The EU AI Act is the first broad legal framework for AI. Its core idea is a risk tiering: a small set of uses are prohibited (e.g. social scoring), a defined set of “high-risk” applications (things like hiring, credit, and critical infrastructure) carry strict obligations around data quality, documentation, human oversight, and transparency, and general-purpose/foundation models get their own transparency and disclosure requirements. Lower-risk uses are largely unregulated.
Two things make it matter even for non-EU teams. First, like GDPR, it reaches past the EU’s borders: it covers providers that place systems on the EU market and providers and deployers anywhere whose system’s output is used in the EU, not only companies based there. Second, it pushes the governance practices in this glossary (documentation, evaluation, audit trails, human oversight) from optional to, in some cases, legally required. The obligations phase in over time. Most prohibitions have applied since 2 February 2025, and two added in 2026, on AI-generated non-consensual intimate imagery and child sexual abuse material, apply from 2 December 2026. The rules for general-purpose models have applied since 2 August 2025, though models already on the market before then have until 2 August 2027. After 2026 amendments, high-risk obligations for the Annex III uses apply from 2 December 2027, and those for AI in regulated products from 2 August 2028. Dates have moved before, so check the current timeline. The practical move is knowing which risk tier your use case falls into and building the required controls before the relevant deadline.
Sources
- AI Act Explorer: Article 5, Prohibited AI practices — Lists the prohibited practices, including social scoring whose result is detrimental treatment in unrelated social contexts or treatment that is unjustified or disproportionate; checked October 25, 2026.
- AI Act Explorer: Annex III, High-risk AI systems — Lists high-risk uses including critical infrastructure, recruitment and other employment decisions, and creditworthiness assessment; checked October 25, 2026.
- AI Act Explorer: Article 2, Scope — Applies the regulation to providers and deployers outside the EU where the output of their AI system is used in the Union; checked October 25, 2026.
- Future of Life Institute: AI Act implementation timeline — Shows prohibitions applying from 2 February 2025 and general-purpose AI model rules from 2 August 2025; as amended, Annex III high-risk obligations apply from 2 December 2027 and Annex I product-linked ones from 2 August 2028 (page last updated 31 August 2026); checked October 25, 2026.
