On 8 December 2023 negotiators for the European Parliament and the Council reached a provisional political agreement on the Artificial Intelligence Act. The European Commission described the agreement as making the EU the first region to set clear rules for the use of AI. The Act still required formal adoption by Parliament and Council and publication in the Official Journal before entering into force.
Its importance lies not in the number of provisions but in an operable risk-tier structure. The first question for companies is no longer whether they use AI, but which risk tier their AI falls into.
Four risk tiers
The Act broadly divides AI systems into four categories: unacceptable risk, high risk, limited risk and minimal risk.
Unacceptable-risk uses are prohibited, such as manipulative exploitation of personal vulnerabilities, social scoring and certain biometric uses. High-risk systems face stricter requirements, including risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy and robustness. Limited-risk systems mainly bear transparency duties, such as informing users that they are interacting with AI. Minimal-risk systems face little additional regulation.
General-purpose AI models
The Act sets separate transparency and risk-management requirements for general-purpose AI models, including large language models. Model providers must supply technical documentation, usage instructions and copyright-compliance statements, and assess high-risk uses.
For companies building products on foundation models, the impact runs both ways: providers pass compliance information downstream, while product companies must still determine whether their specific application is high-risk. A compliant model does not exempt the product.
Extraterritorial effect
The Act has extraterritorial reach. Where the output of an AI system is used in the EU market, or a provider is in a third country but the output is used in the EU, the Act may apply. The logic resembles extraterritorial application in data protection.
For Chinese companies, three roles must be distinguished when entering the EU: model provider, system provider and deployer. Obligations and compliance documents differ by role.
What companies can prepare now
First, build a use inventory. List AI uses by product function and assess each against prohibited uses and high-risk areas.
Second, determine the role. Clarify whether the company is a provider, deployer or importer under the Act, avoiding the wrong compliance template.
Third, prepare technical documentation: system description, design logic, training-data sources, testing methods and known limitations.
Fourth, establish human oversight. High-risk systems need operable oversight arrangements, not a promise in a manual.
Fifth, watch the timeline. Entry into force and application of obligations differ; work backwards from product launch plans.
For EU AI Act applicability, see our EU AI Act service; for comparison across jurisdictions, see multi-jurisdiction; for launch documentation, see AI product launch documents.
This article is based on public information from the European Commission and European Parliament on the political agreement on the AI Act reached on 8 December 2023. It is for reference only and does not constitute legal advice.