EU AI Act

The EU AI Act entered into force in August 2024 and applies in phases. It sorts AI uses into tiers. A small set of practices is prohibited, such as social scoring and emotion recognition in workplaces and schools. High-risk uses, including AI in hiring, education, credit, and access to essential services, carry duties for risk management, logging, human oversight, and documentation. Chatbots and systems that generate synthetic content have transparency duties. Most features, like summaries, search, and drafting, face no new obligations under the Act.

Like the GDPR, it can reach companies outside the EU when their system is placed on the EU market or its output is used there. It also separates roles: the provider who builds and sells an AI system, the deployer who uses it, and the provider of the general-purpose model underneath.

For most builders, the practical work is transparency: telling people they're talking to an AI, marking generated images, audio, and video in a machine-readable way, and labeling deepfakes. Those duties have applied since 2 August 2026. A 2026 amendment postponed high-risk obligations to December 2027 for the listed stand-alone uses and August 2028 for AI built into regulated products, and dates have moved before, so check the current text. Talk to a lawyer about your own situation.