EU tightens AI regulation with landmark compliance rules

The European Union has enacted sweeping new compliance requirements for artificial intelligence systems, establishing the most comprehensive legal framework for AI governance yet seen anywhere in the world. The rules, which come into force on a rolling basis, impose strict obligations on developers and deployers of so-called high-risk AI systems — covering everything from hiring algorithms to medical diagnostic tools — and carry penalties of up to €35 million or seven percent of global annual turnover for the most serious violations.

What the New Rules Actually Require

The regulation establishes a tiered risk classification system that determines how stringently any given AI application is regulated. At the top of the scale, certain applications are banned outright — including AI systems that deploy subliminal manipulation techniques, exploit the vulnerabilities of specific groups, or enable real-time remote biometric surveillance in public spaces by law enforcement, subject to narrow exceptions.

High-risk systems, which attract the most detailed compliance obligations, span fourteen regulated sectors. These include critical infrastructure such as energy grids and water systems, educational institutions making decisions about student access, employment tools used for recruitment or performance monitoring, essential public and private services including credit scoring and insurance underwriting, law enforcement applications, migration and asylum processing, and the administration of justice.

Technical Documentation and Transparency Obligations

Organisations deploying high-risk AI must maintain extensive technical documentation that demonstrates the system's intended purpose, the datasets used in training, the measures taken to address bias and accuracy, and the results of conformity testing. This documentation must be made available to national competent authorities on request. Regulators have emphasised that self-assessment alone is insufficient for the highest-risk categories; independent third-party audits will be mandatory for AI systems used in biometric identification and critical infrastructure, officials said.

Transparency obligations extend to users as well. Individuals who interact with AI systems — for instance, when applying for a bank loan assessed partly by an algorithmic model — must be informed that automated decision-making is involved and must have access to meaningful explanations of how that decision was reached. The requirement mirrors, but significantly extends, the logic of the General Data Protection Regulation's existing provisions on automated decision-making.

Human Oversight as a Core Principle

One of the regulation's most operationally demanding requirements is the mandatory integration of human oversight into high-risk systems. Developers must design their tools so that a qualified human operator can intervene, override, or halt the system at any point. This requirement is not merely procedural: the AI system itself must be built in a way that makes such oversight technically feasible, and organisations must designate staff with the training and authority to exercise it. According to Gartner, fewer than a third of enterprises currently have formal governance structures that would satisfy this requirement without significant restructuring.

The Risk Classification System Explained

Understanding the regulation requires a clear grasp of how risk tiers function in practice. The classification is not based on the underlying technology — there is no specific rule for large language models as such — but on the application and the context of deployment. A general-purpose AI model used for writing assistance carries minimal regulatory obligations; the same underlying model integrated into a tool that evaluates job candidates becomes high-risk the moment it is used to make or significantly influence a hiring decision.

General-Purpose AI Models Under Scrutiny

A distinct set of rules applies to what the regulation terms general-purpose AI models — large foundation models trained on vast datasets that can be adapted to a wide range of tasks. Providers of these systems, which include the large US technology companies that dominate the market, must publish summaries of the training data used, comply with EU copyright law, and conduct adversarial testing to identify and mitigate foreseeable risks. Systems deemed to pose systemic risk — defined by reference to the computational power used in training, currently set at a threshold of ten to the power of 25 floating-point operations — face additional obligations including mandatory incident reporting to the European AI Office.

This provision has attracted significant attention from the major AI developers, several of whom have engaged directly with EU officials during the regulation's drafting and implementation phases. As reported by Wired, some model providers have argued that the systemic risk threshold is technically arbitrary and may not accurately capture which models genuinely pose the greatest societal risks.

Enforcement Architecture and the European AI Office

Enforcement of the regulation falls primarily to member states, each of which is required to designate one or more national competent authorities. However, a newly created European AI Office, operating within the European Commission, holds responsibility for overseeing compliance by providers of general-purpose AI models — a deliberate choice that reflects the cross-border nature of the largest AI systems and the risk of regulatory fragmentation if enforcement were left entirely to individual member states.

The Office has the authority to conduct investigations, request access to model weights and training data, and impose fines directly on general-purpose AI providers. It will also coordinate with national authorities and publish guidance documents to help smaller organisations understand their obligations. According to the Commission, the Office became operational earlier this year and is currently recruiting a technical staff that includes AI safety researchers and legal experts.

