The EU AI Act and international frameworks

The European Union's Artificial Intelligence Act is the world's first comprehensive, horizontal AI law. It matters far beyond Europe: it applies to organizations anywhere that place AI systems on the EU market or whose AI outputs are used in the EU, and, as with the EU's data protection rules, many multinational companies apply its requirements globally rather than maintain separate practices. Its risk categories and obligations also influence laws and standards elsewhere. This lesson explains the Act's scope, its four risk categories, the obligations of providers and deployers of high-risk systems, transparency obligations, the rules for general-purpose AI models, governance and penalties, the implementation timeline as amended in 2026, and the wider international framework of conventions, principles and other national approaches.

Scope and definitions

The AI Act defines an AI system, following the OECD, as a machine-based system designed to operate with varying levels of autonomy, that may adapt after deployment, and that infers from its inputs how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. Simple rule-based software executing fixed instructions written by people is generally outside the definition. The Act applies to:

• Providers placing AI systems or general-purpose AI models on the EU market or putting them into service in the EU, wherever they are established.
• Deployers of AI systems located in the EU.
• Providers and deployers outside the EU where the output of the AI system is used in the EU.
• Importers, distributors and product manufacturers integrating AI.

Exclusions include AI used exclusively for military, defence or national security purposes, AI used solely for scientific research and development, and purely personal non-professional use. A Canadian or United States company offering an AI-powered hiring tool to European employers is therefore a provider subject to the Act.

For Canadian organizations, the EU AI Act is often the most detailed AI law they must meet, both directly when serving EU customers and indirectly through multinational customers that require AI Act compliance from suppliers.

Four risk categories

The Act sorts AI uses into four broad categories:

• Unacceptable risk (prohibited practices, Article 5): AI that deploys subliminal or manipulative techniques causing significant harm; exploits vulnerabilities due to age, disability or social or economic situation; social scoring that leads to detrimental treatment; predicting criminal offences based solely on profiling; untargeted scraping of facial images to build recognition databases; emotion recognition in workplaces and education (except for medical or safety reasons); biometric categorization to infer sensitive characteristics such as race, political opinions or sexual orientation; and real-time remote biometric identification in public spaces for law enforcement, except in narrowly defined situations. Amendments adopted in 2026 added prohibitions on AI systems that generate non-consensual intimate imagery and child sexual abuse material.
• High risk: AI that is a safety component of, or itself, a product covered by EU product safety legislation listed in Annex I (machinery, medical devices, toys, vehicles and others), and AI used in areas listed in Annex III: biometrics; critical infrastructure; education and vocational training; employment and workers management; access to essential private and public services (including credit scoring, life and health insurance pricing and public benefits); law enforcement; migration and border control; and administration of justice and democratic processes. A system in an Annex III area is not high-risk if it does not pose a significant risk of harm, for example if it performs a narrow procedural task, though profiling of individuals is always high-risk.
• Limited risk (transparency obligations): chatbots, emotion recognition and biometric categorization outside prohibited uses, and generators of synthetic content, which must meet the transparency requirements of Article 50.
• Minimal risk: everything else, such as spam filters and recommendation of products, with no specific obligations beyond AI literacy, though voluntary codes are encouraged.

# Classifying use cases under the EU AI Act (simplified): prohibited, high-risk, transparency, or minimal
prohibited = {"social scoring", "untargeted scraping of facial images", "emotion recognition at work"}
annex_iii = {"employment": "recruitment, promotion, termination", "credit": "creditworthiness of individuals",
             "education": "admission and assessment", "essential services": "public benefits eligibility",
             "law enforcement": "risk assessment of individuals", "migration": "visa and asylum"}
transparency = {"chatbot", "deepfake generation", "emotion recognition outside work"}
use_cases = [
    ("CV ranking tool", "employment"),
    ("Retail product recommender", None),
    ("Customer support chatbot", "chatbot"),
    ("Workplace emotion monitoring", "emotion recognition at work"),
    ("Loan approval model", "credit"),
    ("Synthetic video ads", "deepfake generation"),
]
for name, tag in use_cases:
    if tag in prohibited:
        cat = "PROHIBITED (Article 5)"
    elif tag in annex_iii:
        cat = "HIGH-RISK (Annex III: " + annex_iii[tag] + ")"
    elif tag in transparency:
        cat = "TRANSPARENCY obligations (Article 50)"
    else:
        cat = "minimal risk (voluntary codes)"
    print(f"{name:28s} {cat}")

CV ranking tool              HIGH-RISK (Annex III: recruitment, promotion, termination)
Retail product recommender   minimal risk (voluntary codes)
Customer support chatbot     TRANSPARENCY obligations (Article 50)
Workplace emotion monitoring PROHIBITED (Article 5)
Loan approval model          HIGH-RISK (Annex III: creditworthiness of individuals)
Synthetic video ads          TRANSPARENCY obligations (Article 50)

The CV ranking tool and loan approval model are high-risk under Annex III; workplace emotion monitoring is prohibited; the chatbot and synthetic video ads carry transparency obligations; the product recommender is minimal risk. Real classification requires reading the Act's precise wording, the Commission's guidelines and the exceptions, but this structure guides an initial triage of an organization's inventory (Lesson 1).

