The first comprehensive law governing AI, passed by the European Union and coming into force in stages. It classifies systems by risk and imposes obligations accordingly, from outright bans on a small number of uses, through strict requirements for high-risk applications, to lighter transparency duties elsewhere. It applies to organisations outside the European Union whose systems are used there, which is why it matters well beyond Europe.
Technical view
Obligations fall on both providers and deployers, with separate rules for general-purpose AI models covering technical documentation, copyright policy and, above a compute threshold, systemic risk assessment. High-risk classification triggers requirements for risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness, and conformity assessment. Timelines are staged, penalties are set as a percentage of global turnover, and much of the detail is still being settled through standards and guidance, so anyone relying on this should check the current position rather than any summary.
Related
Part of AI Terminology Index, section: Governance, Law and Regulation.