# EU AI Act The world's first comprehensive legal framework for artificial intelligence. Adopted by the European Parliament in March 2024 and entered into force on August 1, 2024, the EU AI Act imposes binding obligations on AI developers and deployers based on a tiered risk classification system. Maximum penalties: €35 million or 7% of global annual turnover, whichever is higher. The EU AI Act matters to this knowledge base as the regulatory foil to U.S. deregulation under [[Donald Trump]]. While Europe builds a legal architecture to govern AI, the Trump administration has systematically dismantled domestic [[AI Safety]] requirements — rescinding the Biden AI Executive Order, stripping NIST's AI safety mandates, and signaling that the U.S. will treat AI regulation as an obstacle to competitiveness. The transatlantic divergence is a live experiment in whether democratic governance of technology is possible, or whether [[Regulatory Capture]] by the [[Tech Oligarchy]] will prevent it. ## Risk-Based Framework The Act classifies AI systems into four tiers based on the risk they pose to fundamental rights, safety, and democratic processes: **Unacceptable Risk (Banned)** — Effective February 2, 2025. These AI practices are prohibited outright: social scoring systems that evaluate people based on social behavior or personality characteristics; untargeted scraping of facial images from the internet or CCTV to build [[Facial Recognition]] databases (directly targeting companies like [[Clearview AI]]); emotion recognition systems in workplaces and educational institutions; AI that exploits vulnerabilities of specific groups (children, disabled persons, economically disadvantaged); predictive policing based solely on profiling; and real-time remote biometric identification in public spaces by law enforcement (with narrow exceptions for missing children, imminent terrorist threats, and serious crime suspects). **High Risk** — The largest and most complex category. Covers AI used in critical infrastructure (energy, transport, water), education (admissions, grading), employment (hiring, firing, task allocation), essential services (credit scoring, insurance, emergency services), law enforcement (evidence evaluation, risk assessment), migration and border control (visa processing, asylum applications, border surveillance), and democratic processes (election influence). High-risk systems face mandatory requirements: risk management systems, data governance, technical documentation, human oversight, accuracy and robustness testing, and registration in a public EU database. Enforcement date: August 2, 2026. **Limited Risk** — AI systems that interact with people (chatbots), generate synthetic content (deepfakes, AI-generated text/images/audio), or perform emotion recognition or biometric categorization. These face transparency obligations: users must be informed they are interacting with AI, and AI-generated content must be labeled. The transparency layer is thin but structurally important — it establishes the principle that people have a right to know when they're dealing with a machine. **Minimal Risk** — Everything else. Spam filters, AI in video games, inventory management. No regulatory requirements. The EU estimates this covers the vast majority of AI systems currently in use. ## General-Purpose AI (GPAI) Rules Effective August 2, 2025. This is where the Act intersects most directly with [[Silicon Valley]] and the frontier AI race. All general-purpose AI models — including [[Foundation Model]] systems like those from [[OpenAI]], [[Google]], [[Anthropic]], [[Meta]], and [[Mistral]] — must comply with transparency requirements: publish sufficiently detailed summaries of training data, comply with EU copyright law, and provide technical documentation. Models classified as presenting **systemic risk** (defined by a compute threshold of 10²⁵ floating-point operations for training, or by Commission designation) face additional obligations: model evaluation, adversarial testing, incident tracking and reporting, cybersecurity protections, and energy consumption reporting. As of 2026, this captures GPT-4-class and above models from the major labs. The GPAI rules include a carve-out for [[Open Source AI]] models — those released under free and open-source licenses with publicly available parameters, architecture, and training methodology are exempt from most transparency requirements (though not from the systemic risk obligations if they cross the compute threshold). This provision was heavily lobbied for by [[Meta]] and [[Mistral]], both of which release open-weight models. ## Implementation Timeline The Act phases in over four years, reflecting the complexity of regulating a fast-moving technology across 27 member states: - **February 2, 2025**: Banned AI practices take effect - **August 2, 2025**: GPAI model obligations and governance structure activate; codes of practice for GPAI due - **August 2, 2026**: High-risk AI system requirements and full enforcement begin; AI Office operational - **August 2, 2027**: Obligations for high-risk AI in biometrics, critical infrastructure, and other Annex I systems - **August 2, 2028**: Obligations for high-risk AI integrated into products already covered by other EU product safety legislation In November 2025, the European Commission proposed timeline adjustments through the **Digital Omnibus** legislative package, acknowledging delays in standards preparation by European standardization bodies. The adjustments affect technical standards development timelines but do not change the core obligation dates. ## The Lobbying War The legislative process was a case study in [[Lobbying]] at the intersection of technology and geopolitics. [[Silicon Valley]] deployed its full influence apparatus: [[OpenAI]]'s [[Sam Altman]] initially threatened that OpenAI might "cease operating" in the EU if the Act was too restrictive — then walked the comments back after backlash. [[Google]], [[Microsoft]], and other major tech companies lobbied hard through trade associations to weaken the GPAI provisions. French President Macron, under pressure from [[Mistral]] and the French AI ecosystem, pushed to exempt general-purpose models from the framework entirely. The counterweight came from European civil society — digital rights organizations, consumer groups, and academic researchers who argued that the Act didn't go far enough, particularly on biometric surveillance and predictive policing. The final text represents a negotiated middle ground, significantly weakened from the European Parliament's more ambitious initial position but still the most comprehensive AI regulatory framework in the world. ## Transatlantic Divergence The EU AI Act's significance sharpens in contrast to U.S. policy under [[Donald Trump]]. The Biden administration's Executive Order 14110 on AI Safety (October 2023) attempted a light-touch regulatory approach through reporting requirements and safety testing guidelines — but Trump rescinded it almost immediately upon taking office in January 2025. The Trump approach treats [[AI Safety]] regulation as an economic handicap: the U.S. will compete through deregulation while Europe regulates. This creates a strategic asymmetry. U.S.-based AI companies must comply with the EU AI Act for any systems deployed in Europe (the "Brussels Effect" — where the EU's regulatory standards effectively become global because companies find it easier to build one compliant product than maintain different versions). But domestically, those same companies face essentially no binding [[Responsible AI]] obligations. The result is a two-tier system where European users get more protections than American users from the same American companies. The deeper tension is structural: the EU AI Act asserts that AI is subject to democratic governance — that elected legislatures can set boundaries on how the technology is developed and deployed. The Trump-era U.S. approach, aligned with [[Tech Oligarchy]] preferences, treats AI governance as properly the domain of the companies building the technology. Whether [[Regulatory Capture]] or democratic accountability wins this contest will shape the trajectory of AI for decades. ## See Also - [[AI Safety]] - [[Responsible AI]] - [[Regulatory Capture]] - [[Lobbying]] - [[Facial Recognition]] - [[Surveillance State]] - [[Foundation Model]] - [[Open Source AI]] - [[Tech Oligarchy]] - [[Donald Trump]] - [[Artificial Intelligence Timeline]]