EU AI Act explained: what Europe's new law means for the tech industry

01The EU AI Act's scope and timeline

The Artificial Intelligence Act, formally adopted by the European Union, establishes a comprehensive regulatory and legal framework for AI within the EU. The regulation entered into force on 1 August 2024, with provisions phased in gradually over the following 6 to 36 months. It applies to any AI system placed on the EU market or whose outputs are used within the EU, regardless of where the provider is headquartered.

The scope is deliberately broad. It covers machine learning models, logic-based systems, statistical approaches, and Bayesian reasoning tools. The Act defines AI systems by their function rather than the underlying technology, meaning future techniques will fall under its umbrella without requiring amendment. Both providers and deployers of AI systems are covered, along with importers, distributors, and manufacturers who integrate AI into products.

02Risk tiers: unacceptable, high, limited, minimal

The Act's core mechanism is a four-tier risk classification. Unacceptable-risk systems are banned outright — these include social scoring by public authorities, manipulative subliminal techniques, and real-time biometric identification in public spaces with limited exceptions. High-risk systems face the most stringent obligations and include AI used in recruitment, education, critical infrastructure, law enforcement, migration, and justice.

Limited-risk systems — such as chatbots, deepfake generators, and emotion recognition tools — must meet transparency obligations. Users must be informed they are interacting with AI, and synthetic content must be labeled. Minimal-risk systems, which include spam filters and video game AI, face no additional requirements beyond voluntary codes of conduct. The majority of AI applications on the market today fall into this minimal category.

03What companies must do to comply

High-risk AI providers must implement a quality management system, maintain technical documentation, conduct conformity assessments before market placement, and register their systems in an EU database. They are required to ensure human oversight, achieve appropriate levels of accuracy and robustness, and log events automatically. Post-market monitoring is mandatory, and serious incidents must be reported.

For general-purpose AI models, the Act introduces obligations based on capability. Models classified as presenting systemic risk — roughly those trained with cumulative compute above a defined threshold — must conduct model evaluations, assess and mitigate systemic risks, and report serious incidents. Foundation model providers must publish technical documentation and provide downstream providers with the information needed to comply.

04Impact on US tech companies operating in Europe

American technology companies represent some of the most heavily affected entities under the AI Act. The regulation's extraterritorial reach means that a US-based provider whose AI outputs are used in the EU must comply, even without a physical EU presence. Firms like OpenAI, Google, Microsoft, and Meta all operate models that fall under the general-purpose AI provisions, triggering documentation, evaluation, and transparency duties.

The compliance burden creates both cost and competitive dynamics. Smaller US startups may struggle with the overhead of conformity assessments and documentation, potentially consolidating market power among larger firms with dedicated legal and compliance teams. Conversely, some argue the Act creates a level playing field by applying the same rules to all providers serving EU users, removing the competitive advantage of operating from a loosely regulated jurisdiction.

05The enforcement mechanism and penalties

Enforcement is structured through national competent authorities in each member state, coordinated by a European AI Office within the Commission. The AI Office oversees general-purpose AI model obligations and can request information, conduct evaluations, and impose measures including market withdrawal. National authorities handle high-risk system enforcement and market surveillance.

Penalties are among the steepest in any regulatory regime. Non-compliance can trigger fines of up to 35 million euros or 7% of global annual turnover, whichever is higher, for violations involving prohibited AI practices. Other violations carry fines of up to 15 million euros or 3% of turnover. For SMEs, the amounts are proportionally lower, but the structural incentive to comply is clear.

06Comparison with US and Chinese AI regulation

The EU's approach contrasts sharply with the fragmented US landscape, where AI governance relies on sectoral regulations, executive orders, and voluntary frameworks rather than a comprehensive statute. The Biden administration's 2023 executive order on AI safety addressed safety testing and reporting requirements but lacked the legislative force and risk-tiered structure of the EU Act. State-level laws, particularly in California and Colorado, have begun filling gaps but create a patchwork.

China has pursued its own regulatory path, focusing on algorithmic recommendations, deep synthesis technology, and generative AI. Its regulations require security assessments for certain systems, content moderation aligned with state priorities, and labelling of AI-generated content. The Chinese model is more prescriptive about content and use cases, while the EU model centres on risk classification and process obligations.

07What this means for the future of AI governance

The AI Act is likely to function as a global benchmark through the Brussels Effect — companies worldwide may adopt EU-compliant standards to avoid maintaining separate product lines. This regulatory first-mover advantage was previously demonstrated with GDPR, which shaped privacy practices globally despite being EU-specific legislation.

However, critics warn that over-regulation could push AI development outside Europe. There are concerns about innovation chilling effects, particularly for open-source model providers who face uncertainty about their obligations. The real test will come in implementation: how effectively the AI Office and national authorities enforce the rules, how proportionate their interventions prove to be, and whether the risk-tiered approach delivers safety without stifling progress.