The EU AI Act: The Global Floor, Whether You Like It or Not

The EU has ~450 million consumers and a regulatory track record of projecting rules beyond its borders. GDPR went into effect in 2018 and became the de facto global privacy template — companies rarely build two separate data stacks, so the EU version wins by default. The same Brussels Effect is now unfolding for AI.

Whatever you think of the AI Act on the merits, if you deploy AI to EU users, you will comply. And because two product SKUs are expensive, you will probably comply everywhere.

The risk tier architecture

1. 1Unacceptable risk: banned outright. Social scoring by governments, manipulative subliminal techniques, untargeted facial scraping, emotion recognition at work/school, most real-time biometric ID in public.
2. 2High risk: heavily regulated. AI in hiring, credit, law enforcement, migration, education, critical infrastructure, medical devices. Risk management, logging, human oversight, conformity assessment.
3. 3Limited risk: transparency obligations. Chatbots must tell you they are AI. Deepfakes must be labeled. AI-generated content must be machine-detectable.
4. 4Minimal risk: no obligations. Most AI (spam filters, recommender tweaks) falls here.

General-purpose AI (GPAI) obligations

The Act added a separate track for GPAI models (what we call foundation models). Effective August 2025, GPAI providers must publish technical documentation, respect copyright opt-outs, and disclose a summary of training content. Models deemed to pose systemic risk (10^25 FLOPs compute threshold) face additional obligations: model evaluations, risk mitigation, serious incident reporting.

The Code of Practice

Published July 2025 by the Commission, the GPAI Code of Practice gives providers a voluntary roadmap — sign it and you get a presumption of compliance. Most major labs signed (Anthropic, Google, Microsoft, OpenAI); a notable holdout was Meta, which publicly rejected the Code's copyright provisions.

Compare: US, EU, and China approaches

What the Act gets right

• Risk-based: low-risk AI is not bogged down in paperwork
• Clear bans: no ambiguity on social scoring or manipulative systems
• Transparency requirements that enable downstream auditing
• Extraterritorial scope: keeps providers from avoiding via geography

What critics say it gets wrong

• Compliance burden may concentrate market among well-resourced labs
• FLOPs thresholds for systemic risk are a moving target as efficiency improves
• Enumerated high-risk lists will lag novel deployments
• Definitions (emotion recognition, biometric categorization) are fuzzy in practice
• Member states implement enforcement unevenly

“The AI Act is not a final answer. It is the first serious attempt to write rules for systems that did not exist when we started writing.”

The big idea: the AI Act is simultaneously the most ambitious and most criticized AI regulation in the world. Whether you love it or hate it, you will likely build to its standards, and the arguments about it are the shape of AI governance for the rest of this decade.