AI Law

First Provisions of the EU AI Act Now Apply: A Comprehensive Overview

Alex Shahrestani

28 Mar 2025 • 8 min read

1. Introduction to the EU AI Act and Its Significance

The European Union has stepped into the future of technology regulation with the introduction of the EU Artificial Intelligence (AI) Act. This landmark legislative framework establishes detailed rules for the development, deployment, and use of AI systems within the EU. At its core, the Act provides a comprehensive definition of what qualifies as an AI system. According to the legislation, an AI system is defined as a "machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments." This broad definition, as detailed by Taylor Wessing, encompasses technologies including machine learning, natural language processing, and even robotics.

For companies and organizations operating within the EU or offering their AI systems to EU customers, understanding this definition is crucial. The Act not only delineates what is subject to regulation but also imposes a series of obligations on AI system developers and deployers. Non-compliance can lead to significant fines and reputational damage. Additionally, adherence to the framework fosters transparency, accountability, and trust amongst users and stakeholders—a critical component as AI systems increasingly influence daily operations and decision-making processes.

Recent market reactions indicate that stakeholders, from tech giants to emerging startups, are engaging with the regulatory framework with both caution and anticipation. As noted by various reputable sources, such as Benesch, Friedlander, Coplan & Aronoff LLP and research outlets like Reuters and Financial Times, the broad scope and strict requirements of the AI Act set a high bar for all involved.

2. Prohibited AI Use Cases Under the EU AI Act

One of the key pillars of the EU AI Act is the explicit prohibition of certain AI practices that are deemed to compromise fundamental rights or pose unacceptable risks to society. The Act clearly outlines several prohibited practices:

Subliminal and Manipulative Techniques: AI systems that covertly influence human behavior—thereby impairing an individual's ability to make informed decisions—are strictly prohibited. Research from PwC Ireland confirms the seriousness of this provision.
Exploitation of Vulnerable Persons: AI practices that are designed to exploit vulnerabilities in specific groups (such as children or persons with disabilities) are not allowed.
Social Scoring: The assessment or classification of individuals based on their social behavior, potentially leading to social scoring that adversely affects their rights and freedoms, is forbidden.
Emotion Inference in Sensitive Areas: There are strict limits on using AI to analyze or infer human emotions in sensitive settings like workplaces or educational institutions, unless there are legitimate, safety-rooted justifications.
Biometric Data Misuse: AI systems that leverage biometric data to deduce sensitive attributes – including race, political, or religious beliefs – fall under this prohibition.
Untargeted Facial Recognition: The expansion of facial recognition databases through methods like untargeted image scraping from the internet or live CCTV feeds is banned.
Real-Time Remote Biometric Identification: In public spaces, the use of AI for real-time biometric identification by law enforcement is permitted only under very narrowly defined circumstances, such as searching for specific victims or suspects in serious crimes.

Failure to adhere to these prohibitions does not come without consequence. Companies found in violation of these provisions can incur administrative fines of up to €35 million or 7% of their total worldwide annual turnover for the preceding financial year – whichever is higher. This approach ensures that the cost of non-compliance is significant enough to motivate companies to build compliant and ethical AI systems from the ground up.

3. Obligation of AI Literacy

Another groundbreaking provision of the EU AI Act is the obligation of AI literacy. The Act mandates that organizations developing, placing on the market, or using AI systems must ensure that users are properly educated about the capabilities and limitations of these technologies. This requirement serves multiple important functions:

Understanding AI Capabilities and Limitations: Educated users are better equipped to interpret AI outputs and recognize potential biases or errors in decision-making processes.
Enhancing Transparency and Accountability: AI literacy ensures that stakeholders understand how decisions are influenced by machine-based recommendations, thus fostering a greater level of trust in the technology.
Reducing Risks of Misuse: With increased awareness and understanding, users are less likely to misuse or misinterpret AI outputs, leading to more responsible application of these technologies.

To enhance AI literacy, companies can implement several strategies:

Adopt Clear AI Usage Principles: Establish guidelines for how AI should be used responsibly within the organization. Resources like those from Orrick offer practical tips in this area.
Develop Comprehensive Training Programs: Regular training sessions, workshops, and online modules can help employees and stakeholders stay updated on the evolving principles of AI ethics and best practices. For instance, platforms such as Medium provide insightful articles on how to navigate this emerging field.
Foster a Culture of Continuous Learning: Encourage open dialogue and regular updates about new developments in AI. This not only keeps the workforce informed but also builds a foundation of trust and accountability in using AI technologies.

Ultimately, investing in AI literacy is not just about regulatory compliance—it’s about empowering users to interact with AI systems in a way that propels innovation and protects individual rights.

