Risks & safety
EU AI Act
Also known as: EU Artificial Intelligence Act
The European Union's comprehensive AI law, which regulates AI systems based on how risky they are.
The EU AI Act is Europe's big law for AI, the first comprehensive one of its kind. Its main idea is simple: the riskier an AI use is, the stricter the rules. Some uses are banned outright, high-risk ones (like AI in hiring or medical devices) face strong requirements, and everyday tools face light rules such as telling you when you are dealing with AI. It affects any company offering AI in the EU, including Belgian businesses.
The EU AI Act (Regulation (EU) 2024/1689) is the European Union's horizontal AI law, taking a risk-based approach: - Unacceptable risk: banned (e.g. social scoring, certain manipulative or biometric practices). - High risk: heavy obligations (risk management, data governance, transparency, human oversight, accuracy) for uses like hiring, credit, critical infrastructure, medical devices. - Limited risk: transparency duties (e.g. disclosing AI interaction, labelling deepfakes). - Minimal risk: largely unregulated.
It also adds specific rules for general-purpose AI models and duties around AI literacy.
Why it matters
It applies to providers and deployers offering AI in the EU regardless of where they are based, and phases in over time, making it a global reference point (a "Brussels effect") for AI regulation.
The EU AI Act (Reg. (EU) 2024/1689) is the first comprehensive horizontal AI regulation, structured around risk tiers: prohibited practices, high-risk systems (Annex III / product-safety-linked) subject to conformity assessment, risk management, data-governance/bias controls, technical documentation, logging, human oversight, accuracy/robustness and post-market monitoring, transparency-tier obligations (disclosure, synthetic-media labelling/watermarking), and minimal-risk. It adds a dedicated regime for general-purpose AI (GPAI) models, with heightened obligations for those posing systemic risk, plus AI-literacy duties.
It is extraterritorial (applies where output or systems are used in the EU), enforced via national authorities and an AI Office, with significant fines, and phases in on a staggered timeline through the mid-2020s. Interactions with GDPR (data privacy), sectoral law and standards (harmonised standards, ISO/IEC 42001, NIST AI RMF as a complementary framework) are substantial. It operationalises AI-safety and ethics principles into binding obligations and is widely treated as a global regulatory benchmark; specifics continue to be clarified through guidance and standards.