The European Union has taken a major step forward with theAdoption of the AI Act in March 2024. This legislation aims to regulate the use of artificial intelligence (AI) to ensure the security, transparency and respect for the fundamental rights of European citizens. The Act came into force on August 1, 2024, and was phased in until 2026.
The European Parliament adopted the AI Act in March 2024. It is a historic law to regulate artificial intelligence in the European Union. But what does this text mean in practice? What should be expected if you develop or use an AI? Here is a simple guide to understanding everything about the AI Act.
1. What is the AI Act?
The AI Act is a " product regulation ” the world’s first comprehensive regulation on artificial intelligence. It aims to protect European citizens from the misuse of AI (European Commission, 2021). Its goal is to ensure responsible, ethical and safe use of AI systems. It applies to those developing, marketing or using AI systems in the EU.
Like the CE marking for industrial products, compliant AI systems will receive a specific marking attesting to their compliance with European requirements.
Why was this law created?
With the rapid development of AI, new risks have emerged, including security, fundamental rights and discrimination. The AI Act is intended to prevent these abuses by establishing clear rules for the development and use of AI systems.
Who is affected by the AI Act?
The AI Act applies to all actors involved in the life cycle of AI systems:
- Suppliers - those who develop or market AI systems.
- Deployment agencies : those who use AI systems in their professional activities.
- Importers and distributors : those who introduce AI systems into the European market.
Even companies outside the EU are affected if their AI systems are used within the Union.
How does the AI Act work?
The AI Act classifies AI systems according to four levels of risk: it is the basis of all regulation.
1. Unacceptable risk: strictly prohibited (art. 5)
Certain practices are strictly prohibited because they are considered to be contrary to European values. Examples: social notation, real-time facial recognition in public space, predictive font based on profiling, subliminal manipulation...
These prohibitions are already applicable since February 2025
2. High risk: very framed (art. 6)
High-risk AIs can be used under strict conditions. This applies, for example, to AIs used for:
- recruitment
- Justice
- Police
- Education
- Health
These AIs will have to meet specific criteria: transparency, detailed documentation, conformity assessment, traceability, human supervision, safety and data quality.
3. Limited risk
The so-called "limited risk" AIs are those whose use does not have serious consequences for the user. There are, for example, chatbots, on Virtual assistants or marketing content generators. The essential thing for these tools is to ensure transparency: it is important for the user to know that he or she exchanges with artificial intelligence and not with a human.
4. Minimum or zero risk
According to CNIL, the vast majority of artificial intelligence systems deployed today in Europe fall into this category. These applications of artificial intelligence that we use on a daily basis are systems considered safe, which do not require specific rules related to AI itself.
We are talking here about very common tools: the antispam filters from your mailbox, suggestions of movies or playlists on your favorite platforms, or some digital assistants integrated into your work software.
For these uses, the future European AI Regulation does not provide for any specific constraints. Their development and use remain free, provided, of course, that other laws already in force are complied with: personal data protection (GDPR), consumer law, etc.
However, even if there is no strict obligation, the European institutions encourage companies to go further. The voluntary codes of conduct or good practices are recommended (Article 95) for building trust and ensuring an ethical AIeven where the law does not impose anything.
5. Systemic risk associated with general-purpose AIs
When an AI reaches a high level of complexity, it falls into a category known as "systemic risk". For example, it requires a computing power exceeding 10 power 25 flops.
The regulatory requirements are then more stringent:
- Regular evaluations,
- Robustness tests against attacks,
- Risk mitigation plans,
- Mandatory statements in case of major incident,
- Cybersecurity standards,
- Energy impact analysis of the system.
The aim is to frame these powerful technologies to avoid large-scale imbalances or damage.
What obligations for companies?
Artificial intelligence is increasingly part of the daily lives of companies. Let it be with tools like ChatGPT, voice assistants or chatbots, she invites herself everywhere: in decision-making, in customer service, in internal tools...
With the advent of the AI Act, the rules of the game change. Companies will have to be tougher. : better manage the use of their tools, secure data, ensure greater transparency, and above all better manage AI risks.
So yes, it requires effort: review its practices, forming its teams, investing in audits... And of course, all this has a cost. But it would be a mistake to see him only as a constraint.
👉 It's also a real opportunity to:
- Gaining credibility
- Building the confidence of your clients and partners
- Understanding in depth the tools you use
- Secure your long-term AI use
Sanctions for non-compliance
Non-compliance with the AI Act can result in significant financial penalties:
- Until EUR 35 million or 7% of world annual turnover for the use of prohibited systems.
- Until EUR 15 million or 3% of the world's annual turnover for non-compliance with high-risk systems obligations.
- Until €7.5 million or 1% of annual worldwide turnover for the provision of incorrect or misleading information .
What is the relationship with GDPR?
GDPR regulates personal data. The AI Act is concerned with the operation of artificial intelligence systems. However, both laws are complementary. An AI that processes personal data will have to respect the two regulations.
What about generic AIs like ChatGPT?
Generative AIs are classified as "limited risk", unless they are integrated into high risk systems. Furthermore, they will have to comply with specific rules:
- explicit indication of AI-generated character,
- technical documentation,
- copyright enforcement for training data.
Publishers such as OpenAI will have to document the sources of their data.
Entry into force and timetable
The AI Act was passed in March 2024. It will be implemented gradually.
- 1 August 2024 The European AI Regulation officially enters into force in all Member States.
- 2 February 2025 : ban on AI systems considered too dangerous by Europe.
- 2 August 2025 : start of obligations for general-purpose AI models and designation of supervisory authorities in each country.
- 2 August 2026 : application of the rules for high-risk AIs (biometry, education, employment, justice, infrastructure, etc.). Putting sandboxes in place to help companies comply.
- 2 August 2027 Extension of the rules to AI integrated into already regulated products (toys, medical devices, industrial equipment).
Conclusion
The AI Act positions the European Union as world leader in the regulation of artificial intelligence. It strikes a balance between the promotion of technological innovation and the protection of fundamental rights. This legislation provides a clear framework for businesses, fosters citizen confidence and encourages the development of an ethical and responsible AI.