AI Act
AI Act is an EU regulation establishing requirements for artificial intelligence systems. AI Act classifies AI systems by risk (unacceptable, high, limited, minimal) and introduces obligations for providers and users, including transparency, testing, and human oversight requirements.
AI Act Definition
AI Act (Artificial Intelligence Act) is a European Union regulation adopted in 2024 that comprehensively regulates the development and use of artificial intelligence systems. AI Act is the first such comprehensive AI regulation in the world, introducing a risk-based approach and specific requirements for AI system providers and users.
AI Act, Security and Compliance
The AI Act ties closely to cybersecurity and risk management: high-risk AI systems must meet requirements for robustness, accuracy and security, including resilience against manipulation such as data poisoning and adversarial attacks. Compliance therefore overlaps with established security practices.
For organizations, aligning AI Act obligations with existing frameworks (e.g. ISO/IEC 27001, risk management) is the efficient path to preparing your organization for the AI Act — treating AI governance as part of, not separate from, the security program.
AI Risk Categories
Unacceptable risk (prohibited):
- Social credit systems
- Exploiting vulnerable groups
- Real-time biometric identification in public spaces (with exceptions)
- Subliminal manipulation
- Emotion recognition in workplace/education
High risk:
- Critical infrastructure
- Education and employment
- Public services
- Law enforcement
- Migration and asylum
Limited risk:
- Chatbots and virtual assistants
- Emotion recognition systems
- Deepfake generators
- Transparency obligation
Minimal risk:
- Video games
- Spam filters
- Inventory management
- No special requirements
Requirements for High-Risk AI
- Risk management system
- Data quality and governance
- Technical documentation
- Record keeping (logging)
- Transparency for users
- Human oversight
- Accuracy, robustness, security
- CE marking
AI Act Timeline
- 2024: Regulation adoption
- 2 February 2025: Ban on prohibited practices and AI literacy (Article 4)
- 2 August 2025: Obligations for GPAI (General Purpose AI)
- 2 August 2026: Transparency obligations (Article 50), including labelling of AI-generated content
- 2 December 2026: New Article 5 prohibitions added by Regulation (EU) 2026/1744, and Article 50(2) for systems placed on the market before 2 August 2026
- 2 December 2027: High-risk AI systems listed in Annex III
- 2 August 2028: High-risk AI systems covered by Annex I
The deadlines for high-risk systems were moved by Regulation (EU) 2026/1744 (Digital Omnibus) — as of 7 October 2026.
AI Act and Cybersecurity
AI Act includes cybersecurity requirements:
- Robustness against attacks
- Protection against manipulation
- Incident logging
- Security by design
Penalties
- Prohibited practices: Up to €35M or 7% of turnover
- High-risk violations: Up to €15M or 3% of turnover
- False information: Up to €7.5M or 1% of turnover
AI Act vs Other Regulations
| Aspect | AI Act | GDPR | NIS2 |
|---|---|---|---|
| Subject | AI systems | Personal data | Cybersecurity |
| Approach | Risk-based | Rights-based | Security-based |
| Scope | AI providers and users | Data controllers | Essential entities |
AI Act is a groundbreaking regulation that will fundamentally change the AI industry in Europe, imposing obligations on both AI system providers and their users.