Responsibility, Law & Governance
EU AI Act
The first major AI law: applications are sorted by risk — prohibited practices (such as social scoring), high risk with a catalog of obligations (hiring, credit, medicine), transparency duties for the rest, separate rules for large models. Phased in since 2025/2026. For most companies this means: know which class your own applications fall into, and be able to prove it.
An example
The regulation sorts by risk, not by technology. A language model that drafts marketing copy is practically unregulated. The same model sorting job applications falls into the high-risk area — with obligations around risk management, data quality, logging, human oversight and transparency. The difference lies not in the system but in its use. Classification must therefore happen per use case, not per tool.
A closer look
The regulation is tiered by risk: prohibited practices, high-risk applications with obligations on data, documentation, oversight and logs, transparency duties for systems that interact with users, plus separate rules for foundation models. The obligations apply in phases since 2025.
Why it matters
For most companies, two points matter more than the details. First: as a deployer you have obligations of your own even if you only buy the system — in particular on human oversight, intended use and the AI literacy of staff. These cannot be passed through to the vendor. Second: the practical starting point is a register of the systems in use and how they are used. Without it no classification is possible, and most organizations do not have one. This is an overview, not legal advice.
Commonly misunderstood
What matters is not whether AI is used but for what. The same technology can be uncritical in marketing and high-risk in recruiting.