How Does the EU AI Act Work?

The Act categorises AI applications into three risk levels. Firstly, applications and systems that create an unacceptable risk, such as government-run social scoring, are banned entirely. These types of applications are considered too dangerous to be permitted.

Secondly, high-risk applications, like CV-scanning tools that rank job applicants, are subject to specific legal requirements. These applications must adhere to regulations designed to mitigate their potential risks.

Lastly, applications not explicitly banned or listed as high-risk are largely left unregulated. These lower-risk applications do not face stringent legal requirements and are given more freedom in their development and deployment.

The AI Act introduces rules for general-purpose AI models, which are versatile AI systems capable of performing tasks like generating human-like text. General-purpose AI models include OpenAI’s GPT, Google’s Gemini, and Anthropic’s Claude.

These models are increasingly used as components in various AI applications. The Act aims to ensure transparency throughout the value chain and address potential systemic risks associated with these powerful models.

When Does the EU AI Act Become Fully Applicable?

The Act will become fully applicable 24 months after its commencement. Its implementation will occur in phases: bans on prohibited practices will take effect after six months, codes of practice will be introduced after nine months, rules for general-purpose AI and governance will be established after 12 months, and obligations for high-risk systems will come into force after 36 months.

Member States are required to designate national competent authorities by 2 August 2025. These authorities will oversee the application of the Act’s rules for AI systems and conduct market surveillance activities. At the EU level, the Commission’s AI Office will play a central role in implementing the AI Act and enforcing regulations related to general-purpose AI models.

To support the Act’s implementation, three advisory bodies will be involved. The European Artificial Intelligence Board will ensure consistent application of the Act across EU Member States and facilitate cooperation between the Commission and the Member States.

A scientific panel of independent experts will provide technical advice and can alert the AI Office to any risks associated with general-purpose AI models. Finally, an advisory forum, comprising a diverse range of stakeholders, will offer further guidance to the AI Office.

What Happens if a Company Breaches the Rules?

Under the EU AI Act, penalties for non-compliance vary based on the nature of the violation. If a prohibited AI practice is violated, administrative fines can reach up to £30 million ($38 million) or 7% of the offender’s total worldwide annual turnover from the previous financial year, whichever is higher. 

For other breaches, like failing to meet specific obligations, fines can go up to £12.8 million ($16.3 million) or 3% of the annual turnover. Providing false or incomplete information to authorities can result in fines of up to £6.4 million ($8.1 million) or 1% of the annual turnover. 

For small and medium-sized enterprises (SMEs), including startups, the fines are capped at lower percentages of amounts to ensure they remain manageable and do not jeopardise their economic viability.

The EU Artificial Intelligence Act has introduced an EU AI Act Compliance Checker to help European SMEs and startups better understand whether they might have any legal obligations under the EU AI Act or whether they may implement the Act solely to make their business stand out as more trustworthy.

What are the Next Steps?

To bridge the transitional period before full implementation, the Commission has launched the AI Pact. This initiative invites AI developers to voluntarily adopt key obligations of the AI Act ahead of the legal deadlines. 

The Commission is also developing guidelines to define and detail how the AI Act should be implemented and facilitating co-regulatory instruments like standards and codes of practice. 

The Commission opened a call for expression of interest to participate in drawing-up the first general-purpose AI Code of Practice, as well as a multi-stakeholder consultation giving the opportunity to all stakeholders to have their say on the first Code of Practice under the AI Act.