The EU AI Act: The World’s First Major AI Law Is Now in Force — Here’s What You Need to Know

On August 1, 2024, the European Union’s Artificial Intelligence Act entered into force — and the world of AI regulation changed forever. For the first time in history, a major economic bloc enacted comprehensive, legally binding rules governing how artificial intelligence may be developed, deployed, and used across virtually every sector of the economy.

The EU AI Act is to AI what GDPR was to data privacy: a regulatory earthquake whose aftershocks will be felt globally, not just in Europe. Companies in the US, Asia, and beyond are already restructuring AI governance programs, legal teams, and product pipelines to comply. Understanding the Act — its scope, its requirements, its penalties, and its timelines — is now a baseline competency for anyone building or deploying AI in 2026.

The Core Logic: A Risk-Based Framework

Unlike blanket prohibitions or voluntary guidelines, the EU AI Act organizes AI systems into four risk tiers. Your obligations depend entirely on where your AI falls in this hierarchy.

Tier 1: Unacceptable Risk — BANNED

These AI practices are outright prohibited as of February 2, 2025:

• Social scoring by public authorities: Using AI to rate citizens’ trustworthiness for government services, as practiced in some countries
• Subliminal manipulation: AI systems deploying techniques that bypass conscious decision-making to materially distort behavior against users’ interests
• Predictive policing based solely on profiling: Using AI to predict criminal behavior from demographic or behavioral patterns alone, without additional evidence
• Emotion recognition in workplaces and schools: Except for specific medical or safety use cases
• Real-time biometric identification in public spaces for law enforcement: With narrow, court-approved exceptions

Any company operating such systems in the EU after February 2, 2025 faces the highest tier of penalties.

Tier 2: High Risk — Strict Requirements

High-risk AI systems are permitted but face mandatory compliance requirements. The Act defines eight critical application domains as high-risk:

1. Biometric identification (beyond the banned use cases)
2. Critical infrastructure (water, energy, transport)
3. Education and vocational training (student assessment, admission decisions)
4. Employment and HR (CV sorting, interview scoring, performance monitoring)
5. Essential private and public services (credit scoring, insurance, benefits decisions)
6. Law enforcement (evidence evaluation, polygraph systems)
7. Migration, asylum, border control
8. Administration of justice (case outcome prediction)

High-risk system requirements include:

• Risk management system (documented and continuously updated)
• High-quality training, validation, and testing datasets
• Technical documentation and logging
• Transparency and provision of information to users
• Human oversight mechanisms
• Robustness, accuracy, and cybersecurity standards

Tier 3: Limited Risk — Transparency Obligations

AI systems like chatbots, deepfake generators, and emotion recognition tools must clearly disclose that users are interacting with an AI. This is the “you must know you’re talking to a bot” requirement.

Tier 4: Minimal Risk — No Specific Obligations

AI-powered spam filters, recommendation systems, AI in video games — these carry no specific Act requirements, though general EU law still applies.

The GPAI Rules: For Foundation Model Providers

The August 2, 2025 deadline brought in requirements specifically for General-Purpose AI (GPAI) model providers — the companies building foundation models like GPT, Gemini, Llama, Claude, or Mistral.

All GPAI providers operating in the EU must:

1. Technical documentation: Comprehensive documentation of model architecture, training data, training procedures, computational requirements, and performance characteristics
2. Downstream provider support: Provide technical information to companies building on top of their models
3. Copyright compliance: Implement policies respecting EU copyright law; train models on lawfully obtained data
4. Training data transparency: Publish “sufficiently detailed summaries” of training data content

GPAI models with systemic risk (those exceeding 10^25 FLOPs in training compute, roughly the GPT-4 tier) face additional requirements:

• Model evaluation and adversarial testing (red-teaming)
• Incident reporting to the EU AI Office
• Cybersecurity measures for the model and its infrastructure
• Energy efficiency reporting

The Enforcement Calendar: Key Dates

August 2, 2026 is the critical deadline. Companies with high-risk AI systems must have completed:

• Full conformity assessment
• Technical documentation
• CE marking (where required)
• Registration in the EU AI systems database

Penalties: The Numbers That Are Focusing Minds

The EU AI Act’s fines are among the most significant in tech regulatory history:

For SMEs and startups, proportionate caps apply, but the percentage-of-turnover structure means large companies face enormous absolute numbers. A company with €10 billion in revenue could face a €700 million fine for prohibited AI practices.

Compare this to GDPR’s maximum: 4% of global annual turnover. The AI Act’s 7% cap is stronger.

