The EU AI Act: what it means for the next decade

The EU AI Act, Regulation (EU) 2024/1689, is widely described as the first comprehensive law to regulate artificial intelligence by the risk a system poses to people. It sorts AI uses into risk tiers, puts most duties on providers of high-risk systems, applies in stages from 2025 to 2028 and binds any provider placing a system on the EU market, wherever it is based.

A law built around risk, not technology

Except for general-purpose models (see below), the Act regulates not the technology as such but what a system is used for and the harm that use could cause. Systems fall into four tiers:

• a short list of prohibited practices
• a longer list of high-risk uses
• transparency duties for systems that interact with people or generate content
• a large remainder subject only to an AI literacy duty for staff

The same language model is minimal risk when drafting a newsletter and part of a high-risk system when ranking job applications. Risk mostly attaches to the intended purpose, not to the code.

Prohibited practices and high-risk uses

The original prohibitions have applied since 2 February 2025. They include social scoring that leads to unjustified detrimental treatment, manipulative techniques that cause significant harm, untargeted scraping of facial images to build recognition databases, and emotion recognition in workplaces and schools outside medical or safety uses. Real-time remote biometric identification in publicly accessible spaces by law enforcement is banned, with narrow exceptions. The 2026 amendment added two more bans, which apply from 2 December 2026: AI systems that generate or manipulate realistic intimate or sexually explicit images, videos or audio of an identifiable person without that person’s explicit consent, and AI systems that generate or manipulate child sexual abuse material. Breaches carry the Act’s highest fines: up to 35 million euros or 7 percent of worldwide annual turnover, whichever is higher.

High-risk status arises in two ways. A safety component of a product covered by listed EU product legislation, such as a medical device or an elevator, is high risk if that legislation requires third-party conformity assessment, and follows the product’s conformity route. Stand-alone systems used for purposes listed in eight areas are high risk by default:

• biometrics
• critical infrastructure
• education
• employment
• essential services (including credit scoring and life and health insurance)
• law enforcement
• migration, asylum and border control
• the administration of justice and democratic processes

Exam scoring and benefit decisions are typical examples.

Obligations for providers and deployers

A provider develops a system and markets it under its own name; a deployer uses it professionally. Most duties fall on providers of high-risk systems, who must:

• run a documented risk management process across the system’s life cycle
• govern training, validation and testing data, including examination for bias
• prepare technical documentation and build in automatic event logging
• design for human oversight, accuracy, robustness and cybersecurity
• complete a conformity assessment (usually internal), affix CE marking and register stand-alone systems in the EU database

Deployers must follow the instructions for use, assign oversight to competent people with authority to intervene, keep logs, tell people when such a system informs decisions about them, and inform workers and their representatives before using one at work. Public bodies, private operators of public services, and deployers using high-risk systems for credit scoring or life and health insurance must first assess the impact on fundamental rights.

Testing for bias often requires sensitive attributes, such as ethnic origin or health status, that data protection law restricts. Since the 2026 amendment, Article 4a of the Act allows such data to be processed for bias detection and correction, no longer only for high-risk systems, under safeguards and only where synthetic, anonymized or other data would not suffice. Whether it would is a technical question, examined in the Foundation’s technical report on synthetic, anonymized and differentially private data for bias detection.

The timeline and the general-purpose AI track

The Act applies in stages:

• 1 August 2024: entry into force
• 2 February 2025: the original prohibitions and the AI literacy duty
• 2 August 2025: obligations for general-purpose AI models
• 2 August 2026: most other rules, including the transparency duties for systems that interact with people or generate content
• 2 December 2026: the two prohibitions added in 2026, and the duty to mark AI-generated content for generative systems placed on the market before 2 August 2026
• 2 December 2027: most high-risk obligations (originally 2 August 2026)
• 2 August 2028: high-risk obligations for AI in products covered by EU product legislation (originally 2 August 2027)

In November 2025 the European Commission proposed amendments, the digital omnibus on AI; the Parliament and the Council adopted them, with changes, as Regulation (EU) 2026/1744, in force since 27 July 2026.

