EU AI Act

Full definition

The Act classifies AI systems into four tiers: prohibited (e.g., social scoring, real-time biometric ID in public spaces for law enforcement, with narrow exceptions), high-risk (Annex III use cases such as hiring, credit scoring, life and health insurance pricing, critical infrastructure, law enforcement, education and biometrics, plus AI in products covered by Annex I legislation such as medical devices), limited-risk (chatbots, deepfakes — transparency obligations), and minimal-risk. General-purpose AI models (GPAI) face additional obligations on documentation, copyright, and — for systemic-risk models — evaluation and cybersecurity. Fines reach €35M or 7% of global annual turnover, whichever is higher.

Why it matters

The EU AI Act applies extraterritorially: any organization placing AI on the EU market or whose AI outputs are used in the EU is in scope, regardless of where the company is headquartered. Most large US, UK, and Asian firms therefore plan their global AI compliance around the AI Act, similar to how GDPR became the de facto global privacy baseline.

Example

A US healthcare-AI vendor selling to French and German hospitals must produce a conformity assessment, technical documentation, post-market monitoring plan, and CE marking under the AI Act's high-risk medical-device pathway — even though its primary market is the United States.

Next steps

• Get a free workflow map →We map one of your workflows and give you a written verdict: software, a process change or AI. No obligation.
• AI consulting cost guide →Hourly rates and project budgets by firm tier, from independents to the Big Four.

Related terms

• AI Governance
  AI governance is the framework of policies, roles, controls, and processes an organization uses to ensure its AI systems are lawful, safe, fair, accountable, and aligned with business intent — across the full lifecycle from problem framing to retirement.
• AI Audit
  An AI audit is a structured, evidence-based examination of an AI system or AI program against defined criteria — covering training data, model, deployment context, monitoring, and governance — performed by an internal team, an external firm, or a regulator.
• AI Bias
  AI bias is systematic, unfair difference in an AI system's outputs across demographic, geographic, or other groups — usually caused by biased training data, biased labels, or biased problem framing rather than the algorithm itself.
• Explainability (XAI)
  Explainability (XAI) is the property of an AI system whose decisions can be understood by humans — through model-level documentation, prediction-level attributions, and counterfactual explanations — and a regulatory expectation in finance, healthcare, hiring, and other high-stakes domains.
• Algorithmic Accountability
  Algorithmic accountability is the principle that a specific person, role, or organization is identifiable and answerable for the design, deployment, outcomes, and harms of an automated decision system — and that the mechanisms to enforce that answerability exist.

More governance & risk terms

• Differential Privacy
  Differential privacy is a mathematical framework that bounds how much any single individual's data can influence the output of an analysis or trained model — providing a quantifiable privacy guarantee (epsilon) rather than relying on after-the-fact anonymization.
• Factuality
  Factuality is the property of an AI system's outputs being verifiably true with respect to a trusted reference corpus or world knowledge — a distinct dimension from fluency, helpfulness, or generic accuracy.