What is the EU AI Act?
The EU Artificial Intelligence Act is the world's first comprehensive, horizontal law on AI. This module explains what it is for, what counts as an "AI system", who it applies to — and who it doesn't.
Learning objectives
- Describe the purpose of the AI Act and how it fits with other EU law
- Apply the legal definition of an AI system
- Explain the Act's territorial reach, including outside the EU
- Distinguish between providers, deployers and other operators
1.1 Why the EU regulated AI
The AI Act — formally Regulation (EU) 2024/1689 — entered into force on 1 August 2024. Because it is a regulation rather than a directive, it applies directly in every EU member state without needing national legislation to bring it into effect.
Its stated aim is to improve the functioning of the internal market and promote the uptake of human-centric and trustworthy AI, while ensuring a high level of protection of health, safety and fundamental rights — including democracy, the rule of law and environmental protection.
In practice, the Act tries to do two things at once:
- Protect people from AI that is harmful, manipulative or discriminatory.
- Support innovation by creating one set of rules across the EU instead of 27 different ones, with lighter treatment for low-risk AI and support for SMEs.
Much of the Act borrows from the EU's "New Legislative Framework" for product safety — think CE marking, conformity assessment and market surveillance. If you've worked with medical devices or machinery regulation, many concepts will feel familiar.
How it fits with other law
The AI Act sits alongside other EU law rather than replacing it. The GDPR still governs personal data used by AI systems; consumer protection, product liability, copyright, employment and anti-discrimination law all continue to apply. An AI system can be fully compliant with the AI Act and still breach the GDPR.
In July 2026 the EU adopted the Digital Omnibus on AI — Regulation (EU) 2026/1744, in force from 27 July 2026. It amends the AI Act: postponing the high-risk deadlines, adding new prohibitions, softening the AI literacy duty and extending SME relief to small mid-caps. This course reflects the amended Act.
1.2 What counts as an "AI system"?
Article 3(1) defines an AI system as:
"a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments."
The definition is closely aligned with the OECD's definition. The key elements are:
| Element | What it means |
|---|---|
| Machine-based | Runs on hardware and software. |
| Varying levels of autonomy | Operates with some degree of independence from human involvement. |
| May exhibit adaptiveness | It may learn or change after deployment — this is optional, not required. |
| Infers how to generate outputs | The decisive element. The system derives outputs from inputs using techniques such as machine learning or logic- and knowledge-based approaches, rather than only executing rules written entirely by humans. |
| Outputs that influence environments | Predictions, content, recommendations or decisions with effects in the physical or digital world. |
The European Commission has published guidelines on the definition. They confirm that simple, traditional software — for example basic data processing, or systems that only follow rules defined entirely by humans — generally falls outside it. Inference is what separates AI from conventional software.
In scope: a CV-screening tool trained on past hiring data; a chatbot built on a large language model; a computer-vision model that spots defects on a production line.
Probably out of scope: a spreadsheet formula that calculates commission; an "if X then Y" rule written by an analyst; a basic sort-by-date function.
1.3 Who does the Act apply to?
Like the GDPR, the AI Act has extraterritorial reach. Under Article 2 it applies to:
- Providers placing AI systems or general-purpose AI models on the EU market or putting them into service in the EU — wherever the provider is based.
- Deployers of AI systems that are established or located in the EU.
- Providers and deployers outside the EU where the output of the AI system is used in the EU.
- Importers and distributors of AI systems.
- Product manufacturers placing AI on the market with their product under their own name.
- Authorised representatives of non-EU providers.
- Affected persons located in the EU.
The AI Act is not UK law. But a UK business is caught if it places AI on the EU market, or if its AI system's output is used in the EU — for example, a UK fintech scoring the creditworthiness of customers in Ireland.
What's excluded
The Act does not apply to:
- AI used exclusively for military, defence or national security purposes.
- AI developed and used solely for scientific research and development.
- Research, testing and development before a system is placed on the market (real-world testing is regulated separately).
- Individuals using AI for purely personal, non-professional activities.
- AI released under free and open-source licences — unless it is high-risk, prohibited, or subject to the Article 50 transparency duties. (Open-source GPAI models have their own, partial carve-out — see Module 5.)
- Public authorities of third countries and international organisations using AI under international law-enforcement or judicial cooperation agreements, with adequate safeguards.
1.4 Roles: provider, deployer and more
Your obligations depend on your role in relation to a specific AI system. The Act calls all of these actors "operators".
| Role | Definition (simplified) | Example |
|---|---|---|
| Provider | Develops an AI system or GPAI model (or has one developed) and places it on the market or puts it into service under its own name or trademark — whether for payment or free. | A software company selling an AI recruitment platform. |
| Deployer | Uses an AI system under its authority in a professional context. | A retailer using that platform to screen job applicants. |
| Importer | EU-established; places on the EU market an AI system bearing the name of a non-EU provider. | An EU reseller of a US-built AI product. |
| Distributor | Any other actor in the supply chain making an AI system available on the EU market. | A software marketplace or IT reseller. |
| Authorised representative | EU-based person mandated to act on behalf of a non-EU provider. | A compliance firm appointed by an Asian AI developer. |
Most of the heaviest obligations fall on providers. But deployers have real duties too — especially for high-risk systems.
When a deployer becomes a provider
Under Article 25, a distributor, importer or deployer is treated as the provider of a high-risk AI system if it:
- puts its own name or trademark on a high-risk AI system already on the market;
- makes a substantial modification to a high-risk AI system so that it remains high-risk; or
- changes the intended purpose of an AI system (including a general-purpose AI system) so that it becomes high-risk.
A bank licenses a general-purpose chatbot for customer service (low risk). Its data team then fine-tunes and repurposes it to decide who gets a loan. The bank has changed the intended purpose into a high-risk use (creditworthiness assessment) — so it now takes on provider obligations for that system.
Key takeaways
- The AI Act is a directly applicable EU regulation, in force since 1 August 2024 and amended in 2026.
- "Inference" is what makes software an AI system under the Act.
- It reaches non-EU organisations whose AI is placed on the EU market or whose outputs are used in the EU.
- Obligations follow your role — and your role can change if you rebrand, substantially modify or repurpose a system.