The EU AI Act (Regulation (EU) 2024/1689) is the most stringent AI regulation in the world. Breach may attract a fine of up to EUR 35 million or 7% of global annual turnover. A Chinese company is subject to it even without an establishment in the Union, provided it offers AI services to users in the Union.
The four-tier risk classification
| Risk level | Legal consequence | Typical scenarios |
|---|---|---|
| Unacceptable risk | Prohibited outright | Social scoring, manipulative AI, untargeted scraping for facial recognition databases |
| High risk | Strict compliance obligations | CV screening, credit scoring, biometrics, medical triage |
| Limited risk | Transparency obligations | Chatbots, AI-generated content, deepfakes |
| Minimal risk | Largely unregulated | Spam filters, game AI |
Unacceptable risk (prohibited practices)
The practices prohibited by Article 5 include:
- Manipulating individuals by exploiting psychological vulnerabilities
- Exploitation of vulnerable groups
- Social scoring
- Prediction of criminal risk based solely on profiling or personality traits
- Untargeted scraping of the internet or CCTV footage to build facial recognition databases
- Real-time remote biometric identification, save for law enforcement exceptions
- Biometric categorisation based on sensitive attributes such as race, political opinion or religion
- Generation of deepfake content, save where required by law
High-risk AI systems: the eight obligations (Articles 9 to 15)
Examples of high-risk systems (Annex III, eight fields)
- Biometrics — remote biometric identification, biometric categorisation, emotion recognition
- Critical infrastructure — safety components in transport, water, gas and electricity
- Education and vocational training — admission decisions, assessment of learning, examination monitoring
- Employment and work — CV screening, recruitment decisions, performance evaluation
- Essential public services — credit scoring, insurance pricing, prioritisation of emergency calls
- Law enforcement — risk prediction, polygraph substitutes, evaluation of evidence
- Migration and border control — risk assessment, visa applications, identity verification
- Justice and democracy — judicial decision support, influence on elections
The eight core obligations
| Article | Obligation | Requirement |
|---|---|---|
| Article 9 | Risk management | Identification, evaluation, mitigation and control of risk throughout the lifecycle |
| Article 10 | Data governance | Quality, representativeness, completeness and absence of bias in training data |
| Article 11 | Technical documentation | Detailed documentation for regulatory scrutiny |
| Article 12 | Record-keeping | Automatic logging to ensure traceability of operation |
| Article 13 | Transparency | Provision of the information necessary for deployers |
| Article 14 | Human oversight | Design that supports human oversight and prevents autonomous operation |
| Article 15 | Accuracy and robustness | Accurate output and resistance to attack |
CE marking and conformity assessment
A high-risk AI system must:
- bear the CE marking, clearly visible and permanently affixed;
- undergo conformity assessment, which may involve a notified body;
- where provided digitally, make the CE marking accessible by digital means;
- where applicable, carry the identification number of the notified body.
Obligations for general-purpose AI models
Obligations of GPAI providers (Article 53)
- Establish and maintain technical documentation
- Provide downstream providers with information on the model’s capabilities and limitations
- Establish a copyright compliance policy
- Publish a summary of the training data
- Cooperate with the European Commission and Member States
GPAI models with systemic risk
- Model evaluation, including adversarial testing
- Assessment and mitigation of systemic risk
- Reporting of serious incidents to the AI Office
Non-EU GPAI providers
A provider established outside the Union must appoint an authorised representative in the Union to handle regulatory contact and procedural tasks. Partially open-source models may be exempt from some obligations where the parameters, weights, architecture and usage information have been published.
The penalty regime
| Tier | Maximum fine | Scope |
|---|---|---|
| Highest | EUR 35 million or 7% of global annual turnover | Breach of the prohibited practices in Article 5 |
| Middle | EUR 15 million or 3% of global annual turnover | Breach of high-risk, transparency or GPAI obligations |
| Lowest | EUR 7.5 million or 1% of global annual turnover | Supplying incorrect, incomplete or misleading information |
Small and medium-sized enterprises: the fine is the lower of the fixed amount and the percentage.
Implementation timetable
| Date | Milestone |
|---|---|
| 1 August 2024 | The Act enters into force |
| 2 February 2025 | Prohibited practices (unacceptable risk) apply |
| 2 August 2025 | GPAI obligations and the enforcement powers of the AI Office commence |
| 2 August 2026 | Transparency obligations (Article 50) apply |
| 2 December 2027 | Obligations for standalone high-risk systems under Annex III apply (deferred by amendment) |
| 2 August 2028 | Obligations for high-risk systems embedded in regulated products apply |
Compliance recommendations for Chinese companies
Determination of role
| Role | Obligations |
|---|---|
| Provider | System design, conformity assessment, post-market monitoring |
| Deployer | Compliant use, human oversight, retention of logs |
| Importer | Verification on entry, retention of information |
| Authorised representative | Non-EU companies must appoint a representative in the Union |
Action list
| Priority | Action |
|---|---|
| P0 | Assess against Annex III whether the product falls within a high-risk category |
| P0 | Appoint an authorised representative in the Union |
| P1 | Embed AI compliance requirements throughout product development |
| P1 | Prepare technical documentation (Article 11) |
| P1 | Establish a risk management process (Article 9) |
| P2 | Prepare CE marking and conformity assessment |
| P2 | For GPAI models, establish a copyright compliance policy and a training data summary |
Frequently asked questions
Q: We have only a small number of users in Europe. Does the AI Act apply to us? A: Yes. The Act applies to every undertaking that offers AI services to users in the Union, wherever it is established. Even a small user base brings the service within scope.
Q: Our AI product is not high-risk. Does that mean we need do nothing? A: No. Even where the product is not high-risk, the transparency obligations under Article 50 apply: a chatbot must inform users that they are interacting with AI, AI-generated content must be labelled, and deepfakes must be identified as such.
Q: Will the penalties actually be enforced against Chinese companies? A: They may be. The AI Office has investigative and sanctioning powers. TikTok was fined EUR 530 million by the Irish DPC in respect of EU-China data transfers under the GDPR, and the maximum penalties under the AI Act are higher still.
Q: We are a large-model company. How do the GPAI obligations affect us? A: Technical documentation must be established, capability information supplied to downstream providers, a copyright compliance policy adopted and a training data summary published. Where systemic risk exists, for example where the parameter count exceeds the threshold, adversarial testing and reporting of serious incidents are also required.
This article is prepared on the basis of Regulation (EU) 2024/1689 (the EU AI Act). The implementation timetable reflects the amendments made in 2026. For assistance with EU AI Act compliance, please contact Geason Law Offices.