- It establishes a regulatory framework based on risk levels to protect fundamental rights and citizen security.
- It imposes strict transparency and risk management obligations for high-risk AI systems and general-purpose models.
- It categorically prohibits the use of AI technologies that are deemed unacceptable, such as social scoring or behavioral manipulation.
- Define a gradual implementation schedule with severe economic penalties for those who ignore the regulations.
The European Union has taken a decisive step by launching the world's first comprehensive legal framework to regulate artificial intelligence. This legislation does not aim to stifle innovation, but rather to ensure that the technology develops safely and reliably , always prioritizing the protection of fundamental human rights and preventing AI from becoming an uncontrolled black box.
To achieve this, Brussels has opted for a risk-based approach, meaning that a spam filter is not the same as an algorithm that decides who gets a bank loan. Depending on the level of risk the system poses to health or safety, the legal requirements will be more or less stringent, forcing companies to be transparent about how their machines work.
Prohibited systems: the EU's red line
There are some things that simply cannot be done. The law is very clear in prohibiting AI that poses an unacceptable risk . Among these are subliminal or manipulative techniques that seek to distort human behavior to cause harm, as well as the exploitation of vulnerabilities related to age or disability. Social scoring , the practice of classifying people based on their behavior to give them unfavorable treatment, is also prohibited .
Regarding biometrics, categorization that infers sensitive traits such as race or religion is prohibited, as is the indiscriminate scanning of faces online to create databases. Real-time remote biometric identification in public spaces is restricted to very specific cases , such as searching for victims of trafficking, preventing imminent terrorist attacks, or locating suspects in serious crimes, always under judicial supervision.
The high-risk category and its requirements
Not everything that's prohibited is dangerous, but some systems, while permitted, are subject to strict controls . This includes security components, medical devices, and algorithms used in hiring and credit evaluation. If an AI is tasked with creating profiles of individuals to assess their job performance or health, it falls squarely into this category.
Providers of these tools must fulfill a long list of tasks. It is mandatory to implement a risk management system throughout the product lifecycle and ensure that training data is representative and error-free. Furthermore, they must create detailed technical documentation, automatically record events using operational logs , and guarantee that there is always real human oversight to prevent erroneous automated decisions.
General Purpose AI Models (GPAI)
This is where the renowned LLMs and foundational models come in . The law distinguishes between standard GPAI models and those that present a systemic risk , generally defined by massive use of computing power (greater than 10^25 FLOPs). Providers of these models must be transparent about their training processes and respect copyright directives.
For models with systemic risk, the bar is higher. They must perform red teaming to mitigate failures, report serious incidents to the AI Office, and ensure robust cybersecurity . It's worth noting that open-source models have some advantages, although they are still required to publish summaries of the content used to train the machine.
Governance, deadlines, and the cost of breaking the law
Oversight falls primarily to the AI Office , which monitors tech giants to ensure compliance. The law's rollout is phased in: prohibitions began in February 2025, while obligations for high-risk systems will come into effect between 2027 and 2028. To assist companies, the AI Pact has been created as a voluntary pathway to prepare for the regulations.
If a company decides to flout the rules, the fines are staggering. Providing false information can cost up to €7,5 million or 1,5% of annual revenue. However, failing to meet core obligations can raise the penalty to €15 million or 3% of global revenue, although some sources mention that in extreme cases it could reach 7%.
This regulatory framework positions Europe as the global benchmark in technological regulation , requiring any company in the world that wants to operate in the common market to adapt its algorithms to European standards of transparency and ethics, thus balancing technical progress with human dignity.
