EU AI Act

The EU AI Act became law in 2024 with a phased implementation through 2027. It bans certain AI uses (social scoring, untargeted biometric scraping), imposes strict obligations on "high-risk" AI (medical devices, hiring, law enforcement), and requires transparency for generative AI (disclosure of AI-generated content, training data summaries). General-Purpose AI (GPAI) models with systemic risk (training FLOPs above 10^25) face extra obligations: model evaluations, cybersecurity, and incident reporting.

The AI Act has four risk categories. Unacceptable risk: banned outright. High risk: conformity assessment, risk management system, data governance, documentation, transparency, human oversight, accuracy/robustness/cybersecurity requirements. Limited risk: transparency obligations (disclose AI interaction). Minimal risk: no specific obligations. GPAI providers (OpenAI, Anthropic, Google, Mistral) must provide technical documentation, copyright compliance summaries, and downstream integration guidance. Systemic-risk GPAI (GPT-4 class, Claude, Gemini Ultra, Llama 3.1 405B+) faces additional evaluation and reporting. Fines reach €35M or 7% of global revenue · higher than GDPR.

Article 6 defines high-risk AI via two pathways: Annex I (regulated product) or Annex III (specific use cases). Article 53 covers GPAI provider obligations; Article 55 adds systemic-risk tier requirements including model evaluations and adversarial testing. Codes of practice and harmonized standards are being developed through 2026. Pre-market conformity assessment for high-risk systems may involve notified bodies. Enforcement is by national competent authorities coordinated by the new EU AI Office. Early cases will test the 10^25 FLOPs threshold and how "substantial modification" triggers re-assessment.