- The EU AI Act, formally adopted in May 2024, sorts AI systems into four risk tiers, from outright banned to minimally regulated, with phased compliance deadlines running through 2027.
- High-risk AI applications, including resume screening tools and medical devices, face mandatory conformity assessments, data governance requirements and human oversight provisions before they can enter the EU market.
- The Act’s risk-based structure, which targets an AI system’s use and impact rather than its underlying technology, gives other jurisdictions a concrete model for drafting AI law without freezing the rules around a single technical generation.
The EU AI Act is the first comprehensive AI law passed by any major jurisdiction, and its four-tier risk architecture is already setting the template for how other governments are approaching the problem. Adopted by the European Council on May 21, 2024and phasing in provisions from August 2024 through 2027, it offers the clearest working example yet of how to translate AI governance principles into enforceable obligations. For policymakers elsewhere, the Act’s structure, more than its specific rules, is the thing worth studying.
Phase 1: Defining the Regulatory Scope and Principles
Before any risk classification can work, legislators have to settle a prior question: what counts as an AI system in the first place? The answer is harder than it sounds. The rapid evolution of AI technology, from narrow applications to sophisticated generative models, complicates the task of establishing clear, future-proof legal definitions. Policymakers must decide whether to use technical or human-centred vocabulary, and how broad the scope of regulation should be, to avoid inadvertently over-regulating benign applications or leaving harmful ones untouched.
Addressing AI’s Ambiguous Definitions
One of the primary challenges is agreeing on what “AI” actually means in a legal context. Subtle differences in wording can have significant impacts on policy, fuelling debates over whether simple algorithms should be regulated alongside advanced machine learning systems. The definitional problem is not hypothetical: a New York City task force reportedly struggled to define “automated decision systems,” with one agency arguing its proposed definition was broad enough to capture spreadsheet calculations.
The EU AI Act addresses this by focusing on the system’s intended purpose and impact rather than an abstract technical definition of intelligence, providing context-based definitions aimed at legal certainty. That framing helps distinguish a spam filter from an autonomous hiring tool, even when both involve the same underlying techniques.
Establishing Core Ethical and Safety Principles
Effective AI regulation needs to be anchored in principles that reflect societal values and protect fundamental rights. The EU AI Act centres on human oversight, transparency, fairness and accountability. Policymakers have to balance curbing potentially harmful applications, those that could entrench discrimination or enable privacy intrusions, against the risk of slowing beneficial innovation. That requires a clear-eyed view of how AI systems can encode and propagate biases, often inherited from training data, and what technical and procedural mechanisms can mitigate them.
Phase 2: Implementing a Tiered Risk Classification
The EU AI Act’s most practically useful feature is its four-tier risk model, which calibrates regulatory obligations to the potential harm of each application. The alternative, a single ruleset applied uniformly, risks over-regulating low-stakes uses while failing to impose adequate controls on genuinely dangerous ones.
Prohibiting Unacceptable AI Practices
The highest tier covers AI applications the Act treats as incompatible with fundamental rights, banning them outright within the EU. These include social scoring systems operated by public authorities, real-time remote biometric identification in public spaces by law enforcement (subject to narrow exceptions), subliminal manipulation techniques that cause harm, and tools that exploit vulnerabilities in groups such as children. These prohibitions became enforceable from February 2, 2025. Drawing a hard legislative line at this tier sends a clear signal about where ethical boundaries sit, independent of the broader compliance framework.
Mandating Strict Requirements for High-Risk Systems
High-risk AI systems, those with significant potential to affect health, safety or fundamental rights, are permitted but only under substantial compliance obligations. The category is broad: it covers AI used in critical infrastructure management, employment decisions such as resume screening, educational assessment, law enforcement evidence evaluation and medical devices, among others. Before any such system can enter the EU market, developers must demonstrate comprehensive risk management, data governance, detailed technical documentation, human oversight capability, accuracy and cybersecurity controls, along with a conformity assessment. This is the tier where compliance costs are highest and the regulatory expectations most specific. For a broader look at how the Act’s transparency and compliance deadlines are structured, see our coverage of the EU AI Act’s August 2026 transparency provisions and staggered compliance deadlines.
