EU AI Act and rules for AI

In short: The EU AI Act is the world’s first comprehensive AI law. It sorts AI systems by risk and sets strict requirements for high-risk applications. It has applied in stages since 2024.

In more detail: The higher the risk to fundamental rights and safety, the stricter the duties. The deadlines run in stages until 2027.

In detail

• Prohibited: social scoring by authorities, certain biometric mass surveillance, manipulation by subliminal techniques, emotion recognition at work and in school (with exceptions).
• High risk: recruitment, credit, access to education, justice, law enforcement, critical infrastructure, medical devices. Duties: risk management, data quality, documentation, human oversight, accuracy and security.
• Transparency: users must notice they are talking to an AI. AI-generated images, audio and video (deepfakes) must be labelled.
• General-purpose models (GPAI): providers of large models must supply technical documentation, a copyright policy and a summary of the training data. Models with “systemic risk” face additional tests and reporting.
• Penalties: up to 35 million euros or 7% of worldwide turnover for the most serious violations.
• Copyright: text and data mining with an opt-out option, disputes are before the courts.
• Other areas of law: GDPR (personal data), product liability, copyright.
• Note: guidance, not legal advice. Details and deadlines change, when in doubt read EU sources.

See also: Bias, fairness and data quality, Data protection in a small business