Skip to content
Optimal Lab

AI Engineering · interactive

AI regulation

The EU AI Act sorts AI systems by what they are used for: a few uses are banned, a list of sensitive ones carries strict duties, some only have to be disclosed, and most get no new rules. Pick what you're building and your role, and see which tier you land in, what it asks of you, and when.

four risk tiers · EU AI Act

  1. Unacceptable risk: banned3 of the 14 examples
  2. High risk5 of the 14 examples
  3. Transparency risk3 of the 14 examples

    Answer customer-support questions

    People must be told they are talking to a machine. Nothing more, unless it also decides on credit, jobs or similar.

  4. Minimal or no risk3 of the 14 examples

Transparency risk: People must be told they are talking to a machine. Nothing more, unless it also decides on credit, jobs or similar.

Your role

1

Say what it's for

The Act regulates uses, not techniques. The same model is minimal-risk writing code and high-risk ranking job applicants.

2

Check the banned list, then the high-risk list

Nine practices are prohibited outright: social scoring, emotion recognition at work or school, scraping faces, manipulation, and others. Then the Act lists areas where AI is high-risk: hiring, credit, education, critical infrastructure, biometrics, law enforcement, migration, justice, and safety parts of regulated products.

People must be told they are talking to a machine. Nothing more, unless it also decides on credit, jobs or similar.

3

Land in a tier

Not banned and not high-risk? Then if people interact with it or it generates content, transparency duties apply. Otherwise the Act adds nothing, which is where most systems are.

Transparency risk

Allowed, but people must be told they are dealing with AI, and generated content must be identifiable.

4

See what it asks of your role

Providers build and sell the system; deployers use it. High-risk duties split between them: the provider proves the system is fit, the deployer uses it properly and keeps people in the loop.

The provider puts the system on the market and carries most of the high-risk duties: risk management, data, documentation, conformity.

  • · Tell people when they are interacting with a machine (chatbots)
  • · Make AI-generated content identifiable
  • · Label deepfakes, and AI text published to inform the public, clearly and visibly
5

Check the dates, and the rest of the world

The Act phased in from 2025 and was amended by the AI Omnibus in 2026, which pushed the high-risk dates out. Other places have frameworks rather than one law: NIST's risk framework in the US, the OECD principles, and sector rules everywhere.

Unacceptable risk: banned
2 February 2025 (the ninth practice from December 2026)
High risk
2 December 2027 for the listed use cases (Annex III); 2 August 2028 for AI inside regulated products (Annex I)
Transparency risk
August 2026
Minimal or no risk
no new rules
General-purpose models
2 August 2025

Summarized from the European Commission’s description of the Act, checked 18 October 2026. It is a teaching summary, not legal advice: the tiers depend on details, and the dates have already moved once.

In production

Tools and technologies

The EU AI Act is the one binding, general AI law so far; elsewhere, frameworks and sector rules.

Not tied to one language — use these names when you search docs or design a system.