Artificial Intelligence: The EU AI Act and Its Risk Framework
The AI Act
The EU AI Act (Regulation 2024/1689), in force since 1 August 2024, takes a risk-based approach with four tiers. Prohibited practices include social scoring, manipulative techniques exploiting vulnerabilities, and certain biometric uses. High-risk systems (Annex III, e.g. critical infrastructure, education, employment, essential services, law enforcement) face conformity assessment, risk management, data governance, documentation and human oversight. Limited-risk systems carry transparency duties (chatbots, deepfakes); minimal-risk systems are largely unregulated. General-purpose AI models have separate obligations, overseen by the AI Office. Timing: prohibitions from 2 February 2025; GPAI from 2 August 2025; high-risk from 2 August 2026 (2027 for Annex I products). GDPR continues to apply alongside.
Traps and rule of thumb
Traps: calling the AI Act a directive; assuming all AI is high-risk; forgetting that provider obligations differ from deployer duties; assuming the Act replaces data protection law. Rule of thumb: “classify the use, then assign the role.” Worked example: a public authority deploys a CV-screening tool. It is high-risk (employment), so the provider must meet high-risk requirements, the authority as deployer must ensure human oversight, and GDPR rules on automated decision-making apply.