EU AI Act

Framework Name

‍EU Artificial Intelligence Act (EU AI Act)

Type

‍Mandatory

Region / Jurisdiction

‍European Union (applies to any organization worldwide whose AI system is used in the EU or affects people in the EU)

Enforcing Body / Certifying Party

‍National competent authorities in each EU member state, with the European Commission and the European AI Office directly overseeing providers of general-purpose AI models

Penalty / Consequence of Non-Compliance

‍Up to €35 million or 7% of global annual turnover for the most serious violations, such as using a banned AI practice. Lower caps apply to other violations, and small and mid-sized companies benefit from reduced maximums.

What It Is & Why It Matters

The EU AI Act is the world's first comprehensive law regulating artificial intelligence. It sorts AI systems into risk categories, from practices that are banned outright, such as social scoring or manipulative AI aimed at vulnerable groups, to high-risk systems used in hiring, credit, healthcare, and law enforcement, down to AI tools with minimal risk that face few or no obligations. Companies that build, sell, or deploy AI systems affecting people in the EU fall under its scope, regardless of where the company is based.

The EU AI Act reaches its most critical enforcement milestone on August 2, 2026, with binding obligations on transparency and high-risk AI system compliance. The law matters because it sets the global reference point other countries are already measuring their own AI rules against, and because its penalty structure is real and large, even though enforcement is still new. Any company shipping AI features into the EU market needs to know which risk tier its systems fall into well before that obligation lands on its doorstep.

Who Needs It

• You build or sell an AI system used by people or businesses in the EU, even if your company has no EU office
• Your product includes AI used in hiring, credit scoring, healthcare, education, or law enforcement, areas the Act treats as high-risk
• Your product includes a chatbot, AI-generated content, or synthetic media shown to EU users, triggering transparency and disclosure duties
• You provide a general-purpose AI model (a foundation model that others build on top of)