EU AI Act: The Major Regulatory Experiment

If the OECD AI Principles helped establish a common language for responsible AI, and the Bletchley and Seoul processes helped create international dialogue around frontier AI safety, the European Union attempted something more concrete.

It attempted to turn AI governance into law.

The result is the European Union’s Artificial Intelligence Act, formally Regulation (EU) 2024/1689.

The regulation was adopted on 13 June 2024 and entered into force on 1 August 2024. Unlike international principles or political declarations, the AI Act creates legally binding obligations within the European Union and establishes institutions responsible for implementation and enforcement.

This makes the EU AI Act a major turning point in the history of AI governance.

The central question is no longer simply what responsible AI should look like.

It becomes a legal question:

Which AI practices should be prohibited?

Which systems should face stronger obligations?

What should developers and deployers document?

Who should supervise compliance?

What information should AI providers disclose?

And what happens when organisations fail to comply?

The European approach attempts to answer these questions through a risk-based regulatory architecture.

From Principles to Law

The AI Act did not emerge in isolation.

It developed within a broader European policy environment that already included data protection, consumer protection, product safety, fundamental-rights law and digital regulation.

This history matters.

Europe’s AI governance model is therefore not simply an attempt to regulate algorithms. It is an attempt to connect AI regulation with existing European legal principles, particularly the protection of health, safety and fundamental rights.

The AI Act consequently treats AI as a technology that can create different levels and types of risk depending on how it is designed and used.

This is the foundation of its risk-based approach.

Instead of imposing identical obligations on every AI system, the regulation creates different governance requirements according to the nature and potential impact of the system.

That principle sounds straightforward.

Its implementation is not.

The Risk-Based Architecture

The AI Act establishes several important regulatory categories.

At one end are certain AI practices considered unacceptable because of the risks they create for people and fundamental rights.

At another level are high-risk AI systems, which are subject to extensive requirements.

Other AI systems may face transparency obligations without being classified as high-risk.

The Act also establishes specific rules for general-purpose AI models, including additional obligations for models presenting systemic risks.

This creates a regulatory hierarchy.

The basic idea is that regulatory intensity should correspond, at least broadly, to potential risk.

This is an important development because it moves AI governance away from a binary choice between “regulate AI” and “do not regulate AI.”

Instead, the regulatory question becomes:

What kind of AI is this?

How is it being used?

Who may be affected?

What risks can it create?

What safeguards are necessary?

And who is responsible?

The Prohibited Practices

The first layer of the AI Act concerns practices that the European Union considers unacceptable.

These include certain forms of manipulation, exploitation of vulnerabilities, social scoring and other specified practices. The regulation also restricts particular forms of biometric identification and other uses subject to tightly defined conditions and exceptions.

This is significant because it establishes a legal boundary around certain uses of AI.

Governance therefore begins before a system is merely assessed for compliance.

Some uses are restricted or prohibited altogether.

This represents a different regulatory philosophy from purely voluntary responsible-AI frameworks.

An ethical principle might state that AI should respect human autonomy.

A regulation can go further by defining specific practices that are legally unacceptable.

That transition from principle to prohibition is one of the most important changes represented by the AI Act.

High-Risk AI

The second major layer is high-risk AI.

The AI Act identifies categories of AI systems that can create significant risks to health, safety or fundamental rights.

These include certain AI systems used in areas such as employment, education, essential services, law enforcement, migration, justice and other sensitive contexts, as well as AI systems that function as safety components of certain regulated products.

High-risk classification triggers a much more demanding governance regime.

Providers must establish risk-management processes, maintain documentation, meet data and technical requirements, ensure appropriate levels of accuracy and robustness, maintain logs where required, conduct conformity assessments and implement post-market monitoring.

The regulation explicitly treats risk management as a continuous and iterative process across the lifecycle of a high-risk AI system.

This lifecycle concept is important.

AI governance is not treated as something that happens only before a product enters the market.

Risk can change after deployment.

Data can change.

The system’s operating environment can change.

Users can behave differently from what developers expected.

New vulnerabilities can emerge.

A lifecycle approach therefore recognises that governance must continue after deployment.

This connects the AI Act to a broader shift already visible in international AI safety discussions: from one-time approval toward continuous monitoring and assurance.

The Importance of Conformity Assessment

Another important concept in the AI Act is conformity assessment.

For certain high-risk AI systems, providers must demonstrate compliance with the applicable requirements before the system is placed on the market or put into service.

This introduces a familiar idea from European product regulation into AI governance.

Instead of relying entirely on government inspectors to evaluate every system directly, regulatory compliance can involve structured procedures through which providers demonstrate that specified requirements have been met.

This creates an emerging ecosystem around AI compliance.

