The European Union has adopted the first comprehensive legal framework on artificial intelligence: Regulation (EU) 2024/1689, known as the AI Act. Being a regulation, it applies directly in all Member States, with no need for transposing laws. Its provisions come into application gradually, with different deadlines for the various obligations. Rather than memorising articles, it is useful to understand the logic behind it, because that is what determines what changes for those who develop or use AI systems.
The core idea: regulating according to risk
The AI Act does not regulate the technology itself but its uses. The same image recognition model can be used to sort holiday photos or to screen people at the entrance to a venue: the risk to people's rights is very different, and so are the obligations.
The regulation therefore distinguishes several levels.
| Level | Examples | Consequence |
|---|---|---|
| Unacceptable risk | Social scoring of people, manipulation exploiting vulnerabilities | Prohibited practices |
| High risk | Recruitment, access to education, creditworthiness assessment | Strict obligations before and during use |
| Limited risk | Chatbots, artificially generated content | Transparency obligations |
| Minimal risk | Spam filters, AI in video games | No specific additional obligations |
Prohibited practices
Article 5 lists the uses considered incompatible with the Union's values. In summary, they include:
- manipulative or deceptive techniques that significantly distort people's behaviour and cause harm;
- exploiting vulnerabilities linked to age, disability or social or economic situation;
- social scoring systems leading to unjustified detrimental treatment;
- building facial recognition databases through untargeted scraping of images from the internet or CCTV;
- emotion recognition in the workplace and in educational institutions, except for medical or safety reasons;
- real-time remote biometric identification in publicly accessible spaces for law enforcement, except in narrowly defined cases.
High-risk systems
This is the most substantial part of the regulation. High-risk systems include, among others, those used as safety components of products that are already regulated and those deployed in areas listed in a dedicated annex, such as employment and worker management, education, access to essential services, critical infrastructure, justice and migration.
For these systems the requirements include:
- a risk management system throughout the life cycle;
- requirements on the quality of training, validation and test data;
- technical documentation and retention of operating logs;
- transparency towards those using the system, with clear instructions;
- effective human oversight;
- appropriate levels of accuracy, robustness and cybersecurity.
Transparency obligations
For some systems the main issue is that people should know what they are dealing with. For example:
- people interacting with a chatbot must be informed that they are talking to an AI system, unless this is obvious from the context;
- synthetic content, such as generated images, audio or text, must be identifiable as such in the ways prescribed;
- those using emotion recognition or biometric categorisation systems, where permitted, must inform the people exposed to them.
General-purpose AI models
The regulation lays down specific rules for general-purpose models, such as large language models that can be built into a vast range of applications. Their providers must, among other things, draw up technical documentation, provide information to those integrating them into their own products, adopt a policy to comply with copyright and publish a summary of the content used for training. Models presenting systemic risks face further obligations of evaluation and mitigation.
Who has obligations: the roles
The AI Act distinguishes several parties, each with its own responsibilities:
- the provider, who develops a system and places it on the market under its own name;
- the deployer, meaning anyone using an AI system under their authority in the course of a professional activity;
- the importer and the distributor, who bring it into or make it available on the European market.
A company that buys AI-based recruitment software is not the provider, but as a deployer it still has duties, for example using it in accordance with the instructions and ensuring adequate human oversight.
AI literacy
One frequently overlooked obligation concerns everyone: Article 4 requires providers and deployers to take measures to ensure a sufficient level of AI literacy among staff dealing with these systems. In practice this means training people to understand what the tool does, what its limits are and what risks it entails.
The relationship with the GDPR
The AI Act does not replace the GDPR: the two regulations apply together. If an AI system processes personal data, all data protection principles remain valid, from legal basis to minimisation, in addition to the specific obligations of the AI Act.
In short
- The AI Act is Regulation (EU) 2024/1689 and applies directly throughout the Union, in stages.
- It regulates uses of AI according to risk: unacceptable, high, limited, minimal.
- Prohibited practices and obligations for high-risk systems are the heart of the framework.
- Providers and deployers have different responsibilities, including staff training.
- The GDPR continues to apply alongside the AI Act.