Ensuring Transparency for Limited-Risk AI
Some watermarking obligations for generative AI systems under this tier require compliance, aligning with the Act’s staggered deadlines.
Encouraging Voluntary Measures for Minimal Risk
Spam filters, AI-powered games and similarly low-stakes applications fall into the minimal-risk tier and sit largely outside direct regulation under the Act. Developers and deployers in this category are encouraged, but not required, to follow voluntary codes of conduct. This is a deliberate policy choice: mandatory rules for genuinely low-risk applications would impose compliance costs without meaningful safety returns, while voluntary frameworks still create reputational and market incentives for responsible development.
Phase 3: Building a Robust Compliance and Enforcement Framework
Legislation without credible enforcement is a statement of intent, not a regulatory regime. The EU AI Act’s compliance architecture reflects that reality, pairing its substantive rules with institutional infrastructure and accountability mechanisms.
Establishing Conformity Assessment and Oversight Bodies
High-risk AI systems must undergo conformity assessments before entering the market, either through developer self-assessment or review by independent notified bodies, depending on the application type. At the EU level, the Act establishes a European Artificial Intelligence Board to promote coordination among national authorities and support consistent application of the rules. The European AI Officelaunched within the European Commission in February 2024, is intended to oversee implementation, particularly for general-purpose AI models. These institutions matter because regulatory principles are only as effective as the bodies tasked with applying them.
Prioritising Data Governance and Quality
Poor training data is one of the most reliable routes to discriminatory AI outcomes, since historical datasets frequently encode existing social biases. The Act addresses this directly, mandating strong data governance practices for high-risk systems: requirements covering data quality, data management processes and bias mitigation in training datasets. Compliance in practice means organisations need documented processes for monitoring algorithmic behaviour, recording decision-making rationale and identifying bias before a system reaches users, not after a problem surfaces.
Integrating Human Oversight and Accountability
High-risk AI systems must be designed to allow effective human intervention, the ability to override, adjust or shut down the system when necessary. Beyond design requirements, the Act pushes toward clear accountability frameworks that assign responsibility for outcomes when autonomous systems cause harm. Liability questions in AI remain genuinely difficult, particularly as systems grow more autonomous, and the Act does not fully resolve them. What it does do is require that the conditions for meaningful human oversight exist at the point of deployment, which at least establishes a baseline from which accountability can be assessed. Governance of autonomous AI systems is also an active concern at the technical level; for context on how web-connected AI agents are being governed to address excessive agency risksthe OWASP framing is worth reviewing alongside the Act’s oversight provisions.
Phase 4: Fostering International Harmonisation and Standards
AI development is inherently cross-border. Divergent national rules create compliance complexity for global companies and, in some cases, regulatory arbitrage, where developers shift operations to the most permissive jurisdiction available.
Navigating Global Regulatory Divergence
The EU AI Act sits alongside a growing set of national and multilateral initiatives: the US Executive Order on AI issued in October 2023, and the Bletchley Declaration of November 2023, endorsed by 28 nations, which acknowledged the need for international collaboration on AI risks. How these frameworks interact in practice, particularly where their requirements conflict, remains an open question for global companies. Policymakers should pursue interoperability mechanisms, mutual recognition of conformity standards and shared best practices where possible, to reduce the burden on organisations operating across multiple jurisdictions.
Leveraging International Standards Bodies
NIST and ISO are the two bodies most relevant to the EU AI Act’s technical underpinnings. The NIST AI Risk Management Framework, released in January 2023, provides voluntary guidance for identifying, assessing and monitoring risks across the AI lifecycle, with an emphasis on trustworthiness, transparency, fairness and accountability. Aligning national AI laws with such frameworks gives regulators a technically grounded foundation and makes it easier for multinational organisations to demonstrate compliance without building separate programmes for each jurisdiction.
The EU AI Act’s four-tier model does not resolve every hard question in AI governance, liability for autonomous systems, the long-term treatment of general-purpose models, and the practical capacity of national authorities to conduct credible oversight all remain contested. What it does provide is a working legislative architecture built around risk level and use-case impact rather than technical specifics, which gives it a degree of durability as the technology continues to change. For jurisdictions still drafting their own frameworks, that architecture is the most transferable part. For more coverage of AI policy and regulation, visit our AI Policy & Regulation section.
