EU AI Act Adopted — The World's First Comprehensive AI Regulation

On 13 March 2024, the plenary of the European Parliament adopted the Artificial Intelligence Act. The vote was 523 in favour, 46 against, 49 abstaining.

For the first time anywhere, comprehensive law—enforceable by substantial fines—now governed AI.

Risk Tiers

The Act's skeleton is a four-tier classification of AI systems.

1. Unacceptable risk — prohibited outright

• Social scoring by public authorities
• Real-time remote biometric identification (indiscriminate facial recognition in public)
• Systems that exploit human vulnerabilities (age, disability, etc.)
• Subliminal manipulation
• Emotion recognition (in workplaces and educational institutions)

2. High risk — strict obligations

• Hiring, credit scoring, judicial decision-making, law enforcement, education, immigration, critical infrastructure, medical devices, and similar high-stakes domains

Such systems must implement risk management, data governance, transparency, human oversight, and demonstrated accuracy and robustness.

3. Limited risk — transparency obligations

• Chatbots, generative systems (deepfakes, etc.)

Users must be told they are interacting with AI or seeing AI-generated content.

4. Minimal risk — free

• Everything else (spam filters, game AI, …)

Special Regime for General-Purpose AI

General-purpose models like ChatGPT, Claude, and Gemini do not fit cleanly into the risk tiers. The Act creates a separate category, General-Purpose AI Model (GPAI), with a two-tier compute-based regulation.

• All GPAI: maintain a record of training-data copyright compliance, publish model cards, prepare transparency documentation.
• GPAI with systemic risk (>10²⁵ FLOPs): additionally must perform model evaluations, adversarial testing, cybersecurity hardening, and serious-incident reporting.

GPT-4, Claude 3.5, Gemini Ultra and their successors fall into the systemic-risk tier.

Fines

The penalty schedule exceeds the GDPR's.

• Prohibited-practice violations: up to €35 million, or 7% of worldwide annual turnover
• High-risk-obligation violations: up to €15 million, or 3%
• Supplying incorrect information: up to €7.5 million, or 1%

The "percentage of worldwide turnover" formulation has bite even for the largest firms.

Phased Entry into Force

The Council of the EU formally adopted the Act on 21 May 2024. It was published in the Official Journal and entered into force on 1 August. Not all provisions begin together:

• 2 February 2025: prohibited practices apply.
• 2 August 2025: GPAI obligations apply (existing models phase in).
• 2 August 2026: high-risk AI obligations apply in full.
• 2 August 2027: product-safety integration fully applies.

The Brussels Effect

The Act has de facto reach beyond the EU. American companies selling AI systems into the European market must comply; in practice, building one global product to the EU standard is cheaper than maintaining two variants.

This is the latest case of the "Brussels effect"—European regulation becoming the de facto global standard for firms based in countries without equivalent law—first widely observed under GDPR (2018).

Through 2024 and 2025, national AI policies in the United States, Japan, the United Kingdom, and elsewhere have used the AI Act as a reference, explicit or otherwise. The plenary vote of 13 March 2024 will be remembered as the day Brussels emitted the first global standard for AI regulation.