What is the EU AI Act?

Remember when cookie banners showed up on nearly every website? That came after Europe passed a privacy law, and companies around the world changed their sites to follow it. The European Union (EU) has now written a broad law for artificial intelligence (AI), called the AI Act. The European Commission calls it the first broad legal framework for AI anywhere in the world. And like the privacy law, it reaches companies far outside Europe.¹

The AI Act doesn't treat AI as one thing. It looks at what a system is used for, and how much harm that use could do. The same kind of software might sort your vacation photos or screen job applications. The law treats them differently. Its organizing idea is a ladder of risk: the greater the possible harm, the stricter the rules.¹

The European Commission describes four levels of risk.

• Unacceptable risk: a short list of uses that are banned outright.
• High risk: uses that can affect people's safety or rights, which face strict checks.
• Limited risk: chatbots and AI-made content, which must be open about what they are.
• Minimal risk: most everyday AI, which gets no new rules.

Most of the AI you use sits on that bottom rung. That may come as a surprise.¹

The banned list is short. It's also specific. It includes social scoring, where people are rated on their behavior in ways that can lead to unfair treatment. It covers AI that manipulates people in harmful ways or exploits their vulnerabilities. And it bans some uses of face recognition, like scraping photos from the internet to build a face database.¹

High-risk uses are where the law asks the most. They include AI used in hiring, in deciding who gets into a school or how students are assessed, and in credit scoring for loans. Systems like these have to manage their risks, keep records of how they run, and be built so a person can oversee them and step in when something goes wrong. When a decision can shape someone's job, schooling, or money, the law asks for more care.¹²

Further down the ladder, the rules get lighter. Chatbots have to let people know they're talking to a machine, and deepfakes and some AI-written public text have to be labeled. Topic 54, "Do I have to label AI-made content?", covers that part. For most other AI, like spam filters or the computer players in video games, the Act adds no new duties.¹³

The law follows the people it protects. Where a company is based matters less than where its AI is used. A company based anywhere, including the United States (US), has to follow it when it offers AI systems in the EU, or when its system's output is used there. So the chatbot on a US company's website may need to meet EU rules for its European visitors.²⁴⁵

Expect more headlines. You'll keep seeing the AI Act in the news, often with a date attached, because its parts phase in over several years and lawmakers have been adjusting the schedule. If it touches your work, a lawyer who knows EU law is the person to ask. And when a story says the Act requires something, here's a good question to bring to it: which rung of the ladder is it talking about?