EU AI Act
The EU AI Act — Regulation (EU) 2024/1689 — is the world’s first comprehensive AI law. It applies a risk-based regime: unacceptable-risk practices are banned, high-risk AI systems carry strict obligations for providers and deployers, and limited-risk systems face transparency duties, with phased application from February 2025.
The risk tiers
Prohibited practices — social scoring, manipulative techniques, most real-time biometric identification — applied from February 2025. General-purpose AI (GPAI) model obligations followed in August 2025. High-risk obligations (Annex III use cases like employment screening, credit scoring, critical infrastructure) apply from August 2026–2027, requiring risk management, data governance, technical documentation, human oversight, and conformity assessment.
Enforcement is serious: up to €35 million or 7% of global turnover for prohibited-practice violations, and each member state designates market surveillance authorities. Deployers — not just providers — carry duties: use according to instructions, human oversight, input-data quality, log retention, and fundamental-rights impact assessments for some public-sector uses.
How organizations are responding
The Act deliberately connects to standards: conformity with harmonised CEN-CENELEC standards creates a presumption of conformity, and ISO/IEC 42001 is the management-system layer most organizations adopt to operationalize the obligations — AI inventory, risk process, oversight, and evidence in one system.
Related Standards
- •Regulation (EU) 2024/1689 (EU AI Act)
- •ISO/IEC 42001:2023 — AI management systems
- •CEN-CENELEC harmonised standards (in development)
Free Tools & Resources
Further Reading
Products & Services
Need help with this?
We consult and build across all of these domains — tell us what you are working on.