The EU AI Act came into full effect this year, making it the world's first comprehensive legal framework governing artificial intelligence. For businesses operating in Europe — or deploying AI that affects European users — it creates real compliance obligations with meaningful penalties for non-compliance (up to €30 million or 6% of global annual revenue, whichever is higher).
Who does it actually apply to?
The Act applies to: AI providers (companies that develop and sell AI systems), deployers (businesses that use AI in their products or services), and importers (businesses that bring non-EU AI products into the EU market). If you use AI in your customer-facing products, hiring processes, credit decisions, or content moderation, you are a deployer and the Act applies to you.
The risk classification system
The Act classifies AI systems into four risk tiers. Unacceptable risk systems (real-time biometric surveillance in public spaces, social scoring by governments, AI that exploits psychological vulnerabilities) are simply banned. High-risk systems (AI in hiring, credit decisions, healthcare, law enforcement, education, critical infrastructure) face the most demanding requirements. Limited risk systems (chatbots, deepfake generators) require transparency disclosures. Minimal risk systems (spam filters, AI-powered video games) face no specific requirements.
What high-risk compliance requires
If your AI system qualifies as high-risk, you need: a conformity assessment (demonstrating the system meets technical requirements), registration in the EU database of high-risk AI systems, human oversight mechanisms (a human must be able to override, intervene, or shut down the system), technical documentation proving the system's accuracy, robustness and cybersecurity, and a post-market monitoring plan. This is not a checklist you complete once — it's an ongoing compliance program.
What most businesses actually need to do
For the majority of small and medium businesses using commercial AI tools (ChatGPT, Copilot, Claude) rather than building their own AI systems, immediate obligations are limited. Your primary requirement is transparency: if you use AI in customer interactions, you must disclose this. If you use AI to generate content, deepfakes, or synthetic media, you must label it as AI-generated.
Where you do need to act: if you use AI in any employment decision (screening resumes, assessing performance, making redundancy decisions), you are operating a high-risk AI system and need to begin your conformity assessment process now. Enforcement is beginning, and employment AI is an early priority for regulators.
The US perspective
American businesses with no EU operations or customers can largely ignore the EU AI Act for now. However, the US AI landscape is evolving rapidly — multiple states have passed AI regulations, federal legislation is progressing, and the de facto global standard often follows European regulation. Building your AI governance framework to EU Act standards now is a future-proofing investment, not just a compliance exercise.
Found this useful? Share it.