Summary
The EU AI Act—Regulation (EU) 2024/1689—is the European Union's comprehensive law for regulating artificial intelligence. It takes a risk-based approach: AI systems are classified by the level of risk they pose, and obligations scale accordingly, from minimal requirements up to strict controls or outright prohibition for unacceptable uses.
What is the EU AI Act?
The regulation sorts AI systems into risk tiers. Unacceptable-risk practices are banned; high-risk systems (for example in critical infrastructure, employment, or essential services) face requirements such as risk management, data governance, transparency, human oversight, and conformity assessment; limited-risk systems carry mainly transparency duties. Obligations apply across the value chain, including providers and deployers.
Compliance is being phased in over time, with major obligations for high-risk systems taking effect in 2026, and significant penalties for non-compliance. For organisations, meeting the Act in practice means concrete technical work—inventorying AI systems, documenting them (including approaches such as an AI bill of materials), and enforcing controls in the delivery pipeline using tooling like Mondoo/cnspec. It sits alongside related frameworks such as NIST AI RMF and ISO/IEC 42001, and overlaps with the GDPR and the EU Data Act for systems that process data.
Why is the EU AI Act relevant?
- Risk-based obligations: Requirements scale with the risk a system poses, up to bans for unacceptable uses
- Broad scope: Applies to providers and deployers across the AI value chain
- Named accountability: High-risk systems require defined responsibility for governance and oversight
- Technical, not just paperwork: Real compliance means inventory, documentation, and enforced controls in CI/CD