AI Regulation & the EU AI Act
The EU AI Act (Regulation 2024/1689), which became law in August 2024 and is being phased in through 2028 following a 2026 amendment that delayed its high-risk provisions, is the world's first comprehensive legal framework for artificial intelligence. It classifies AI systems by risk level (unacceptable, high, limited, minimal), imposes compliance obligations on developers and deployers, and has extraterritorial reach — applying to any AI system used in the EU regardless of where it was built. In parallel, the US, UK, China, and dozens of other countries are implementing their own AI governance frameworks, making AI regulation one of the most consequential and heavily-searched topics in the field.
The world's first comprehensive AI law — and what it means for every developer.
Category: AI Safety & Ethics
The EU AI Act's risk-based framework
The Act classifies AI systems into four risk tiers, with obligations escalating from minimal to complete prohibition:
| Risk tier | Definition | Examples | Requirements |
|---|---|---|---|
| Unacceptable risk (BANNED) | AI that poses clear threat to fundamental rights or safety | Social scoring by governments; real-time biometric surveillance in public; subliminal manipulation; emotion recognition in schools/workplaces | Prohibited outright. Violations: up to €35M or 7% global revenue. |
| High risk | AI that affects health, safety, or fundamental rights in high-stakes domains | CV screening tools; credit scoring; medical diagnosis AI; biometric ID; critical infrastructure management; educational assessment AI | Conformity assessment; transparency obligations; human oversight requirements; registration in EU database; CE marking required. |
| Limited risk (transparency) | AI that interacts directly with users without being obvious | Chatbots; deepfakes; AI-generated content | Must disclose that content is AI-generated; users must be informed they are interacting with AI. |
| Minimal risk | All other AI — the vast majority of systems | Spam filters; recommendation systems; video games with AI | No mandatory requirements; voluntary codes of practice encouraged. |
GPAI: General Purpose AI obligations: The Act also covers General Purpose AI models (GPAIs) — including frontier LLMs like GPT, Claude, and Gemini. All GPAI providers must maintain technical documentation, comply with copyright law, and publish summaries of training data used. GPAIs with "systemic risk" (trained on >10²⁵ FLOPs) face additional red-teaming, incident reporting, and cybersecurity obligations. This directly affects Anthropic, OpenAI, Google, and Meta.
Timeline and current status
| Date | Milestone |
|---|---|
| August 1, 2024 | EU AI Act (Regulation 2024/1689) enters into force |
| February 2, 2025 | Prohibited practices apply — AI social scoring, real-time public biometric surveillance, subliminal manipulation banned EU-wide |
| August 2, 2025 | GPAI model obligations apply — providers of models like GPT, Claude, Gemini, and DeepSeek must publish training-data summaries and comply with copyright rules |
| July 27, 2026 | Digital Omnibus on AI (Regulation 2026/1744) enters into force, formally deferring the high-risk deadlines below — published in the Official Journal just days before the original August 2026 high-risk cutoff |
| August 2, 2026 | General application date — Article 50 transparency duties (labeling AI-generated content, disclosing chatbot interactions) proceed on schedule, unaffected by the Omnibus delay |
| December 2, 2027 | High-risk obligations for standalone Annex III systems (hiring tools, credit scoring, medical diagnosis AI, biometric ID, etc.) take effect — pushed back 16 months from the original August 2026 date |
| August 2, 2028 | High-risk obligations for AI embedded in products already regulated under other EU law (medical devices, machinery, toys) take effect — pushed back from the original August 2027 date |
The 2026 Digital Omnibus delay — a live, frequently-missed update: In mid-2026 the EU formally adopted the Digital Omnibus on AI (Regulation 2026/1744, in force July 27, 2026), deferring the AI Act's high-risk obligations: standalone high-risk systems (Annex III — hiring, credit, medical diagnosis) now apply from December 2, 2027 instead of August 2, 2026, and product-embedded high-risk systems (Annex I) from August 2, 2028 instead of August 2, 2027. This is a genuine legal change, not a rumor, but it only delays the high-risk tier — the prohibited-practice ban (Feb 2025), GPAI obligations (Aug 2025), and Article 50 transparency duties (Aug 2026) are untouched. Many older explainers online (and some AI answers) still cite the original August 2026/2027 dates; if you are building a high-risk system, budget your compliance work against the new December 2027 / August 2028 deadlines, not the dates in the original 2024 text.
US vs. EU approach in 2026: The US is taking a markedly different path. In December 2025, President Trump signed an executive order aiming to preempt state AI laws, prioritizing innovation over regulation. The White House and US states are now in an active legal and political battle over who governs AI. As of 2026, the US has no comprehensive federal AI law, while the EU's Act — even with the high-risk delay — remains the most detailed cross-sector AI regulatory framework in force anywhere. Many multinational companies still design to EU AI Act standards globally, since it's the most stringent framework — similar to how GDPR set a global de facto privacy standard.
