Prohibited AI, high-risk systems, transparency requirements, general-purpose AI: For months now, we’ve been encountering a steady stream of new terms related to the European AI Act. But what do they actually mean? A look at the European Union’s first comprehensive set of AI regulations—without getting lost in the jungle of legal provisions.

As of August 30, 2026 · This post is for general informational purposes only and does not constitute legal advice.

Artificial intelligence is evolving at such a rapid pace that even people who work with technology every day sometimes struggle to keep up.
Today we’re talking about chatbots.
Tomorrow, we’ll talk about AI agents.
The day after tomorrow, we’ll talk about systems that perform complex tasks on their own.

At the same time, AI is making its way into businesses, schools, government agencies, the medical field, human resources departments, and numerous products.

And at some point, the question inevitably arises:

• Do we actually need rules for this?

The European Union answers this question quite clearly:

• Yes.

With Regulation (EU) 2024/1689, better known as the AI Act or AI Regulation, the EU has established a comprehensive legal framework specifically for artificial intelligence. The regulation entered into force on August 1, 2024. However, not all of its provisions take effect at the same time; rather, they will be phased in gradually. EUR-Lex

And this is precisely where one of the most common misunderstandings begins.

Because “The AI Act is in effect” does not mean:

As of a certain date, all regulations apply to all AI systems.

It's not that simple.

WHAT HAPPENED?

On August 2, 2026, another major portion of the European AI Act took effect. At the same time, the European Commission’s AI Office and the relevant national authorities began enforcing additional regulations.

Among other things, new transparency requirements for certain AI systems have been in effect since that day. Europe's Digital Strategy

The path toward this, however, began much earlier.
The AI Act was passed in 2024 and took effect on August 1, 2024.
On February 2, 2025, the first regulations took effect. These included, in particular, rules regarding certain prohibited AI practices as well as obligations related to AI literacy.
On August 2, 2025, governance rules and obligations for providers of general-purpose AI models—GPAI for short—were introduced, among other provisions.
Since August 2, 2026, another major portion of the regulatory framework has been in effect.
Other provisions will follow at a later date. For example, the rules for certain high-risk use cases have additional transition periods. Europe’s Digital Strategy

The AI Act is therefore less of a single starting point and more of a multi-year regulatory roadmap.

WHY DOES THE AI ACT EXIST IN THE FIRST PLACE?

To understand this, we first need to ask another question:

What is it about AI that makes it so special that we need separate rules for it?

After all, laws were already in place even before the AI Act.
Data protection law didn’t just disappear overnight.
Consumer protection already existed.
The same goes for product safety law, and of course, other existing legal provisions remain in effect as well.

However, the European Commission argues that existing regulations are not sufficient to address all of the specific challenges posed by AI systems. Europe's Digital Strategy

This is because AI can possess characteristics that traditional software did not necessarily have in this form. For example, systems can identify patterns in enormous amounts of data. They can prepare or influence decisions. Their results may be difficult for users to understand, and errors can, under certain circumstances, affect a large number of people at the same time.

That doesn't automatically mean:

• AI is dangerous.

Rather, it means:

• The risk depends on how the AI is used.

And that is precisely what the AI Act is based on.

NOT ALL AI IS EQUALLY DANGEROUS

One of the key concepts of the AI Act can be explained with surprising simplicity:

The greater the risk associated with an AI application, the stricter the requirements may be.

The European approach is therefore risk-based.

The Commission identifies four risk levels: unacceptable risk, high risk, transparency risks, and minimal or no risk. Europe's Digital Strategy

And it is precisely this distinction that matters. After all, a spam filter is not the same as an AI system that helps determine whether someone gets a loan. An AI opponent in a video game is not the same as software that evaluates job applicants, and image generation for fun is not the same as a deceptively realistic deepfake of a real person. That is precisely why the AI Act does not attempt to lump all these systems together. Let’s take a closer look at the different areas.

1. UNACCEPTABLE RISK: WHAT THE EU IS NOT WILLING TO ACCEPT

There are certain AI practices regarding which the European Union states:

• We don't want to simply regulate this risk. Certain uses will be banned.

Prohibited practices include, for example, certain forms of harmful manipulation or deception, certain forms of social scoring, certain biometric categorizations, and—with narrow, legally defined exceptions—certain forms of real-time remote biometric identification for law enforcement purposes in publicly accessible spaces. Europe’s Digital Strategy

Accuracy is important here as well.

For example, the AI Act does not say:

• Facial recognition is completely banned in Europe.

It governs specific practices and, in some cases, specific operational situations.
That’s the difference.
That’s why, especially when it comes to legal regulations, caution is advised when relying on oversimplified headlines.

