What Is the EU AI Act, and What Does It Regulate?

💡 Summary: Key Takeaways

• The EU AI Act does not apply the same rule to every AI system. Obligations become more demanding as a use creates greater potential consequences for health, safety, and fundamental rights.
• Some practices are prohibited, while high-risk systems may be used under stricter conditions. Chatbots, deepfakes, and some synthetic content also face transparency requirements.
• Using the same model does not put every company in the same legal position. The company's role, the system's purpose, where its output is used, and other laws such as the GDPR must be assessed separately.

A chatbot can tell a hotel guest when breakfast is served. The same technology can rank job applications or help a hospital prioritise emergency calls.

On screen, all three systems may look similar. A person provides an input, and the system produces an answer or recommendation. But the consequence of a wrong answer is not the same. A guest may miss breakfast in the first case. A person may lose access to a job opportunity in the second. In the third, health and safety may be directly affected.

The EU AI Act creates a common regulatory framework that recognises these differences.

Its official legal form is Regulation (EU) 2024/1689. The Regulation applies directly within the European Union and governs how AI systems are developed, placed on the market, and used for professional purposes according to their risk.

This is not a law that can be summarised as “Europe banned AI.” It does not treat AI as inherently good or bad. It imposes more demanding requirements when a system can create more serious harm to health, safety, or fundamental rights. It prohibits some uses altogether.

This article establishes the foundation: why the Act exists, whom it covers, which practices it prohibits, what high risk means, what it requires from chatbots and synthetic content, when the rules apply, and where a company should begin.

Why was the EU AI Act introduced?

An AI system can be a product, a decision mechanism, and part of a service at the same time. A system deployed in one country may reach users in another. One company may develop the model, another may put it inside a product, and a third may use that product with customers or employees.

When this structure depends only on voluntary principles, two problems arise.

The first is uncertainty about the protection available to people. How should discrimination be controlled when a system influences recruitment? If a medical system fails, who must be able to produce which records? How does a user know whether they are interacting with a person or a chatbot?

The second is fragmentation for companies. Different rules in different EU countries make product development, procurement, and market entry more difficult.

The current consolidated text of the Regulation addresses both needs. It establishes common rules for the EU market while seeking to limit harm to health, safety, fundamental rights, democracy, the rule of law, and the environment. Supporting innovation is also among its stated aims.

That balance matters. The Act is not only trying to protect people. It is also trying to tell companies under which conditions they can develop and use these systems.

Does every piece of software count as an AI system?

No.

A fixed tax calculation in accounting software, a form driven by a few predefined conditions, or a conventional business rule does not become an AI system merely because its marketing calls it “smart.”

The Act looks at machine-based systems designed to operate with varying levels of autonomy. These systems infer from their inputs how to generate outputs such as predictions, content, recommendations, or decisions. Some can adapt after deployment.

The practical business question is simpler:

Does the system only execute steps written in advance, or does it infer a result from its inputs and influence a decision or process in the outside world?

What the product actually does matters more than its name. A supplier calling a feature “only automation” is not decisive. Neither is a company declaring that it “uses AI.”

Who is responsible under the Act?

The EU AI Act does not apply only to the large technology companies that develop models. It assigns different responsibilities to different parties between development, market entry, and daily use.

A party that develops a system, or has it developed and places it on the market under its own name, may be a provider. A company that uses an existing system under its authority for professional purposes may be a deployer. The Act also defines importers, distributors, product manufacturers, and authorised representatives of certain non-EU providers.

A company does not always have only one role. It may be a deployer when it uses a purchased tool in human resources and a provider when it offers another system to customers under its own brand. If it substantially modifies a system or changes its intended purpose to a high-risk use, its responsibilities may change as well.

The territorial scope does not stop at a company's registered address. In broad terms, the Act can apply to:

• providers that place an AI system or general-purpose AI model on the EU market,
• deployers located in the EU,
• and, in some circumstances, providers or deployers outside the EU when the system's output is used within the Union.

“We are not established in the EU, so the Act cannot concern us” is therefore not a safe conclusion. But “Someone in Europe can open our website, so we are definitely covered” is equally hasty. Where the system is offered, where its output is used, and the company's actual role in the chain all matter.

There are exclusions for purely personal and non-professional use, activities carried out solely for scientific research and development, and some pre-market research and testing. A concrete scope assessment cannot be made from a product name or a country name alone.

How do the rules change as risk increases?

The European Commission explains the framework through four broad levels of risk.

This gives us a useful first map. But one detail is essential: the Act usually looks at what the system is used for, not simply at the model brand.

Using a model from OpenAI, Anthropic, Google, or an open-source project does not by itself reveal the risk category of the final system. The same model may perform a low-risk task when it explains hotel facilities and form part of a high-risk use when it ranks job candidates.

