Should an AI system used to screen job applicants face the same rules as a voice-activated toy? The European Union’s AI Act takes a risk-based approach: systems with greater potential to harm safety or fundamental rights face stricter requirements. It entered into force on August 1, 2024, with provisions being phased in through 2026. section 10.30 section 10.17
The level of risk shapes what happens to a system:
- Unacceptable-risk uses are banned. Examples include social scoring and certain uses of real-time remote biometric identification; some law-enforcement exceptions apply to the latter. section 10.30
- High-risk uses, including AI involved in hiring, educational access, and financial-services access, face assessment before release and throughout their lifecycle. Requirements include data governance, accuracy, nondiscrimination, risk management, records, documentation, human oversight, and registration in an EU-wide database. section 10.30
Figure 10.7 The four risk categories in the AI Act
The four-risk-category figure gives an overview of the Act’s tiered approach. section 10.30
The Act also places obligations on developers of foundation and general-purpose AI models. These include using suitable datasets, maintaining technical documentation and intelligible instructions, and publishing summaries of training data, including copyrighted material. For generative AI developers, data sources, risk assessments, and copyright disclosures are therefore governance concerns, not just implementation details. section 10.17 section 10.18
The AI Act complements rather than replaces the General Data Protection Regulation (GDPR), the EU’s principal framework for personal-data governance. Its emphasis on transparency, bias, risk, and accountability addresses concerns that privacy rules alone do not settle. Compliance is a starting point: organizations still need to examine data quality and oversight across an AI system’s lifecycle. section 3.15 section 3.18