“EU Bans AI” sounds sensational.

However, it does not describe what the AI Act actually does.

2. HIGH RISK: AI MAY BE USED—BUT UNDER STRICT CONDITIONS

The next group is particularly interesting.

High-Risk AI.

In this case, the EU does not say, as a general rule:

• This technology must not be used.

Instead, the approach is as follows:

• When AI is used in particularly sensitive areas and meets the legal requirements, special requirements apply.

These may include, for example, certain applications in areas such as education, employment, critical infrastructure, migration, or access to essential private and public services. Certain AI systems that fall under specific EU product regulations as products or safety components may also be classified as high-risk systems. Europe's Digital Strategy

We already know a good example from our first article:

Applications.

If AI is used to analyze job applications, screen candidates, or evaluate people in the context of certain employment decisions, this may fall under the high-risk rules.

Why?

Because a mistake here can have far more serious consequences than simply recommending the wrong streaming service. For high-risk systems, the AI Act therefore sets out requirements regarding, for example, risk management, data quality, technical documentation, logging, human oversight, accuracy, robustness, and cybersecurity. Europe’s Digital Strategy

However, timing is particularly important here. According to the current implementation roadmap, the rules for certain high-risk use cases listed in Annex III will take effect on December 2, 2027. For certain high-risk AI systems embedded in regulated products, the effective date is set for August 2, 2028. Europe's Digital Strategy

This is a good example of why the sentence

• "The AI Act will be fully in effect as of August 2026"

would be too imprecise.

3. TRANSPARENCY RISK: WHEN WE NEED TO KNOW THAT AI IS INVOLVED

This is where the AI Act becomes immediately apparent to many people in their everyday lives.

This is because, as of August 2, 2026, certain transparency requirements under Article 50 of the European Digital Strategy will take effect.

The basic idea is simple:

In certain situations, people should be able to recognize when they are dealing with AI or AI-generated or manipulated content.

One example is certain interactive AI systems. People should generally be informed when they are interacting with an AI system rather than a human, unless this is already obvious. Transparency requirements also apply to certain types of artificially generated or manipulated content. Deepfakes must be disclosed accordingly under the conditions set forth by law. Providers of generative AI systems must also ensure that certain synthetic content is identifiable as artificially generated or manipulated in a machine-readable format. Europe’s Digital Strategy

Why is this important?

Because AI can now generate images, voices, and videos where it may be nearly impossible for us to tell with the naked eye or ear whether something is real. This isn't just changing technology; it's changing our information environment.

4. MINIMAL OR NO RISK: YES, THAT EXISTS, TOO

This aspect tends to get lost in public discussions. That’s because “the EU is regulating AI” can easily sound as if anyone who uses an algorithm anywhere will have to fill out a mountain of forms in the future. That is not in line with the basic framework of the AI Act.

The European Commission notes that the vast majority of AI systems currently in use in the EU fall into the category of minimal or no risk. It cites AI-powered video games and spam filters as examples. For this category, the AI Act does not introduce any additional mandatory rules due to this low level of risk. Europe's Digital Strategy

This is crucial for understanding the law.

The AI Act is not:

• "AI is dangerous, so let's regulate everything."

Rather:

• "Let's take a look at the risks associated with a particular application—and respond accordingly."

AND WHAT ABOUT CHATGPT AND OTHERS?

Now things are getting a little more complicated.

After all, modern AI models don't always fit neatly into our expectations:

One system—one task—one risk.

Large so-called general-purpose AI (GPAI) models can be used for a wide variety of purposes.

They can generate text.
Write program code.
Summarize information.
Analyze images.
Or serve as the basis for numerous other applications.
That is why the AI Act includes specific rules for providers of such models.

GPAI providers are subject to, among other things, transparency and documentation requirements, as well as requirements related to copyright. For particularly powerful GPAI models that pose systemic risks, additional obligations apply, such as the assessment and mitigation of systemic risks, model testing, cybersecurity, and the reporting of serious incidents. Europe's Digital Strategy

And here's something interesting:

The AI Act does not merely focus on the finished AI product. In some cases, it also delves deeper into the AI value chain. This is because a foundational model can later become a component of numerous other applications.

DOES EVERY COMPANY NOW HAVE TO FEAR MILLION-DOLLAR FINES?

No.

But companies shouldn't ignore the AI Act either.

In fact, one of the first questions isn't:

• "What punishment do we face?"

Rather:

• "What role do we even play?"

Does a company develop an AI system on its own?
Does it offer one under its own name?
Does it merely use a third-party system?
Is it even an AI system as defined by the regulation?
What specific function does it perform?
And in what context is it used?

Only then can one meaningfully determine which regulations are relevant.