4. Transition Timelines for Additional Provisions

The EU AI Act is designed with a phased approach to implementation, ensuring that organizations have adequate time to prepare for different sets of requirements. This gradual roll-out is essential given the complexity and breadth of the regulations. Here are some key timelines outlined in the Act:

February 2, 2025: Certain basic standards, including prohibited AI practices, will begin enforcement.
May 2, 2025: The European Commission is expected to finalize codes of practice for General Purpose AI (GPAI) models.
August 2, 2025: Obligations for providers of GPAI models will commence, including the designation of national competent authorities and the establishment of penalty rules.
February 2, 2026: Post-market monitoring for high-risk AI systems will be implemented.
August 2, 2026: Additional obligations concerning high-risk AI systems in areas such as biometrics and critical infrastructure will take effect. At least one operational AI regulatory sandbox must also be established by this time.
August 2, 2027: More advanced requirements for high-risk AI systems intended as safety components of products will come into force.
By the end of 2030: Further obligations will apply to AI systems that are components of large-scale IT systems, such as those relevant to law enforcement and security measures.

In light of these transition timelines, organizations are advised to develop comprehensive strategies to prepare for upcoming changes. This might include performing a current state assessment of all AI systems, aligning practices with future requirements, ramping up training programs, and consulting with legal experts on compliance matters. Being proactive in these areas will help prevent disruptions and ensure a smooth transition into the new regulatory environment.

5. Impact on Startups and Innovation

The EU AI Act has far-reaching implications not only for established corporations but also for startups and innovators in the AI space. While the Act aims to secure a safe and trustworthy use of AI, it also introduces challenges for emerging companies that may have limited resources:

Compliance Challenges: Startups, especially small and medium-sized enterprises (SMEs), might find it challenging to meet all the stringent requirements of the Act given their resource constraints. Recognizing this, the European Commission has anticipated these issues by allowing for simplified technical documentation and offering reduced fees for conformity assessments based on company size. However, the financial burden is still significant, with some studies estimating that compliance costs can average around €400,000 annually. For instance, a healthcare AI startup based in Amsterdam might have to spend up to €500,000 per year merely to comply with the new regulations.

Balancing Compliance and Innovation: While regulatory compliance may initially seem like it stifles innovation, many experts argue that it can also serve as a catalyst for trust. Startups that integrate ethical AI practices and demonstrate compliance can boost their credibility with investors. Furthermore, adherence to robust regulatory standards can attract partnerships and funding opportunities, ultimately driving long-term success and competitive advantage.

Best Practices for Startups: To navigate this complex regulatory landscape, startups should consider several strategies, including:

Leveraging Compliance Technology: Investing in automated tools that streamline compliance can reduce manual efforts and minimize errors.
Adopting Agile Methodologies: Flexibility is key. Agile practices help organizations quickly adapt to regulatory changes while continuously improving their systems.
Utilizing Regulatory Sandboxes: These sandboxes offer a controlled environment where startups can test and refine their AI solutions under regulatory oversight.

By integrating these best practices, startups can strike a balance between maintaining regulatory compliance and fostering innovation. This dual focus not only minimizes risk but also positions them to capitalize on new market opportunities and build lasting trust with consumers and stakeholders.

6. Conclusion and Future Outlook

In summary, the enforcement of the first provisions of the EU Artificial Intelligence Act marks a significant turning point in the regulatory landscape for AI in Europe. The Act’s regulatory framework is designed to ensure that AI systems operate safely, transparently, and ethically. It encompasses a wide-ranging definition of AI, sets out strict prohibitions on high-risk practices, mandates AI literacy among users, and introduces transition timelines to allow for gradual compliance.

Looking ahead, we can expect the EU AI Act to evolve as technologies evolve. Future provisions may address more nuanced aspects of AI, but the foundational emphasis on safety, transparency, and accountability will likely remain unchanged. Organizations are encouraged to stay abreast of new developments by engaging in continuous learning and proactive planning.

For businesses, startups, and regulators alike, the key takeaway is clear: staying informed and being proactive is essential in this new era of AI regulation. Whether through comprehensive training programs, leveraging advanced compliance tools, or participating in regulatory sandboxes, the path forward requires a blend of diligence, innovation, and ethical responsibility.

The challenge of integrating state-of-the-art AI systems into our daily lives comes with great responsibility. By fostering an environment where transparency, accountability, and continuous learning are prioritized, the EU sets a new global standard. As the regulatory framework expands and matures over time, companies that adapt early will not only avoid penalties but will also gain a competitive edge in a rapidly evolving technological landscape.

Call to Action: If your organization operates in the AI domain or if you are a startup navigating this new regulatory terrain, now is the time to review your AI systems, invest in AI literacy training, and commit to a proactive compliance strategy. Staying ahead of regulatory changes will ensure that you are well-positioned for both legal compliance and market success. The future of AI is not only about technological advancement but also about building systems that are trustworthy, fair, and beneficial for society as a whole.

Additional Resources and Recent News

Stay informed by following key updates on the implementation of the EU AI Act. Recent developments include:

Final Thoughts

The EU AI Act signals a transformative moment in the regulation of emerging technologies. With its initial provisions now in force, the Act sets the stage for a future where artificial intelligence is integrated responsibly and ethically. Embracing these regulations is not just a legal requirement; it is a commitment to building a more transparent, fair, and trustworthy digital society. As we witness the evolution of AI governance, the proactive steps taken today will shape the future of innovation and societal well‐being for years to come.

Remember: in the rapidly advancing world of AI, knowledge is power—and compliance is key to unlocking a safer, more innovative tomorrow.