The World's First Comprehensive AI Law Is in Effect

On August 2, 2024, the European Union's Artificial Intelligence Act entered into force — the first comprehensive regulatory framework for AI in history. By August 2026, most of its core provisions are fully applicable. Whether your organisation is headquartered in Berlin or San Francisco, the EU AI Act matters to you: any company that offers AI-powered products or services to European users must comply. With the EU representing roughly 450 million consumers and 27 national markets, this effectively makes the EU AI Act a global regulation for any organisation operating at scale.

This is not a compliance checkbox. The EU AI Act is a fundamental shift in how AI systems must be designed, documented, and governed. Engineers who build AI systems — not just lawyers and compliance officers — need to understand its requirements, because many of the obligations (technical documentation, risk management systems, accuracy testing, human oversight mechanisms) are engineering responsibilities, not policy ones.

The Four-Tier Risk Classification

The EU AI Act's core architecture is a risk-based classification system. AI systems are categorised into four tiers based on the potential harm they can cause, with regulatory requirements escalating at each level.

Tier 1: Unacceptable Risk (Prohibited)

These AI applications are banned outright. The prohibition took effect February 2025. Banned practices include: social scoring systems by governments or public authorities; real-time biometric surveillance in public spaces (with narrow law enforcement exceptions); AI systems that manipulate human behaviour in ways that cause harm or exploit psychological vulnerabilities; systems that exploit the vulnerabilities of specific groups (children, people with disabilities); and AI-based subliminal advertising that influences decisions without the person's awareness.

Tier 2: High-Risk AI (Extensive Requirements)

High-risk AI systems face the most demanding compliance requirements, which became fully applicable in August 2026. High-risk categories include:

  • AI used as safety components in products covered by existing EU product legislation (machinery, medical devices, aviation, vehicles)
  • Biometric identification and categorisation systems
  • Management and operation of critical infrastructure (water, gas, electricity, traffic)
  • Education and vocational training (determining access to institutions, assessing students)
  • Employment and worker management (CV screening, hiring decisions, performance monitoring)
  • Access to essential private services and public services (credit scoring, insurance)
  • Law enforcement (risk assessment, polygraphs, evaluating evidence)
  • Migration and border management
  • Administration of justice and democratic processes

Tier 3: Limited Risk (Transparency Obligations)

Chatbots must disclose to users that they are interacting with AI. Systems that generate synthetic content (deepfakes, AI-generated images, video) must label it as AI-generated. Emotion recognition systems must inform users they are being analysed. These obligations are designed to prevent deception, not restrict use.

Tier 4: Minimal Risk (No Specific Requirements)

Most general-purpose AI applications fall here: spam filters, AI-powered games, inventory management systems, recommendation systems for content. No specific regulatory obligations apply, though the Act encourages voluntary codes of conduct.

High-Risk AI: What Engineering Teams Must Deliver

If your AI system falls into a high-risk category, the engineering obligations are substantial. The Act requires:

  • Risk management system: Documented identification and analysis of known and foreseeable risks, implemented throughout the development lifecycle and updated post-deployment as new risks are identified.
  • Data governance: Training, validation, and test datasets must meet quality criteria relevant to the intended purpose. Data must be relevant, representative, and free of known errors. Data biases that could lead to discrimination must be identified and mitigated.
  • Technical documentation: Comprehensive documentation describing the system's intended purpose, design specifications, training methodology, validation and testing results, and performance metrics. This must be produced before deployment and kept current throughout the system's lifecycle.
  • Transparency and provision of information: Systems must include instructions for use, including performance limitations, known risks, and conditions under which the AI may fail to perform as intended.
  • Human oversight: High-risk systems must be designed to allow human oversight and intervention. This means implementing override mechanisms, ensuring that outputs are interpretable by human reviewers, and designing systems that can be paused, corrected, or disabled.
  • Accuracy, robustness, and cybersecurity: Systems must achieve appropriate levels of accuracy for their intended purpose, be resilient against errors and inconsistencies, and include measures against adversarial attacks.
  • Logging: Automatic logging of events sufficient to enable post-hoc monitoring, including at minimum the period of use, the database queried, input data matches, and the identity of persons involved in verification.

General-Purpose AI Model (GPAI) Obligations

The Act introduces specific obligations for providers of general-purpose AI models — the foundation models like GPT-5, Claude, and Gemini that power downstream applications. Since August 2025, GPAI providers must: maintain technical documentation, provide information to downstream deployers about the model's capabilities and limitations, comply with EU copyright rules, and publish a summary of training data used.