That is exactly why the AI Act is not a simple checklist with the heading:

• Companies Using AI → Do These Ten Things.

The specific role and application are crucial.

WHAT DOES AI LITERACY HAVE TO DO WITH IT?

I find one provision of the AI Act particularly interesting because it shows that regulation isn't just about technology.

Article 4: AI Competence.

The relevant regulations have been in effect since February 2, 2025. Europe's Digital Strategy

Providers and operators of AI systems should take measures to ensure, to the best of their ability, that their staff and other individuals involved in the operation and use of AI systems on their behalf possess a sufficient level of AI competence.

That doesn't simply mean:

• Everyone has to take an AI course now.

This is about something more fundamental.
Anyone working with AI should have a reasonable understanding of what they’re actually using.
What can the system do?
What are its limitations?
What risks are involved?
In what context is it used?
This is precisely where regulation and education intersect.
After all, responsible use of AI doesn’t come about through regulations alone.
It requires people who understand what they’re doing.

IS THE AI ACT HINDERING INNOVATION?

And that brings us to one of the major controversies. One side sees the AI Act as an important protective framework. AI can influence fundamental rights, security, and social processes. That’s why Europe needs clear rules before problematic practices become the norm. The other side warns against too much bureaucracy. Complex requirements can be costly, especially for smaller companies and startups. While large technology conglomerates can afford to employ entire legal and compliance departments, the situation is different for a small European AI company.

This discussion is by no means over.

The fact that the EU is now working on simplifying and adjusting the implementation roadmap itself shows that regulation is not a static process. The lists of prohibited practices and certain high-risk applications are also being reviewed and may be adapted to technological developments. Europe's Digital Strategy

Perhaps that is why the more interesting question is not:

• Regulation or Innovation?

Rather:

• How can we create rules that protect people without unnecessarily hindering meaningful innovation?

Europe will have to keep finding new answers to this in the coming years.

WHAT DOES THE AI ACT MEAN FOR US?

For most people, the AI Act doesn’t initially mean they’ll have to sit down on the couch in the evening with an EU regulation that’s several hundred pages long. But its effects will become increasingly apparent. We’ll be notified more frequently when we interact with AI. We’ll see labels indicating AI-generated or manipulated content. Companies will have to pay closer attention to which AI systems they use and the responsibilities that come with them. Developers and providers will have to grapple with new requirements. Regulatory agencies will have to enforce rules. Courts will interpret regulations. And we’ll likely find in some cases that regulations need to be adjusted because technology has evolved faster than lawmakers could have anticipated. That’s normal. Laws aren’t set in stone. They represent a society’s attempt to create rules for a reality that is constantly changing.

THE AI ACT IS NOT A “ONE-SIZE-FITS-ALL AI CODE”

Perhaps that is the most important insight.
The AI Act does not address every legal issue surrounding artificial intelligence.
Data protection is not going away.
Copyright law is not going away.
Product liability is not going away.
Labor law is not going away.
Consumer protection is not going away.

The AI Act is being enacted in addition to the existing legal framework.

And that’s why, in the future, it will hardly be enough to simply say, whenever a legal question about AI arises:

• "It's definitely in the AI Act."

Sometimes the answer will be found there.
Sometimes in the GDPR.
Sometimes in copyright law.
Sometimes in labor law, and sometimes multiple areas of law will be relevant at the same time. That is exactly what makes AI and the law so interesting—and at the same time so challenging.

SO WHAT NOW?

The AI Act is no longer a distant prospect. It is now European law, and its provisions have gradually become applicable and will continue to do so. Some rules are already in effect. Others will follow later. Some applications are prohibited. Others are subject to specific requirements. And many everyday AI systems continue to fall into a low-risk category.

That's why neither panic nor the phrase:

• "Brussels is now regulating just about every AI."

What helps is understanding what is actually being regulated—and why.

Only then can we have a meaningful discussion about whether these rules are good, where they go too far, and where there might still be gaps.

And that's exactly why it's worth looking beyond the headline.

Not to have an opinion imposed on you, but to be able to form your own.

---

Note: This article is intended to provide general information and context. It does not constitute legal advice. The applicable legal provisions and the circumstances of each specific case are decisive.

For this article, I have deliberately relied primarily on the EU regulation itself and current information from the European Commission. The AI Act generally takes effect on August 2, 2026, but includes phased implementation deadlines; furthermore, the implementation roadmap for high-risk systems in 2026 has evolved. EUR-Lex

Original text of Regulation (EU) 2024/1689 – EUR-Lex
AI Act – Overview by the European Commission
Current Enforcement Framework of the AI Act
EU Guidelines on Transparency Requirements
EU Guidelines on Prohibited AI Practices