EU AI Act Takes Full Effect: What It Means for Global Tech Companies

Key takeaways

• The EU AI Act regulates by risk tier, not by technology — the same model can be unregulated in one deployment and high-risk in another.
• Obligations fall primarily on deployers, not just model developers, which catches far more companies than most expected.
• General-purpose model providers face separate transparency and systemic-risk duties above a compute threshold.
• The extraterritorial scope means non-EU companies are covered whenever their output is used in the EU.

The European Union's AI Act is the first comprehensive attempt by a major jurisdiction to regulate artificial intelligence as a category rather than through sector-specific rules. Its influence already extends well beyond Europe, for the same reason the GDPR did: compliance is easier to implement globally than to fence off geographically.

The risk-tier structure

The central design decision is that the Act regulates applications, not algorithms. The same underlying model can sit in three different tiers depending on what it is used for.

Unacceptable risk — prohibited

A narrow set of practices is banned outright: government social scoring, untargeted scraping of facial images to build recognition databases, emotion inference in workplaces and schools, and certain predictive policing applications. These prohibitions are absolute rather than subject to a compliance pathway.

High risk — heavily regulated

This is where most of the compliance burden lives. Systems used in employment decisions, credit scoring, education access, essential public services, medical devices, and critical infrastructure fall here. Obligations include risk management systems, data governance and bias testing, technical documentation, logging, human oversight, and accuracy and robustness standards — plus registration in an EU database before deployment.

Limited and minimal risk

Chatbots and generative systems must disclose that content is AI-generated. Everything else — spam filters, recommendation engines, most productivity tooling — carries no specific obligations beyond existing law.

The part most companies underestimate

Obligations attach to deployers, not only to the organisation that trained the model. A company that buys a third-party résumé-screening tool is a deployer of a high-risk AI system and inherits real duties: ensuring human oversight is meaningful, monitoring for drift, retaining logs, and informing affected individuals.

This is the provision that catches organisations by surprise. Firms that assumed the Act was a problem for AI labs discover it is a problem for their HR department. “We just use a vendor” is not a defence, and vendor documentation alone does not discharge the deployer's obligations.

General-purpose models

Foundation models are handled separately. All providers face transparency requirements: technical documentation, information for downstream deployers, a copyright policy, and a public summary of training data. Above a compute threshold intended to capture the largest models, additional systemic-risk obligations apply — adversarial evaluation, incident reporting, and cybersecurity measures.

The training-data summary is quietly one of the most consequential provisions. It creates a disclosure surface that rights-holders can act on, and it sits awkwardly with the trade-secret posture most labs have adopted.

Extraterritorial reach

The Act applies to providers placing systems on the EU market and to providers outside the EU whose system output is used within it. A US company with no European entity is in scope if its model's outputs reach EU users. As with the GDPR, most multinational organisations will find it cheaper to apply one standard globally than to maintain two product behaviours.

Practical implications

• Classification comes first. Inventory every AI system in use and determine its tier. Most organisations discover more systems than they expected, often procured outside IT.
• Documentation is the deliverable. High-risk compliance is largely an evidentiary exercise. Systems built without documentation of training data, evaluation, and oversight are expensive to retrofit.
• Human oversight must be real. A reviewer who rubber-stamps model output does not satisfy the requirement; the design must give them genuine authority and information to overrule it.
• Penalties are GDPR-scale. Fines reach into the tens of millions of euros or a percentage of global turnover, whichever is higher.

The open questions

Considerable detail still depends on harmonised standards and guidance yet to be finalised, and the boundary between “limited” and “high” risk is less crisp in practice than the tier structure implies. Enforcement capacity is also untested — national authorities need technical expertise that is scarce and expensive.

What is no longer in question is the direction. Regulating AI by deployment context rather than by model architecture is becoming the default template internationally, and organisations building on that assumption will adapt more cheaply than those waiting for it to be dropped.