What is the EU AI Act?

Learning Objectives

By the end of this chapter, you will be able to:

Explain the purpose and legal basis of the EU AI Act
Describe the six key policy objectives driving this regulation
Understand the risk-based regulatory philosophy
Identify where the AI Act sits in the broader EU regulatory landscape
Recognize the global significance of this first-of-its-kind regulation

The EU AI Act (Regulation (EU) 2024/1689) represents a watershed moment in technology regulation. Adopted on 13 June 2024 and entering into force on 1 August 2024, it is the world's first comprehensive legal framework specifically designed to govern artificial intelligence throughout its lifecycle.

Historical Context and Legal Basis

The AI Act was proposed by the European Commission on 21 April 2021 as part of its broader digital strategy. After extensive negotiations between the European Parliament, Council, and Commission (the "trilogue" process), political agreement was reached in December 2023.

📅 Legislative Timeline

Legal Foundation: The regulation is based on Article 114 TFEU (internal market) and aims to eliminate fragmentation that would arise from divergent national AI rules. Like GDPR before it, it establishes uniform requirements across all 27 EU Member States.

Expert Insight

The AI Act follows the "Brussels Effect" pattern established by GDPR—setting global standards through market access requirements. Companies worldwide must comply to access the 450+ million consumer EU market.

The Six Policy Objectives

The AI Act pursues six interconnected objectives outlined in Recitals 1-5:

Objective	Description	Relevant Recitals
Safety	Ensure AI systems are safe and respect fundamental rights	Recital 1, 4
Legal Certainty	Provide clear rules to facilitate investment and innovation	Recital 2, 5
Enhanced Governance	Strengthen enforcement through coordinated oversight	Recital 3
Single Market	Create unified rules preventing fragmentation	Recital 2
Trustworthy AI	Build public confidence in AI technologies	Recital 4
Global Leadership	Position the EU as a standard-setter for AI governance	Recital 5

The Risk-Based Regulatory Philosophy

The AI Act's defining feature is its risk-proportionate approach. Rather than treating all AI equally, it calibrates obligations based on the potential harm an AI system could cause. This approach draws on the EU's "New Legislative Framework" for product safety while adapting it for AI's unique characteristics.

EU AI Act Risk Classification Pyramid

Prohibited

Banned AI practices

High Risk

Strict requirements apply

Limited Risk

Transparency obligations

Minimal Risk

No specific requirements

The Risk Tiers Explained

🚫 Tier 1: Prohibited Practices (Article 5) — Unacceptable Risk

Complete ban on AI practices threatening fundamental rights
No compliance pathway—these practices are forbidden
Examples: Social scoring, subliminal manipulation, emotion recognition in workplace and education (with medical/safety exceptions)

⚠️ Tier 2: High-Risk AI Systems (Articles 6-51) — High Risk

Extensive compliance requirements before market placement
Mandatory conformity assessment, registration, and ongoing monitoring
Examples: AI in employment, education, credit decisions, law enforcement

ℹ️ Tier 3: Limited Risk AI (Article 50) — Transparency Risk

Primarily transparency obligations
Users must be informed they are interacting with AI
Examples: Chatbots, deepfake generators, emotion recognition (permitted contexts)

✅ Tier 4: Minimal Risk — Low/No Risk

No mandatory requirements under the AI Act
Voluntary codes of conduct encouraged
Examples: AI-enabled video games, spam filters, inventory management

Risk Classification Matrix

Risk Level	Regulatory Burden	Market Access	Examples
Prohibited	N/A—Banned	Denied	Social scoring, manipulative AI
High-Risk	Extensive (Articles 8-15)	Conditional on compliance	Recruitment AI, credit scoring
Limited Risk	Transparency only	Permitted with disclosure	Chatbots, deepfakes
Minimal Risk	None required	Unrestricted	Spam filters, video games

Relationship to Other EU Legislation

The AI Act does not operate in isolation. It forms part of a comprehensive EU digital regulatory framework:

EU Regulatory Ecosystem

EU AI Act

Central AI Regulation

GDPR

Data Protection

NIS2

Cybersecurity

DSA/DMA

Digital Services

Product Safety

CE Marking

The AI Act works alongside existing EU regulations, creating a comprehensive framework

GDPR (2016/679): Governs personal data processing by AI systems
Digital Services Act: Regulates algorithmic systems on online platforms
Digital Markets Act: Addresses AI used by gatekeeper platforms
Product Safety Regulation: Applies to AI embedded in products
Machinery Regulation: Covers AI in industrial machinery
Sectoral Legislation: Medical devices, vehicles, aviation include AI-specific provisions

Compliance Note

AI systems may need to comply with multiple overlapping regulations simultaneously. Article 2(3) excludes AI systems used exclusively for military, defence, or national security purposes. Article 2(2) limits which AI Act provisions apply to high-risk AI systems in products covered by Union harmonisation legislation listed in Annex I Section B.

Global Significance: The "Brussels Effect"

The EU AI Act is expected to become the global benchmark for AI governance, similar to GDPR's impact on data protection:

Market Access Imperative: Any company wanting to sell AI in the EU must comply
Extraterritorial Reach: Applies to non-EU entities whose AI outputs are used in the EU
Standard-Setting: Many countries are studying or adapting the EU approach
First-Mover Advantage: Early compliance positions companies for global market access