# EU AI Act

AI Glossary · Governance, Risk & Ethics
Canonical URL: https://aisat.uk/glossary/eu-ai-act
Author: Lucy Gilmore, Assistant General Counsel, Product, Privacy & AI at Sprinklr | Practical Privacy, Product & AI Governance & Defensible Risk Decisions (https://www.linkedin.com/in/lucy-gilmore/)
Breadcrumb: [Glossary](https://aisat.uk/glossary) > [Governance](https://aisat.uk/glossary?category=governance) > EU AI Act

## TL;DR

> **The EU AI Act** (Regulation (EU) 2024/1689) is the world's first comprehensive, risk-based legal framework for artificial intelligence. It applies extraterritorially to any organisation, including UK firms, whose AI systems or outputs are placed on the market or used within the European Union.

## How EU AI Act works in practice

The Act regulates AI by use-case risk rather than underlying maths, sorting systems into four tiers: unacceptable risk (prohibited), high risk, transparency risk, and minimal risk, alongside dedicated rules for General-Purpose AI (GPAI) model providers. Prohibited practices (such as untargeted facial scraping, social scoring, and manipulative subliminal techniques) and mandatory staff AI literacy duties under Article 4 took legal effect on 2 February 2025.

Obligations for GPAI models (transparency documentation, copyright policies, and systemic-risk evaluations for frontier compute thresholds) entered into application on 2 August 2025, together with national governance structures and penalty regimes reaching up to €35 million or 7 per cent of global annual turnover. Under the EU's Digital Omnibus agreement reached on 7 May 2026, enforcement of high-risk AI obligations was aligned with technical standards delivery: standalone Annex III high-risk systems (covering recruitment, creditworthiness, education, and biometric categorisation) apply from 2 December 2027, while Annex I product-embedded high-risk AI systems (such as medical devices and machinery) apply from 2 August 2028.

For example, a London HR-tech vendor selling automated CV-screening software to employers in Dublin and Frankfurt is classified as a high-risk AI provider under Annex III, requiring a risk management system, dataset bias audits, human oversight hooks, technical documentation, and EU database registration.

## Why it matters and trade-offs

Any UK business serving EU customers or allowing EU employees to use its AI outputs falls within the Act's extraterritorial reach under Article 2. Crucially, an enterprise that substantially modifies a third-party model or deploys an LLM into a high-risk HR or credit workflow can legally step into the shoes of a high-risk 'provider', inheriting the full compliance burden.

Waiting until late 2027 to inventory systems is a costly mistake: prohibited-practice bans, Article 4 AI literacy rules, and GPAI obligations are already enforceable today, and procurement teams across Europe now require AI Act conformity roadmaps before signing SaaS contracts.

## Primary sources

- [European Commission: AI Act Regulatory Framework](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-artificial-intelligence)
- [EUR-Lex: Regulation (EU) 2024/1689 (Artificial Intelligence Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)

## Related AI concepts

- [AI Governance](https://aisat.uk/glossary/ai-governance): AI Governance is the operational framework of internal policies, model inventories, risk assessments, approval gates, human oversight rules and audit trails that an organisation uses to deploy artificial intelligence safely, ethically and legally.
- [Human-in-the-Loop (HITL)](https://aisat.uk/glossary/human-in-the-loop): Human-in-the-Loop (HITL) is an operational governance pattern in which an AI system or agent prepares a recommended decision, communication or tool call, but pauses execution until a qualified human reviewer approves or edits it.
- [Shadow AI](https://aisat.uk/glossary/shadow-ai): Shadow AI is the unsanctioned use of consumer chatbots, unvetted SaaS AI features, browser extensions or personal API keys by employees to process proprietary company data or customer records outside IT and information-security governance.
- [Guardrails](https://aisat.uk/glossary/guardrails): Guardrails are programmable validation layers placed on the input and output paths of an AI application to detect prompt injections, redact personally identifiable information, verify citations and block policy-violating completions in real time.