Member State Implementation Challenges

Analysts have flagged significant variation in the capacity of EU member states to implement and enforce the regulation effectively. Smaller economies with limited existing regulatory infrastructure face particular challenges in standing up the specialist technical expertise required to audit complex AI systems. The Commission has established a support mechanism to assist member states in building capacity, but observers quoted by MIT Technology Review have noted that the timeline for full implementation is ambitious given the speed at which AI capabilities are advancing.

Industry Response and Compliance Timelines

The regulation does not apply all at once. Prohibited practices became enforceable first, followed by rules covering general-purpose AI models, with the full high-risk system requirements coming into effect on a staggered basis. This phased approach was designed to give industry time to adapt, though many organisations have said the compliance burden remains substantial even with the extended runway.

Risk Category	Example Applications	Key Obligations	Maximum Penalty
Unacceptable Risk (Banned)	Social scoring by governments, subliminal manipulation, real-time biometric surveillance (with exceptions)	Outright prohibition — no market access	€35 million or 7% global turnover
High Risk	Hiring algorithms, medical diagnostics, credit scoring, law enforcement tools, educational assessment	Conformity assessment, technical documentation, human oversight, transparency to users	€15 million or 3% global turnover
Limited Risk	Chatbots, emotion recognition, deepfake generation	Disclosure that users are interacting with AI	€7.5 million or 1.5% global turnover
Minimal Risk	Spam filters, AI-enabled video games, basic recommendation engines	Voluntary codes of conduct only	No mandatory penalty regime
General-Purpose AI (Systemic Risk)	Large foundation models above computational threshold	Training data disclosure, adversarial testing, incident reporting, red-teaming	€15 million or 3% global turnover

Major technology companies operating in Europe — including those headquartered in the United States — have broadly accepted that compliance is unavoidable, given the size of the European market. Several have announced dedicated EU AI compliance programmes, appointed internal accountability officers, and begun auditing their existing product portfolios to identify which applications fall into high-risk categories. Smaller European startups, by contrast, have raised concerns that the compliance costs could disadvantage them relative to larger incumbents with greater resources, a tension that regulators have acknowledged but not yet fully resolved.

The Broader Regulatory Context

The EU framework does not exist in isolation. Across the Atlantic and in the United Kingdom, governments are grappling with how to regulate AI without stifling innovation — a balance that different jurisdictions are striking in markedly different ways. The UK has opted for a principles-based approach that distributes AI oversight across existing sector regulators, rather than creating a single AI-specific law. That approach has drawn both praise for its flexibility and criticism for its potential inconsistency. Readers tracking the UK's parallel regulatory trajectory can find detailed analysis in our coverage of UK artificial intelligence safety legislation and the country's evolving AI liability framework, which addresses how responsibility is allocated when AI systems cause harm.

The divergence between the EU's prescriptive, risk-tiered model and the UK's sector-led approach raises practical questions for multinational organisations that must comply with multiple overlapping regimes simultaneously. For a broader overview of where the UK's regulatory architecture currently stands, our analysis of the evolving UK AI governance framework sets out the key regulatory actors and their respective mandates. The interplay between AI regulation and broader digital market legislation is also relevant context; the UK Digital Markets Bill has implications for how AI products from dominant technology platforms are treated under competition law.

International Alignment and Standards Bodies

EU officials have signalled an intention to work with international standards organisations, including ISO and IEEE, to develop technical standards that can underpin conformity assessments globally — an effort that, if successful, could reduce the compliance burden for companies operating across multiple jurisdictions. The United States has engaged with these discussions through the National Institute of Standards and Technology, which has published its own AI risk management framework, though the US has not enacted federal AI legislation of comparable scope to the EU's regulation. According to IDC, regulatory divergence between major markets currently represents one of the top three strategic risks that enterprise AI teams identify in governance planning exercises.

What Comes Next

The full implementation of the EU AI Act will unfold over the next several years, with the European AI Office expected to issue a series of guidance documents, delegated acts, and technical standards that will fill in the practical detail of many provisions. The regulation also contains a review clause that requires the Commission to assess whether the risk thresholds and category definitions remain appropriate in light of technological developments — an acknowledgement that AI capabilities are advancing faster than legislative processes can easily track.

For enterprises currently deploying or developing AI systems with any European market exposure, the compliance window is narrowing. Legal and technical teams that have not yet begun mapping their AI inventories against the regulation's risk classifications are increasingly behind the curve. The EU AI Act represents not merely a compliance challenge but a fundamental shift in the conditions under which AI systems can legally operate in the world's largest single market — and, given the EU's historic ability to set de facto global standards through the so-called Brussels Effect, its influence is unlikely to stop at the Union's borders.