Extraterritorial Scope: Why This Affects the Entire World

Like GDPR, the EU AI Act has extraterritorial application. You must comply if:

• Your AI system is placed on the EU market
• You offer AI services to EU users
• The output of your AI system is used in the EU

This means a US company that offers an AI HR screening tool to European companies must comply with high-risk provisions — even if it has no office in Europe. This is precisely the pattern established by GDPR, which has proven effective.

Global companies building AI products are therefore not building separate compliance programs for Europe — they’re building their global AI governance to EU standards and applying them everywhere.

Who’s Responsible for What?

The Act distinguishes between roles:

Provider: The entity that develops the AI system and places it on the market. Bears primary compliance responsibility for high-risk systems.

Deployer: Organizations that use a high-risk AI system in professional contexts. Must implement user instructions, maintain logs, perform human oversight, report serious incidents.

Importer/Distributor: Entities that distribute AI systems. Must verify the provider has met requirements.

This creates a compliance chain: providers can’t simply push obligations to deployers, and deployers can’t assume providers handled everything.

The EU AI Office: New Enforcement Authority

The Act established the EU AI Office within the European Commission — the first EU-level body with direct enforcement power over AI. It:

• Oversees GPAI model compliance across the EU
• Investigates AI system incidents
• Coordinates with national competent authorities
• Can conduct model evaluations and order access to training data

Individual EU member states designate National Competent Authorities for domestic enforcement — similar to how data protection authorities (DPAs) enforce GDPR nationally. France’s CNIL, Germany’s BfDI, and Ireland’s DPC are among the most active.

What Companies Are Actually Doing to Prepare

Based on compliance consulting firm reports and enterprise surveys:

Conducting AI Inventories

Most enterprises are finding they have far more AI systems deployed than anyone realized. Shadow AI — tools adopted by individual teams without formal procurement — is a major discovery in most audits.

Building AI Governance Frameworks

Companies are appointing AI Compliance Officers, forming AI Ethics Boards, and creating internal processes for evaluating AI systems against the Act’s risk tiers before deployment.

Updating Vendor Contracts

Procurement teams are adding “EU AI Act compliance” clauses to contracts with AI vendors, software providers, and cloud platforms.

Investing in Technical Documentation

The Act’s documentation requirements — training data, model architecture, performance testing — require engineering teams to produce records they often haven’t maintained historically.

Red-Teaming and Adversarial Testing

GPAI providers with systemic risk models are building red-teaming capabilities. This was previously done informally; the Act makes it a legal requirement.

The Global Ripple Effect

The EU AI Act is already influencing AI policy worldwide:

• UK: The AI Safety Institute, established after the Bletchley Park Summit, is coordinating voluntary safety testing for frontier models
• Canada: The proposed Artificial Intelligence and Data Act (AIDA) explicitly references the EU approach
• Brazil: National AI Strategy aligns with EU risk-tiering principles
• Singapore: The Model AI Governance Framework is being updated toward binding requirements
• China: Has its own AI regulations but is watching EU enforcement outcomes closely

The “Brussels Effect” — the tendency of EU regulations to become de facto global standards because multinational companies find it easier to implement one global policy than fragmented regional ones — is operating in full force with AI.

What to Do Right Now

For any organization building or deploying AI touching European markets:

1. Map your AI systems: Inventory every AI tool in use, including embedded AI in SaaS products
2. Classify by risk tier: Which systems are high-risk under the Act’s definitions?
3. Assess GPAI exposure: If you’re providing foundation models or services built on them, understand your obligations
4. Build documentation: Start creating technical documentation for AI systems now — this takes months, not weeks
5. Train your team: The AI literacy obligations (Article 4) require everyone who develops or manages AI to have appropriate competency
6. Engage legal counsel: AI Act compliance is complex enough that specialist legal advice is now a necessity, not a luxury

Conclusion

The EU AI Act is the most consequential AI policy development in history. It transforms AI from an unregulated space into a regulated industry — with clear rules, clear accountability, and serious consequences for non-compliance.

The companies that will benefit most from this regulatory moment are not necessarily those with the most powerful AI. They’re the ones with the most trustworthy AI — documented, tested, human-overseen, and transparently communicated to the users it affects.

The deadline of August 2, 2026 is not far away. For organizations that haven’t started their compliance journey, the time is now.

Quick Take: The EU AI Act’s extraterritorial reach means any Algerian company deploying AI that touches EU markets or partners must comply — this is not optional. Algeria currently has no domestic AI regulatory framework, making the EU Act a de facto reference standard for Algerian enterprises going global. The Ministry of Digital Economy and Startups should accelerate work on a national AI governance strategy, drawing on the EU’s risk-based model while adapting it to Algeria’s economic priorities.