EU AI Act
Also called AI Act, Regulation (EU) 2024/1689, EU Artificial Intelligence Act
The European Union's law on AI systems, Regulation (EU) 2024/1689, whose strictest rules fall on systems it classes as high-risk.
The EU AI Act is a regulation, so it applies directly in every EU member state. It sets rules for AI systems according to what they are used for, and the heaviest rules are for systems it classes as high-risk.
A system is high-risk in one of 2 ways: it is used in an area the law lists, such as recruitment, and poses a significant risk of harm, or it is a product, or a safety part of one, covered by the EU product laws the Act lists. Duties fall on the provider who builds such a system and on the deployer who uses it.
For a security team the useful questions are whether any system it provides or uses is high-risk, and which start date follows from that.
For example
A company in Germany uses bought-in software to screen job applications. That use is on the law's high-risk list, so the company checks whether the tool counts as high-risk and which duties and date apply.
Put it to use
Where you'll meet EU AI Act in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.