Documentation becomes important.

Testing becomes important.

Risk-management systems become important.

Quality-management systems become important.

Technical standards become important.

Auditing and conformity assessment become important.

As a result, the AI Act is not simply creating rules for AI developers.

It is also creating demand for an institutional and professional ecosystem capable of demonstrating compliance with those rules.

That may eventually include technical auditors, conformity-assessment bodies, legal specialists, AI assurance professionals, risk experts and independent evaluators.

Fundamental Rights Enter the Technical Compliance Process

One of the distinctive characteristics of the European approach is the connection between AI regulation and fundamental rights.

For certain high-risk deployments, the AI Act requires a fundamental-rights impact assessment. Public authorities and certain other deployers must assess how the use of a high-risk AI system may affect individuals and groups.

This is significant because it expands the meaning of AI impact assessment.

The question is not only whether an AI system is technically accurate.

A system can be technically functional and still create serious consequences for people.

It may discriminate against certain groups.

It may affect access to employment.

It may influence access to public services.

It may affect a person’s ability to exercise their rights.

The European model therefore attempts to connect technical risk management with legal and societal impact.

This is one of the clearest examples of how AI governance is becoming interdisciplinary.

Computer science alone is not enough.

Law alone is not enough.

Ethics alone is not enough.

Effective governance increasingly requires interaction between technical evaluation, law, human rights, organisational processes and public policy.

General-Purpose AI Changes the Regulation

One of the most important developments in the final AI Act was the inclusion of rules for general-purpose AI models.

This is particularly relevant because the regulatory challenge had changed dramatically between the early development of the AI Act and the emergence of generative AI.

Traditional risk classification works relatively well when a system is designed for a specific application.

A general-purpose model is different.

The same underlying model may be integrated into a chatbot, educational application, coding tool, healthcare system or business software.

The model provider may not know all of the downstream contexts in which the model will eventually be used.

This creates a distribution-of-responsibility problem.

Who should be responsible for the risk?

The model developer?

The company integrating the model?

The organisation deploying the final application?

Or all of them in different ways?

The AI Act responds by establishing specific obligations for providers of general-purpose AI models.

These include technical documentation, information sharing with downstream providers, copyright-related policies and publication of a sufficiently detailed summary of training content.

For the most advanced or impactful general-purpose models, the Act creates an additional category: general-purpose AI models with systemic risk.

Providers of such models face stronger obligations, including risk assessment and mitigation, incident reporting and cybersecurity protections.

This is an important bridge between conventional AI regulation and frontier AI governance.

The European Union is no longer regulating only the applications built on top of AI.

It is also regulating aspects of the underlying general-purpose models that can become the foundation for many downstream systems.

That is a major conceptual shift.

The AI Office

The AI Act also demonstrates that legislation alone is not sufficient.

A regulatory framework requires institutions capable of interpreting, implementing and enforcing it.

The European Commission established the European AI Office as a central institutional component of the AI Act’s governance architecture.

The AI Office develops Union-level expertise, supports implementation and has important responsibilities relating to general-purpose AI models. The wider governance structure also includes the European Artificial Intelligence Board, a scientific panel and advisory mechanisms, alongside national competent authorities in Member States.

This institutional architecture illustrates an important lesson.

AI regulation requires governance capacity.

A government can pass a sophisticated law, but the law has limited practical value if institutions do not have the expertise, resources and technical infrastructure necessary to implement it.

This is especially relevant for countries that are considering their own AI governance frameworks.

The difficult part may not be writing the regulation.

The difficult part may be building the institutions that make the regulation work.

The AI Act in 2026: From Legislation to Implementation

The AI Act is particularly important to study today because its implementation is now moving from legal preparation toward active enforcement.

The regulation entered into force in August 2024, but its provisions are being applied progressively rather than all at once.

The first rules began applying on 2 February 2025, including the provisions concerning prohibited AI practices and AI literacy. Governance rules and obligations for providers of general-purpose AI models became applicable on 2 August 2025.

As of 2 August 2026, major enforcement powers of the AI Office and national competent authorities have begun to apply.

The European Commission has also begun enforcing relevant AI Act rules and new transparency requirements, including requirements concerning disclosure of AI interaction and labelling or machine-readable marking of certain AI-generated or altered content.

However, not every provision applies immediately.

Some high-risk AI requirements have longer transition periods. Under the current implementation timeline, certain Annex III high-risk use cases are scheduled for application from 2 December 2027, while high-risk AI systems embedded in regulated products have a transition period until 2 August 2028.

This gradual approach is itself an important governance experiment.

It allows institutions, companies and regulators time to develop guidance, standards, technical procedures and compliance capabilities.

At the same time, it creates a complex implementation landscape.

