Last reviewed: May 24, 2026

What is the AI Act? Definition and business implications

The AI Act is European Regulation 2024/1689, the world's first legal framework to classify AI systems by risk level and to impose differentiated obligations: prohibition for unacceptable uses, strict requirements for high-risk systems, transparency for the rest.

The AI Act (EU Regulation 2024/1689) entered into force on 1 August 2024, with a progressive application until 2027. The text classifies AI systems into four risk levels. Unacceptable risk (banned since February 2025): social scoring, behavioural manipulation, real-time biometric identification in public spaces. High risk (applicable from 2 August 2026): AI systems in recruitment, education, justice, credit, insurance, public services. These systems require detailed documentation, testing, European registration, human oversight. Limited risk: transparency obligations (informing the user that they are interacting with AI). Minimal risk: no specific obligation. Foundation model (GPAI) providers have their own obligations since August 2025: documentation of training sources, copyright compliance policies, evaluation of systemic risks for powerful models.

Concrete example

A 800-employee French mid-cap uses an AI tool to filter candidate CVs for hiring. Under the AI Act, this system falls into the “high risk” category (annex III, point 4 of the regulation). From 2 August 2026, the company (or its provider, depending on the responsibility split) must have detailed technical documentation of the system, a conformity assessment, an effective human oversight mechanism, and a registration declaration in the European database. Non-compliance exposes to sanctions of up to 35 million euros or 7% of worldwide turnover, whichever is higher.

Three implications

The AI Act is not a sectoral text, it is a horizontal framework that affects every AI deployment in Europe. Three implications for the executive. First, the risk classification of your deployment is the first decision to take, before any technical choice. Recruitment, credit scoring, access to public services, occupational safety: all are high risk by default. Second, the AI Act applies to non-European companies as soon as the system's results are used in Europe. Choosing a U.S. or Chinese provider does not exempt you. Compliance is an obligation of the deployer, not just the provider. Third, sanctions are calibrated to be dissuasive: up to 35 million euros or 7% of worldwide turnover, whichever is higher. That is above the GDPR ceiling (4%). AI compliance is no longer optional, nor postponable.

Sources

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 (AI Act). https://eur-lex.europa.eu/eli/reg/2024/1689/oj (accessed 2026-05-24)
AI Act, European Commission, official presentation page. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai (accessed 2026-05-24)

← Back to glossary

What is the AI Act? Definition and business implications

Concrete example

See also

Further reading

Sources