Practical compliance for developers
| If you are building… | Key questions to ask | Likely tier |
|---|---|---|
| A customer service chatbot | Does it tell users it's AI? Does it make significant decisions (credit, insurance)? | Limited risk if disclosure is in place; High risk if decision-making |
| A CV screening or hiring tool | Is it used for recruitment decisions? In what countries? | High risk — requires conformity assessment, human oversight, bias testing |
| A medical diagnosis tool | Is it a medical device under EU MDR? Does it influence treatment decisions? | High risk — requires clinical validation, CE marking, extensive documentation |
| An LLM-powered general assistant | What is it trained on? Does it generate images/video/audio of real people? | GPAI rules apply; Limited risk transparency rules apply; deepfake detection required if generating synthetic media of people |
| An AI tutor / educational tool | Does it assess students? Is it used to make decisions about grades or admission? | High risk if used for assessment; limited risk if purely educational support |
| A code generation tool | No decisions about people; no biometric data; no safety-critical functions? | Minimal risk — voluntary compliance only |
Resources for compliance: The EU AI Office (digital-strategy.ec.europa.eu/en/policies/european-approach-artificial-intelligence) is the main official source. The AI Act compliance checker at artificialintelligenceact.eu lets you assess your system's risk tier. For GPAI compliance, the EU is developing codes of practice through a multi-stakeholder process with the AI Office.
Practice questions
- What are the four risk categories in the EU AI Act with examples of each? (Answer: Unacceptable risk (prohibited): social scoring by governments, real-time biometric surveillance in public spaces, subliminal manipulation, exploitation of vulnerabilities. High risk: medical devices, critical infrastructure, employment AI, credit scoring, law enforcement. Limited risk: chatbots (must disclose AI), deepfakes (must be labeled). Minimal risk: spam filters, AI in video games — majority of AI systems fall here with no specific requirements.)
- The EU AI Act requires GPAI (General Purpose AI) providers to comply with copyright law. What does this mean in practice? (Answer: GPAI providers must: (1) Publish a summary of training data used (which datasets, which sources). (2) Implement an opt-out mechanism for copyright holders who do not want their content used for training. (3) Maintain technical measures to identify AI-generated content (watermarking). This is why companies like OpenAI, Anthropic, and Google publish training data transparency reports and offer copyright opt-out registries.)
- A startup in the US develops an AI hiring tool used by European companies. Does the EU AI Act apply? (Answer: Yes — the EU AI Act has extraterritorial reach. It applies to: (1) AI systems placed on the EU market (even if developed outside the EU). (2) AI systems whose outputs are used within the EU. A US startup whose AI tool is used by EU employers for hiring (a High Risk category) must comply with all High Risk requirements: risk management system, bias testing, transparency to candidates, human oversight, and EU market conformity assessment.)
- What is conformity assessment under the EU AI Act and who performs it? (Answer: Conformity assessment: the process of verifying that a High Risk AI system meets the EU AI Act requirements before market placement. For most High Risk systems: self-assessment (the provider audits themselves against the requirements and signs a Declaration of Conformity). For certain critical systems (biometric identification, critical infrastructure): third-party assessment by a notified body. Providers must maintain technical documentation and update assessments when the system changes materially.)
- What penalties does the EU AI Act impose for violations? (Answer: Prohibited AI violations: up to €35 million or 7% of global annual turnover (whichever is higher). High-risk AI non-compliance: up to €15 million or 3% of global turnover. Incorrect information to authorities: up to €7.5 million or 1% of global turnover. For SMEs: proportionally lower maximums. These penalties are significantly higher than GDPR's maximum (€20M or 4% of turnover) — reflecting the EU's intent to make AI regulation enforcement credible.)
Every model LumiChats offers from a major lab — Anthropic's Claude line, OpenAI's GPT-6 series, xAI's Grok, DeepSeek's V4 line — is a GPAI provider under the EU AI Act and has been required since August 2, 2025 to publish training-data summaries and comply with EU copyright opt-out rules; that obligation applies to the provider regardless of where LumiChats' own users are located. If you're building on top of LumiChats' API for an EU-facing product (a hiring screen, a credit-scoring assistant, a medical-triage bot), the underlying LLM's GPAI compliance doesn't cover you — your own application is separately assessed under the Act's risk tiers, and as of the 2026 Digital Omnibus, a standalone high-risk classification gives you until December 2, 2027 rather than August 2026 to comply.