The EU AI Act, decoded: what actually changes, and when

The European Union's Artificial Intelligence Act is frequently described as the world's first comprehensive AI law. That description is accurate but unhelpful for anyone trying to work out what they personally have to do. The Act is not a single switch. It is a layered regime that classifies uses of AI by the risk they pose, attaches different duties to each layer, and brings those duties into force on a staggered timetable.

The risk tiers

The Act's central design choice is that regulation attaches to the use, not to the technology. The same underlying model can sit in an unregulated product and, deployed differently, sit in a prohibited one.

• Prohibited practices: a narrow list of uses considered incompatible with fundamental rights, banned outright.
• High-risk systems: permitted, but subject to the heaviest obligations — risk management, data governance, technical documentation, logging, human oversight and conformity assessment.
• Transparency-risk systems: permitted with disclosure duties, such as making clear that a person is interacting with a machine or that content has been artificially generated.
• Minimal risk: the large majority of AI uses, which the Act leaves substantially untouched.

General-purpose AI is handled separately

Large general-purpose models sit outside the use-based tiers because their eventual use is unknown at the point they are released. The Act therefore imposes model-level duties on their providers — documentation, information for downstream developers, a copyright policy and a summary of training content — with additional obligations for models judged to carry systemic risk.