The EU AI Act regulates AI by risk. If you build, deploy or distribute AI that reaches the EU market, it likely applies to you — regardless of where you’re based.
The risk tiers
- Prohibited — unacceptable-risk practices (e.g. social scoring, certain biometric uses).
- High-risk — strict obligations: risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness, conformity assessment.
- Limited-risk — transparency duties (e.g. disclosing AI/chatbots and AI-generated content).
- Minimal-risk — largely unregulated.
General-purpose AI (GPAI)
Providers of general-purpose/foundation models have their own transparency and documentation duties, with stricter rules for the most capable models.
How to get ready
Inventory and classify your AI systems, close documentation and oversight gaps for anything high-risk, and keep conformity evidence. Treat it as an ongoing program with phased deadlines, not a one-time filing.
Related guides