EU AI Act.
Also known as: The Act
The European Union's comprehensive risk-based law governing the use of and supply of AI. You don't need to be based in the EU for the Act to affect you and it may apply if you sell or provide an AI system to consumers or customers in the EU (even from outside the EU). The Act bans specific practices, imposes requirements on high-risk systems and gives specific rules around transparency, AI literacy, and general purpose AI models. The Act has already been amended and has been going live in phases, but most of it has been live since August 2026. High-risk uses have rules following in December 2027 and August 2028. In short, it's complex and comprehensive and broad in who needs to take note.
In the wild
“The Act regulates use of AI systems in the EU — including for recruiting, hiring and managing workforce. It is a risk-based model: the higher the potential impact on individuals' rights, safety or opportunities, the heavier the compliance burden.”
Seen here: Reuters, 2026
For AI users
Your use of AI for personal and non-professional use is generally not covered by the Act. However, at work, make sure to follow your organisation's processes and understand the risks and limitations of the systems you're using. Generally, consumers should be told when they're interacting with an AI system, and machine outputs should be detectable as AI. Deepfakes must be labelled and as must some AI generated text. There are of course nuances and exceptions. In addition, AI literacy is a must and should be provided.
For business leaders
It's a complex area, so it's best to get proper specialist advice personalised to your company. Expect an audit around your business' AI to make sure you know whether you need to do anything and, if you do, what the recommended actions are. Don't assume that having no EU office means the Act doesn't apply to your company. Even without an EU office or entity, you may need to comply if you have customers or consumers in the EU. The fines are GDPR-style but heavier, topping out at €35m or 7% of worldwide turnover (GDPR stops at 4%), so the business risk of inadvertently breaking these new laws could be high. Put in place good checks around AI procurement, transparency for end users on anything like chatbots, adverts and content where AI is used, and team training to boost literacy. And remember to keep records.