The distinction I find especially important is this: the Act is less concerned with whether AI exists somewhere in a company than with the work and authority the company gives it.

Which AI practices are prohibited?

For some uses, the Act does not say “add better controls.” It says that the practice must not be used when the legal conditions for the prohibition are met.

The prohibited practices include:

• manipulative or deceptive techniques that materially distort a person's ability to make a decision and cause, or are reasonably likely to cause, significant harm,
• exploiting vulnerabilities related to age, disability, or particular social or economic circumstances in a way that causes or is reasonably likely to cause significant harm,
• certain forms of social scoring based on people's behaviour or characteristics,
• predicting an individual's risk of committing a criminal offence solely from profiling or personality traits,
• untargeted scraping of internet or CCTV images to create or expand facial-recognition databases,
• emotion inference in workplaces and educational institutions, apart from narrow medical or safety exceptions,
• biometric categorisation that infers certain sensitive characteristics,
• and real-time remote biometric identification by law enforcement in publicly accessible spaces, apart from the Act's narrow and tightly controlled exceptions.

The 2026/1744 amendment, which entered into force on 27 July 2026, added new prohibitions concerning realistic intimate or sexually explicit content generated or manipulated without the depicted person’s explicit consent, and child sexual abuse material. The provisions apply from 2 December 2026. The prohibition does not operate at the same threshold for providers and deployers: whether the system was designed to produce that material, whether it is a foreseeable outcome, the safeguards in place, and the purpose of its use all matter.

The list should not be read without its conditions. Some prohibitions contain tests concerning purpose, effect, harm, and exceptions. Not every form of personalisation is manipulation, and not every use of biometrics or emotion analysis produces the same legal result.

If a use really is prohibited, however, a better contract, an extra approval button, or more logging will not make it compliant. The use must change or stop.

What does high risk mean?

A high-risk system is not automatically prohibited. It may be developed and used, but under stricter conditions because it performs a safety function or influences an important decision in a person's life.

A system can become high risk through two main routes.

The first is when AI is a safety component of a product that is separately regulated in the EU, or is itself that product, and the product requires third-party conformity assessment. Some medical devices and machinery can fall into this route.

The second route covers sensitive uses listed in Annex III. These include biometrics, critical infrastructure, education, employment, access to essential public and private services, law enforcement, migration and border management, justice, and democratic processes.

Systems that evaluate or rank job applicants, influence admission to education, support certain credit or insurance decisions, or help assess emergency calls and health-service triage may therefore be high risk.

The sector name is not enough. Demand forecasting for a hospital cafeteria and software that recommends a diagnosis may operate inside the same healthcare organisation, but they do not perform the same task or create the same consequence. The Act also contains narrow exceptions for some procedural, preparatory, or otherwise limited functions in Annex III.

For a high-risk system, the Act broadly expects:

• risk management throughout the system's lifecycle,
• data governance and quality controls,
• technical documentation and automatic record-keeping,
• sufficient information and clear instructions for the deployer,
• human oversight that can work in practice,
• accuracy, robustness, and cybersecurity,
• the required conformity assessment, registration, and post-market monitoring,
• and reporting of serious incidents together with corrective action.

“A person makes the final decision” is not enough to establish human oversight. If that person does not understand the system's limits, cannot challenge its recommendation, or lacks the practical authority to reject it, the approval button changes only the appearance of the process.

These requirements are not a small set of documents for the legal department. They change what data must be retained, what the software must record, which authority an employee needs, how the product is tested, and what the company must require from suppliers. High-risk classification therefore enters product cost and daily operations directly.

What changes for chatbots, deepfakes, and synthetic content?

A system may face transparency obligations even when it is not high risk.

The transparency provisions address several different situations:

• A system designed to interact directly with people must inform them that they are interacting with AI unless this is already reasonably obvious.
• Providers of systems that generate synthetic audio, image, video, or text must make the output machine-readable and detectable as artificially generated or manipulated where technically feasible.
• A deployer that uses a deepfake must disclose that the content was artificially generated or manipulated.
• People exposed to emotion-recognition or biometric-categorisation systems must be informed.
• AI-generated text published to inform the public about matters of public interest must be disclosed. There is an exception when the text has undergone human review or editorial control and a person or organisation holds editorial responsibility.

For a hotel website chatbot, the most visible consequence is that the visitor should be able to understand that they are interacting with AI rather than a person.

That disclosure does not resolve the data-protection question. If the visitor's name, email address, travel plans, or health information is sent to a third-party model provider, separate issues arise under the GDPR and Türkiye's KVKK. The third article in this series will examine that data flow directly.

Does using OpenAI or Anthropic make a company a model provider?

Usually not.

The EU AI Act creates a separate set of rules for general-purpose AI models that can be used across many different tasks. The responsibilities of a company that develops or places such a model on the market are not the same as those of a business that uses the model inside a chatbot or business application.

