EU AI Act

The EU AI Act (regulation EU 2024/1689) is the world's first horizontal AI-regulation framework. Adopted in June 2024, it applies progressively between 2025 and 2027 depending on AI-system categories.

The regulation classes AI systems into four risk levels: unacceptable risk (banned), high risk (strict obligations), limited risk (transparency obligations), minimal risk (free). The pivot for most vendors is the "high risk" category, framed by articles 8 to 15 of the regulation.

Every actor in the AI chain is concerned, with differentiated obligations:

• Providers: develop and place an AI system on the market. Bear most obligations.
• Deployers: use an AI system as part of their professional activity. Obligations on proper use and human oversight.
• Importers and distributors: obligations to verify compliance before market placement.
• GPAI (General-Purpose AI) foundation models: specific regime, already applicable since August 2025.

AI is not high-risk by its technology (LLM, vision, classical ML) but by its use case. High-risk uses are listed in Annex III: biometrics, critical infrastructure, education, employment (recruitment, evaluation), access to essential services (credit, insurance, social benefits), law enforcement, migration, justice.

• 2 February 2025: bans on prohibited AI (social scoring, cognitive manipulation, real-time biometric identification without supervision).
• 2 August 2025: obligations for GPAI model providers.
• 2 August 2026: obligations for high-risk AI systems (articles 8-15).
• 2 August 2027: CE marking of high-risk AI systems, harmonized CEN/CENELEC standards.

• Prohibited AI practices: fine up to €35m or 7% of global annual revenue.
• Breach of high-risk AI obligations: fine up to €15m or 3% of global annual revenue.
• Providing incorrect information to authorities: fine up to €7.5m or 1% of global annual revenue.

The seven key obligations of articles 8-15:

• Continuous risk-management system (art. 9), identification, analysis, risk mitigation.
• Data governance (art. 10), representative datasets, identified and mitigated biases.
• Technical documentation (art. 11), Annex IV file per high-risk AI system.
• Log retention (art. 12), minimum 6 months of operation logs.
• Transparency and user information (art. 13), instructions for deployers.
• Human oversight (art. 14), human ability to understand, detect, intervene.
• Accuracy, robustness, cybersecurity (art. 15), appropriate level, documented, resistant to adversarial attacks.