The EU AI Act sets new rules for high-risk systems and transparency

A risk-based approach to AI

The EU AI Act, formally known as Regulation (EU) 2024/1689, classifies artificial intelligence based on the level of harm it can cause. Unlike some regulations that focus on the underlying technology, this law looks at the specific use cases of the machine-based systems. It defines an AI system as a machine that infers outputs like predictions, content, or decisions from the input it receives.

At the highest level of restriction, the Act outright bans eight categories of AI practices. These include the use of subliminal techniques to distort behavior, social scoring, and the scraping of facial images without consent. It also prohibits emotion recognition in schools and workplaces, as well as most real-time remote biometric identification by police in public spaces.

For most other applications, the law creates a tiered system of requirements. Systems that affect fundamental rights—such as those used in policing, education, employment, or credit scoring—are classified as high-risk. These systems must adhere to heavy compliance duties, while low-risk applications like spam filters are left largely alone. As PPC Land reported, this structure ensures that the most sensitive human interactions are the most regulated.

Compliance for high-risk systems

Companies providing high-risk AI systems face a rigorous set of requirements to ensure safety and reliability. These providers must implement a risk management system and maintain high standards for the data used to train their models. They are also required to keep technical documentation, automatic logs, and designs that allow for human oversight.

To enter the market, these systems must pass a conformity assessment and be registered in an official EU database. They must also be affixed with a CE mark, which is a standard mark of conformity for products sold in the European Economic Area. Deployers of these systems, such as banks or public bodies, may also have to perform fundamental rights impact assessments.

The timeline for these obligations was recently clarified through the Digital Omnibus, a 2025 amending package. While some high-risk obligations for certain sectors move to December 2, 2027, others for specific products will be due by August 2, 2028. This staggered rollout gives companies a window to align their technical infrastructure with the new legal standards.

Transparency and generative AI

The Act also introduces specific transparency duties for systems that interact with the public or generate content. Chatbots are required to inform users that they are communicating with a machine rather than a human. Additionally, providers of generative systems must ensure that their outputs are marked in a machine-readable way to help identify synthetic content.

Users and deployers also have responsibilities regarding the content they share. For instance, anyone publishing a deepfake or AI-generated text intended to inform the public must clearly label it as such. These rules are designed to prevent the spread of misinformation and ensure that people can distinguish between human and machine-generated interactions.

General-purpose AI models, which power many of today's popular chatbots and image generators, are governed by a separate set of rules. Since August 2, 2025, these providers must provide technical documentation and a public summary of their training content. Models that carry systemic risk due to their massive scale face even stricter requirements, including incident reporting and cybersecurity duties.

Enforcement and penalties

The EU has established a multi-layered enforcement architecture to ensure the Act is followed. The Commission's AI Office will have exclusive supervision over general-purpose models and AI systems embedded in very large online platforms. For most other systems, enforcement will be handled by national market surveillance authorities in each member state.

The penalties for breaking these rules are significant and designed to deter large-scale non-compliance. For prohibited practices, companies can be fined up to 35 million euros or 7% of their worldwide annual turnover. Other breaches of the Act can result in fines of up to 15 million euros or 3% of turnover, while providing incorrect information can cost up to 7.5 million euros or 1%.

Small and medium-sized enterprises (SMEs) and small mid-caps are granted some relief under these rules. For these smaller entities, the law specifies that the lower of the two figures—the fixed amount or the percentage of turnover—will apply. This distinction aims to protect smaller innovators while still maintaining a high standard of safety for the broader market.

The road ahead for AI

While the Act entered into force in August 2024, the transition period is still ongoing as standards are developed. Many companies have expressed concerns about the speed of implementation, with some requesting postponements for high-risk rules. However, the Commission has maintained that there is no pause, and the deadlines remain fixed to ensure a predictable legal environment.

One of the primary challenges moving forward is the creation of harmonized standards. These are technical specifications that give providers a presumption of conformity with the law. While the first standard for quality management was referenced in late 2026, many other areas still lack a finalized harmonized standard, which could create uncertainty for developers.

The AI Office is already beginning its work by requesting information from major companies like OpenAI and Anthropic. These requests are not findings of a breach but are part of the ongoing effort to understand security and monitoring practices. As the 2026 and 2027 deadlines approach, the focus will shift toward practical compliance and the integration of these rules into daily business operations.