Providers of general-purpose AI models are expected to prepare technical documentation, give downstream providers the information they need, maintain a policy for compliance with EU copyright law, and publish a sufficiently detailed summary of the content used for training.

Models with systemic risk face additional requirements, including model evaluation and adversarial testing, assessment and mitigation of systemic risks, serious-incident monitoring and reporting, and cybersecurity.

A company that buys access to one of these models and uses it in a chatbot does not automatically become the provider of the general-purpose model. It can still have separate responsibilities for the system it offers, the data it processes, and the decisions to which it connects the system.

Compliance by the model provider does not make every product built on top of that model automatically compliant.

AI literacy is also an obligation

The Act is not concerned only with product features and documentation. Providers and deployers must also take measures to support a sufficient level of AI literacy among their staff and other people who operate systems on their behalf.

This does not mean assigning the same online course to everyone and collecting completion certificates. Technical knowledge, experience, the context of use, and the people who may be affected should all be considered.

The team that monitors incorrect answers from a hotel chatbot does not need the same preparation as the human-resources team evaluating recommendations from a candidate-ranking system. The second team may need a deeper understanding of automation bias, discrimination risk, and the conditions under which a recommendation should be rejected.

The operating value of literacy follows from that difference. If people do not understand what a system cannot do, even good technical controls can be bypassed in daily use.

Does the EU AI Act replace the GDPR?

No.

The Act does not replace the GDPR, ePrivacy rules, consumer protection, product-safety law, employment law, anti-discrimination law, or sector-specific regulation.

A chatbot may not be high risk under the EU AI Act and may still be subject to data-protection law because it processes personal data. Healthcare software may be both a high-risk AI system and a medical device. A recruitment system may have to be assessed under employment and anti-discrimination law as well.

“Low risk” should therefore not be read as “legally unrestricted and free of problems.” The narrower meaning is that the system may not be subject to certain demanding obligations under the EU AI Act. The assessment under other law continues.

When does the Act apply?

The EU AI Act did not begin to apply in full on a single day. Its provisions are being phased in. A 2026 amendment also moved the dates for some high-risk requirements.

“The Act started on 2 August 2026” is therefore incomplete. Some obligations already applied before that date, while other transition periods continue.

Treating the final date as the date on which preparation should begin is also misleading. The data, event records, and human-oversight arrangements required for a high-risk system may be impossible to construct retrospectively after the product is complete.

How high are the penalties?

For a breach of the prohibited-practices rules, the maximum fine can reach EUR 35 million or 7% of the undertaking's total worldwide annual turnover in the preceding financial year. The higher ceiling applies to undertakings.

For breaches of certain other operator obligations and the transparency rules, the ceiling is EUR 15 million or 3% of worldwide annual turnover. Supplying incorrect, incomplete, or misleading information to authorities can lead to a maximum of EUR 7.5 million or 1%. Providers of general-purpose AI models face a separate ceiling of EUR 15 million or 3%.

For SMEs, including start-ups, the lower of the fixed amount and percentage ceiling applies.

These figures are not an automatic tariff. Authorities consider the nature, gravity, and duration of the infringement, the people affected, the resulting harm, the company's size, mitigating action, cooperation, and degree of fault.

The enforcement framework gives the European AI Office a role concerning general-purpose models and certain AI systems. National competent authorities supervise other AI systems, while the European Data Protection Supervisor oversees uses by EU institutions.

The fine is not the whole business risk. A company may have to stop a use, redesign a product, delay market entry, fail a corporate customer's supplier review, or lose a contract. Those costs may arise earlier and be more tangible than a penalty.

Where should a company begin?

The first step is not to send the legal team a list of product names. A company first needs to see where AI is actually producing a decision or action inside the business.

For each system, answer five questions:

1. What task does the system perform, and what output does it produce?
2. Whose decision, right, or access to a service does that output affect?
3. What would a wrong output mean for health, safety, fundamental rights, or the business?
4. Does the company develop the system, offer it under its own name, purchase and use it, or distribute it?
5. What data enters the system, where is the output used, and which countries does the process connect?

Without those answers, “Is it high risk?” and “Which documents do we need?” are both premature questions.

For companies, I think the Act's most important effect is this: it forces us to see AI not only as purchased software, but as part of a workflow that affects people.

The technical capability of a model may remain the same. Giving it hotel information, asking it to rank candidates, and using it for health-service triage are not the same decision. The rules do not remain the same either.

The second article in this series, scheduled for 5 September, will examine why the four-level risk explanation used here is not enough to guide decisions inside a company. I will then address chatbot conversations sent to third-party model providers under the GDPR and KVKK, the additional rules in healthcare, and finally how the EU AI Act may affect different company structures in Türkiye.

This article provides general information and does not constitute legal advice for a specific system or company.