The AI Act is therefore no longer simply a piece of legislation to analyse.

It is becoming a real-world regulatory system whose effectiveness will depend on implementation.

From Regulation to Regulatory Infrastructure

This is perhaps the most important lesson from the European experiment.

AI regulation does not end when legislation is passed.

Legislation creates requirements.

Institutions interpret those requirements.

Standards translate them into technical practices.

Codes of practice provide more operational detail.

Auditors and conformity-assessment bodies may evaluate compliance.

Regulators investigate and enforce.

Courts may eventually interpret disputed provisions.

Companies redesign internal processes.

Universities and professional organisations develop new expertise.

The result is a regulatory ecosystem.

The AI Act therefore provides an important example of how governance evolves from principles into infrastructure.

The General-Purpose AI Code of Practice is a useful example.

The European AI Office facilitated the development of the Code, involving a large group of stakeholders, including industry, researchers, civil society and Member State representatives. The Code was designed to operationalise requirements for providers of general-purpose AI models, including those presenting systemic risks.

This shows how modern AI governance may increasingly operate.

The law establishes the obligation.

Technical and institutional processes help explain how the obligation can be fulfilled.

That is very different from the earlier era of AI ethics principles.

The Brussels Effect and Global Influence

One reason the EU AI Act is globally significant is that its effects may extend beyond the European Union.

Companies operating internationally often prefer to develop products and compliance systems that can work across multiple markets rather than creating completely separate systems for every jurisdiction.

This creates the possibility that European rules can influence global product design and corporate governance.

This phenomenon is often discussed through the concept of the “Brussels Effect”: the possibility that EU regulation can influence practices beyond the EU because of the size and importance of the European market.

Whether the AI Act will generate a strong global Brussels Effect remains an empirical question.

Its influence should therefore not be assumed.

Different countries are developing their own regulatory models, and companies may respond differently depending on market structure, technical architecture and regulatory requirements.

Nevertheless, the AI Act provides one of the most important regulatory reference points for countries developing their own AI governance frameworks.

Its influence may therefore occur through legal imitation, regulatory interoperability, corporate compliance practices, standards development or international policy learning.

The Limits of the European Model

The AI Act is ambitious, but it is not a complete solution to every AI governance problem.

One challenge is complexity.

A risk-based framework requires organisations and regulators to determine how a particular AI system should be classified and which obligations apply.

Another challenge is enforcement capacity.

Sophisticated rules require sophisticated institutions.

A third challenge is technological change.

AI capabilities can develop faster than legal frameworks.

A fourth challenge concerns global coordination.

The AI Act operates within the European legal system, while many AI systems are developed and deployed globally.

A fifth challenge concerns general-purpose AI.

The regulation’s approach to foundation models is still relatively new, and its effectiveness will depend heavily on implementation, technical evaluation and the evolution of the underlying technology.

These challenges do not necessarily invalidate the regulatory model.

They reveal the central difficulty of AI governance.

The law must remain sufficiently stable to create predictable obligations while remaining sufficiently adaptable to a rapidly changing technology.

That is a difficult institutional design problem.

What the EU AI Act Changed

The historical importance of the AI Act can therefore be understood through several transitions.

AI governance moved from broad principles toward enforceable legal obligations.

Risk assessment became a central regulatory mechanism.

Technical documentation and organisational accountability became regulatory requirements.

Fundamental-rights considerations were connected to AI deployment.

General-purpose AI models entered the legal governance framework.

Government institutions were created specifically to support AI governance.

Codes of practice and technical standards became part of implementation.

And enforcement became a central part of the AI governance conversation.

These developments represent a major change from the early AI ethics debate.

In the 2010s, governments were largely asking:

What should responsible AI look like?

The next question became:

What should organisations be required to do?

The EU AI Act provides one of the most comprehensive answers so far.

But it also creates another question:

Can a risk-based regulatory model developed in Europe become a useful governance reference for the rest of the world?

That question leads directly to the next stage of the global debate.

Different countries are responding to AI through different combinations of regulation, industrial policy, national security, innovation policy, standards and voluntary governance.

Europe is building a rights-oriented risk-based legal framework.

The United States has developed a more distributed approach involving federal policy, sectoral regulation, standards and state-level action.

China has combined AI governance with state strategy, cybersecurity, standards and industrial policy.

India, Japan, South Korea and Singapore are developing their own approaches.

The result is not one global AI governance model.

It is the emergence of multiple models.

Understanding those models—and the differences between them—is essential for understanding where global AI governance is heading.

The EU AI Act therefore marks not the end of AI governance evolution, but the beginning of a new comparative phase.

The next question is no longer simply how AI should be governed.

It is:

Which governance model is emerging in different parts of the world, and why?