Providers of general-purpose models, those adaptable to many tasks, must keep technical documentation, inform developers who build on them, adopt a copyright policy and publish a summary of training content. Models with systemic risk also face evaluation, risk mitigation, incident reporting and cybersecurity duties. The General-Purpose AI Code of Practice, published in 2025, offers a voluntary way to show compliance; the EU AI Office, within the Commission, enforces these rules.

Why the effects reach beyond Europe

Three mechanisms carry the Act abroad. Scope: it binds any provider placing a system on the EU market, wherever it is based, and providers and deployers abroad whose system’s output is used in the Union. Economics: many companies prefer one global version of a product, so a strict rule in a large market can become the default elsewhere, a pattern known as the Brussels effect and widely discussed after the GDPR. Standardization: harmonized European standards, once their references are published in the Official Journal, will carry a presumption of conformity with the high-risk requirements, and the practices they codify can travel with the products.

Alongside the Act sit the OECD AI Principles, the NIST AI Risk Management Framework, ISO/IEC 42001 and the Council of Europe Framework Convention on AI. The next decade will show whether these frameworks converge on shared technical evidence or fragment into incompatible paperwork.

What to watch, and what to do now

Open questions remain: how quickly harmonized standards arrive, how the exceptions to the high-risk classification are read in practice, and how the Act’s right to explanation interacts with Article 22 of the GDPR.

Any school, municipality, NGO or small business can start now by listing the AI systems it uses, asking which touch a listed high-risk area, requesting documentation from vendors, naming who is responsible for oversight, and training staff, a duty that already applies. Individuals gain protections in law: being told when they interact with an AI system, an explanation of significant decisions based on a high-risk system, and a complaint route to a market surveillance authority. The Foundation researches the technical evidence such rules require and publishes its findings as technical reports and analyses.

In short

The EU AI Act, Regulation (EU) 2024/1689, is widely described as the first comprehensive law to regulate AI by the risk a system poses to people. It sorts AI uses into risk tiers, puts most duties on providers of high-risk systems and applies in stages from 2025 to 2028. It binds any provider placing a system on the EU market, wherever it is based.

Frequently asked questions

What are the risk tiers in the EU AI Act?

The EU AI Act sorts systems into four tiers: a short list of prohibited practices, a longer list of high-risk uses, transparency duties for systems that interact with people or generate content, and a large remainder subject only to an AI literacy duty for staff. Risk mostly attaches to the intended purpose, not to the code.

Which AI practices does the EU AI Act ban?

The original prohibitions, applying since 2 February 2025, include social scoring that leads to unjustified detrimental treatment, manipulative techniques that cause significant harm, untargeted scraping of facial images to build recognition databases, and emotion recognition in workplaces and schools outside medical or safety uses. Two further bans, added in 2026, apply from 2 December 2026.

What counts as a high-risk AI system under the EU AI Act?

Under the EU AI Act, high-risk status arises in two ways. A safety component of a product covered by listed EU product legislation, such as a medical device or an elevator, is high risk if that legislation requires third-party conformity assessment. Stand-alone systems used for purposes listed in eight areas are high risk by default, including biometrics, education, employment, law enforcement and essential services such as credit scoring.

When do the EU AI Act’s rules apply?

The EU AI Act entered into force on 1 August 2024. The original prohibitions and the AI literacy duty apply from 2 February 2025, general-purpose AI obligations from 2 August 2025, and most other rules from 2 August 2026. Most high-risk obligations apply from 2 December 2027, and those for AI in products covered by EU product legislation from 2 August 2028.

Does the EU AI Act apply to companies outside the EU?

Yes. The EU AI Act binds any provider placing a system on the EU market, wherever it is based, and providers and deployers abroad whose system’s output is used in the Union. Many companies also prefer one global version of a product, so a strict rule in a large market can become the default elsewhere, a pattern known as the Brussels effect.

How to cite LASTHUMAN Foundation. (2026, October 15). The EU AI Act: what it means for the next decade. https://lasthuman.today/insights/eu-ai-act-next-decade.html