Obligations for high-risk systems

Providers of high-risk AI systems must, before placing them on the market:

• Establish a risk management system covering the whole life cycle.
• Apply data governance to training, validation and test data: relevance, representativeness, error and bias examination.
• Prepare technical documentation demonstrating compliance.
• Enable automatic logging of events for traceability.
• Provide instructions for use and transparency information to deployers.
• Design for effective human oversight.
• Achieve appropriate accuracy, robustness and cybersecurity.
• Operate a quality management system.
• Undergo conformity assessment (mostly self-assessment against harmonized standards, with third-party assessment for some biometric and product-related systems), affix the CE marking, and register the system in the EU database.
• After placing on the market, perform post-market monitoring and report serious incidents.

Deployers of high-risk systems must use them according to the instructions, assign human oversight to competent people, ensure input data is relevant, monitor operation and report risks and incidents, keep logs, inform workers before using high-risk AI in the workplace, and inform people subject to decisions. Public bodies, and private deployers of systems for credit scoring and life and health insurance pricing, must carry out a fundamental rights impact assessment before use. Affected persons have a right to an explanation of decisions based on high-risk AI that significantly affect them.

Transparency obligations

Article 50 requires that people be informed when they interact with an AI system such as a chatbot, unless obvious from the context; that providers of systems generating synthetic audio, images, video or text mark outputs in a machine-readable format detectable as artificially generated; that deployers of deepfakes disclose that content has been artificially generated or manipulated (with lighter requirements for evidently artistic or satirical works); and that deployers of emotion recognition or biometric categorization systems inform people exposed to them. A code of practice on marking and labelling AI-generated content supports these requirements.

General-purpose AI models

Providers of general-purpose AI (GPAI) models, such as large language models offered to others, must from August 2025 maintain technical documentation, provide information to downstream providers that integrate the model, put in place a policy to comply with EU copyright law (including respecting opt-outs from text and data mining), and publish a sufficiently detailed summary of the content used for training, using a template from the AI Office. Open-source models released under free licences are exempt from some documentation duties unless they pose systemic risk. Models with systemic risk, presumed above 10^25 FLOPs of training compute or designated by the Commission, must additionally perform model evaluations including adversarial testing, assess and mitigate systemic risks, report serious incidents, and ensure cybersecurity (AI-430). A General-Purpose AI Code of Practice, published in July 2025 and signed by most leading developers, sets out ways to comply.

Governance, enforcement and penalties

The Commission's AI Office supervises general-purpose AI models and, after the 2026 amendments, AI systems built on a provider's own GPAI model or integrated into very large online platforms. National market surveillance authorities in each member state enforce the rules for other AI systems, coordinated by the European AI Board, with advice from a scientific panel and an advisory forum. Penalties are tiered: up to 35 million euros or 7 % of worldwide annual turnover for prohibited practices; up to 15 million euros or 3 % for most other violations; and up to 7.5 million euros or 1 % for supplying incorrect information, with lower caps for small and medium enterprises. The Act also requires providers and deployers to ensure an adequate level of AI literacy among staff dealing with AI systems, an obligation that has applied since February 2025.

Implementation timeline

The AI Act entered into force on August 1, 2024, with obligations phased in. A Digital Omnibus amendment, adopted in 2026 as Regulation (EU) 2026/1744, postponed the main high-risk obligations to allow time for standards and guidance:

The amendments also created relief for "small mid-cap" companies, narrowed the definition of safety component, extended the legal basis for processing sensitive data to detect and correct bias, and gave the AI Office broader enforcement powers. Rules of this kind continue to evolve, so practitioners should check the current consolidated text and Commission guidance.

International frameworks

Beyond the EU, several international instruments shape AI governance:

• The Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (opened for signature in September 2024) is the first binding international treaty on AI, requiring parties to ensure that AI activities respect human rights, democracy and the rule of law, with risk and impact assessments and remedies. Canada, the United States, the United Kingdom and the EU are among the signatories; obligations apply once ratified.
• The OECD AI Principles (2019, updated 2024) were the first intergovernmental AI standard and underpin many national frameworks; the OECD also hosts the reporting framework for the G7 Hiroshima Process International Code of Conduct for organizations developing advanced AI.
• The United Nations General Assembly has adopted resolutions on safe and trustworthy AI and, in 2025, established an Independent International Scientific Panel on AI and a Global Dialogue on AI Governance.
• Other national approaches include the United Kingdom's principles-based, regulator-led approach; China's binding rules on recommendation algorithms, deep synthesis, generative AI services (2023) and labelling of AI-generated content (2025); and frameworks in Japan, Korea (which enacted a framework AI act in 2024), Singapore and Brazil.

Multinational organizations increasingly build governance programs around common elements of these frameworks, adding jurisdiction-specific requirements as needed (Lesson 12).