The EU AI Act is the world’s first comprehensive law for artificial intelligence, and in 2026 it stopped being a future problem and became a present one. Its rules arrive in stages, sorted by how risky the EU judges each use of AI to be. Here is what it bans, what it demands and what happens next.
The Act’s logic is simple to state: the closer an AI system gets to people’s rights, safety and livelihoods, the heavier its obligations — and a short list of uses is banned outright, whatever the paperwork says.
What is banned outright
The Act’s “unacceptable risk” tier prohibits a defined set of practices. They include social scoring of citizens, manipulative systems designed to distort behaviour, and untargeted scraping of faces to build recognition databases. Emotion recognition in workplaces and schools is also on the prohibited list, with narrow exceptions.
These bans were the first part of the Act to bite. They matter less for the number of products they kill — few mainstream systems were built to do these things openly — than for the line they draw: some uses of AI are illegitimate in Europe regardless of accuracy or consent forms.
The high-risk rules
Below the bans sits the high-risk tier: AI used in areas such as critical infrastructure, education admissions, hiring, credit decisions, law enforcement and medical devices. Providers of these systems owe the Act’s heaviest duties — risk assessments, quality data, documentation, human oversight and registration.
This tier is where the compliance industry is being built. A hiring tool or a credit scorer sold into Europe now needs an evidence trail showing how it was tested, what data trained it and who can overrule it. For many vendors, that paperwork — not the technology — is the real cost of the European market.
Transparency: the rules already live
The most visible layer for ordinary users is Article 50, the transparency rules that took effect on 2 August 2026. They require people to be told when they are interacting with an AI system, and they require AI-generated content — text, images, audio and video — to be marked as machine-made in a detectable way.
Deepfakes carry a specific duty: if content depicts a real person doing or saying something they did not, it must be disclosed as artificially generated or manipulated. If you have noticed more “made with AI” labels this year, this article of the Act is a large part of the reason.
General-purpose model providers have their own transparency duties: documentation for downstream users, summaries of training content and, for the most powerful models, systemic-risk assessments. The era of the undocumented frontier model, at least in Europe, is over.
What comes next
The remaining high-risk obligations phase in over the coming years, and enforcement is the story to watch: national regulators and the EU’s AI Office can levy fines calculated as a share of global turnover, which gets the attention of even the largest labs.
For readers outside Europe, the Act still matters. Global companies tend to build once and comply with the strictest major rulebook, so Brussels’ requirements have a habit of becoming the world’s defaults — the so-called Brussels effect. The EU AI Act is best read not as a European law, but as the first draft of how democracies intend to govern this technology.
What companies are doing about it
Inside large companies, the Act has created a new discipline almost overnight: AI inventories. Before you can comply, you must know what you run — every model, vendor and use case, classified by risk tier. Many firms discovered, in the counting, that they were running far more AI than anyone had formally approved.
Vendors feel the pressure next. European customers now ask model providers for documentation, training-data summaries and audit support as contract terms, and providers who cannot produce the paperwork are losing deals to those who can. Compliance has become a sales feature.
The smaller-company question is proportionality. A startup does not have a regulatory department, and the Act’s defenders argue its duties scale with risk: labelling a chatbot is cheap, while the expensive machinery is reserved for systems that can genuinely harm people. Whether that balance holds in practice is the implementation story of the next two years.
0 Comments