GPAI models classified as posing systemic risks face additional requirements. The threshold is based on the computing power used during training: currently set at models trained with more than 10²⁵ FLOPs. Models above this threshold must undergo model evaluation, adversarial testing (red-teaming), incident tracking and reporting, and implement adequate cybersecurity protections. This directly affects the largest frontier models from OpenAI, Google, Anthropic, and Meta.

Conformity Assessment and CE Marking

Before a high-risk AI system can be deployed in the EU, it must undergo a conformity assessment — a structured evaluation demonstrating that the system meets all applicable requirements. For most high-risk AI systems, conformity assessment is self-assessment: the provider conducts the assessment against the Act's requirements, maintains documentation, and issues an EU Declaration of Conformity. For AI systems in safety-critical domains already covered by existing EU product legislation (medical devices, machinery, aviation), conformity assessment may require third-party notified body involvement.

Systems that pass conformity assessment receive a CE marking and are registered in the EU database for high-risk AI systems before deployment. This database is publicly accessible, enabling market surveillance authorities to identify deployed high-risk systems.

Penalties for Non-Compliance

The EU AI Act penalties are structured by violation severity:

  • Violations involving prohibited AI practices: Up to €35 million or 7% of global annual turnover, whichever is higher
  • Non-compliance with requirements for high-risk systems, GPAI obligations, or other provisions: Up to €15 million or 3% of global annual turnover
  • Providing incorrect, incomplete, or misleading information to authorities: Up to €7.5 million or 1.5% of global annual turnover

For large technology companies, these figures can reach billions of euros. The regulation also grants EU member states the ability to impose additional penalties at the national level, and allows individuals to seek redress through national courts when high-risk AI systems violate their rights.

The Global Regulatory Landscape

The EU AI Act is the most comprehensive AI regulation globally, but it operates within a broader international governance context:

United States: No comprehensive federal AI legislation as of 2026. The US approach is sectoral and agency-led: the FDA regulates AI in medical devices; the SEC addresses AI in financial markets; the FTC enforces consumer protection against deceptive AI; the EEOC monitors AI in employment decisions. Several states (California, Colorado, Illinois) have enacted targeted AI legislation. The result is a patchwork of sector-specific requirements that is more fragmented and less predictable than the EU's approach.

United Kingdom: Positioned as a pro-innovation alternative, the UK empowers existing regulators to apply five core AI principles (safety, transparency, fairness, accountability, contestability) rather than creating new AI-specific legislation. The UK's AI Safety Institute conducts technical evaluations of frontier models. This principles-based approach is designed for flexibility but provides less legal certainty than the EU's rules-based framework.

China: Has enacted targeted AI regulations addressing algorithmic recommendation systems, generative AI services, and deep synthesis (deepfakes). Generative AI services must ensure content aligns with "core socialist values" and must implement content moderation. These regulations emphasise content control and national security alongside more conventional data protection concerns.

The practical global compliance strategy is the "Brussels effect": build your AI governance framework to the EU AI Act standard (the highest applicable bar), then adapt for local requirements. Organisations achieving EU compliance are typically 80% of the way toward compliance in other jurisdictions. The EU AI Act is becoming the de facto global baseline — similar to how GDPR shaped global data privacy practice.

What Engineering Teams Should Do Now

The compliance process for engineering teams follows five steps:

  1. Inventory: Document all AI systems your organisation builds or uses. For each, identify the intended purpose, the data sources, and the decisions it influences.
  2. Classify: Apply the Act's four risk tiers to each system. Most are minimal risk. Flag any that touch employment, credit, education, law enforcement, critical infrastructure, biometrics, or safety.
  3. Gap analysis: For high-risk systems, compare current documentation, testing, and oversight mechanisms against the Act's requirements. Most gaps will be in technical documentation, logging, and human oversight mechanisms.
  4. Implementation: Build the required risk management system, update data governance processes, create technical documentation, implement logging, and add human oversight mechanisms. These are engineering tasks, not just policy tasks.
  5. Ongoing monitoring: The Act requires post-market monitoring. Establish automated monitoring for performance degradation, bias drift, and adverse events. Maintain the documentation current as the system evolves.

The engineering reality is that high-quality AI systems — well-documented, rigorously tested, with clear failure modes and human oversight — align naturally with the Act's requirements. The compliance burden is primarily administrative for teams already following engineering best practices. For teams that have not been documenting their AI systems systematically, the Act provides a useful forcing function to do so.