The European Union (EU)’s Artificial Intelligence Act provides a comprehensive set of regulations for the accountability, transparency, and oversight of artificial intelligence (AI) technologies. Initially proposed by the European Commission in 2021, the EU AI Act went into effect on August 1, 2024.

For purposes of the AI Act, an “AI system” is defined as a “machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.”

The AI Act broadly categories risks from AI practices into four categories—unacceptable risk, high risk, limited risk, and minimal risk. AI systems that pose an unacceptable level of risk include those that pose a threat to basic human rights. Examples may include emotion recognition systems, social scoring systems, biometric identification systems, and predictive policing systems. Such AI practices are generally prohibited under the AI Act.

The second category applies to high-risk AI systems. Such practices may negatively affect safety or basic human rights, but they do not rise to the level of posing an unacceptable level of risk to society. High-risk AI systems must comply with strict requirements such as maintaining continuous risk mitigation systems, adopting data governance practices, and ensuring data collection techniques abide by strict quality control standards. Examples of high-risk AI systems may include AI in medical devices, critical energy infrastructure, and educational training contexts.

AI systems falling under the limited risk category are subject to transparency obligations under the AI Act. Chatbots are the most obvious example of a limited risk AI system. The transparency obligations require companies to inform users that they are interacting with a machine. The final category is minimal risk AI, which is not subject to enhanced obligations under the AI Act. Examples of minimal risk AI include AI-enabled video games or spam filters.

The EU’s AI Act also establishes rules for general-purpose AI (GPAI) models. Examples of GPAI models include Meta’s Llama 3 open-source AI model and OpenAI’s GPT-4. GPAI models can perform a wide range of complex tasks, think abstractly, and adapt to new situations. They are sometimes referred to as foundation models. A GPAI model may be classified as posing a systemic risk under the AI Act if it has high-impact capabilities that could have foreseeable negative effects on society. Providers of GPAI models classified as posing a systemic risk must satisfy additional conditions such as maintaining enhanced cybersecurity protections and reporting serious incidents to the EU AI Office.

Enforcement of the AI Act is overseen by the EU AI Office, which was established in February 2024 and sits within the European Commission. Non-compliance with the AI Act can result in severe penalties. Companies and organizations that violate the AI Act can be fined for up to the greater of 35 million EUR or 7% of their global annual revenues. The AI Act applies to AI providers outside of the EU if they offer AI services within the EU. Therefore, it is important for AI providers to have an intricate understanding of the AI Act in order to remain in compliance.