The EU AI Act
Artificial intelligence has become a big part of everyday business. It can help screen job applications, detect fraud, recommend products, optimise logistics, support medical decisions and much more.
The EU Artificial Intelligence Act, usually called the AI Act, sets rules for how these systems may be developed and used. It does not try to stop AI. It tries to make sure AI is safe, fair and understandable, especially when it affects people in meaningful ways.
- Risk-based approach
- Directly applicable across the EU
- Applies beyond the EU
What is the AI Act?
The AI Act is European regulation that sets rules for artificial intelligence systems or models placed on market or (its output) used in the EU.
Its objective is laid down in Article 1 of the regulation. In simple terms, the AI Act aims to promote human-centred and trustworthy AI, while protecting health, safety, fundamental rights, democracy, the rule of law and the environment. At the same time, it wants to support innovation and legal certainty.
Like the GDPR, the AI Act is a regulation. That means it applies directly across the EU, even if there is no national law implementing it. The rules are largely the same whether you are active in Belgium or anywhere else within the EU. However, some differences might exist between different Member States.
Who must comply with the AI Act?
The AI Act applies to:
- providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the EU, irrespective of whether those providers are established or located within the EU or in a third country;
- deployers of AI systems that have their place of establishment or are located within the EU;
- providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the EU;
- importers and distributors of AI systems;
- product manufacturers placing on the market or putting into service an AI system together with their product and under their own name or trademark;
- authorised representatives of providers, which are not established in the EU;
- affected persons that are located in the EU.
It does not matter whether you are a tech company, a public authority, a hospital, a bank, an HR department or a software vendor. If an AI system is placed on the EU market or used in the EU, the AI Act can apply.
The regulation also has an extraterritorial effect. Organisations outside the EU can still fall under the AI Act if their AI systems/models are used in the EU or if their outputs are used in the EU.
How the AI Act works: a risk-based approach
Not all AI is treated the same. The AI Act uses a risk-based approach split over AI Systems and AI models. The more impact an AI can have on people and society, the stricter the rules.
The regulation distinguishes four main risk categories. Understanding these categories is the first step towards compliance.
01 - Prohibited AI systems.
Some AI uses are considered so harmful that they are prohibited.
These use cases are seen as incompatible with EU values and fundamental rights. They cannot be placed on the market or used in the EU, with very limited exceptions.
Examples include manipulation of behaviour in a deceptive way and cause harm, exploiting vulnerabilities linked to age or disability, social scoring systems, and inferring sensitive personal characteristics from biometric data.
The Act also bans certain uses of biometric identification in public spaces and emotion recognition in workplaces or schools, except in very specific situations.
If a use case falls into this category, the legal analysis is short. The system cannot be used.
02 - High-risk AI systems.
03 - Limited risk and transparency obligations.
04 - Minimal risk AI systems.
High-risk AI and compliance in practice
For high-risk AI systems, compliance is not a single document or a one-off exercise. It is a process that runs throughout the system’s lifecycle.
Step 1: High-risk or not?
Organisations must first determine whether a system is high-risk. That decision must be documented. If the system is high-risk, the provider must ensure that the AI Act requirements are built into the system from the start. This includes risk management, data governance, technical documentation, transparency towards users, effective human oversight measures and safeguards for accuracy and security.
Step 2: Conformity assessment
Before placing the system on the market or putting it into service, a conformity assessment must be completed. Depending on the type of system, this can be an internal assessment or an external assessment by a notified body.
Step 3: EU Declaration of Conformity
Once the system is compliant, an EU Declaration of Conformity must be issued and the system must carry a CE marking. High-risk AI systems must also be registered in the EU AI database, with some exceptions for sensitive use cases.
Step 4: Continued obligations
After deployment, obligations continue. Providers must monitor performance, keep documentation up to date and report serious incidents.
The relationship between the AI Act and GDPR
The AI Act does not replace the GDPR. The two regulations often apply together.
When an AI system processes personal data, the GDPR governs how that data is handled. The AI Act focuses on the AI system itself: how it is designed, assessed, deployed and monitored.
Both regulations rely on similar principles. They use a risk-based approach, emphasise transparency and accountability, and require impact assessments in specific high-risk situations. In practice, organisations that have strong GDPR governance are better prepared for the AI Act, but GDPR compliance alone is not enough.
Key terms explained
-
AI system
An AI system is software that can generate predictions, recommendations, content or decisions with some degree of autonomy.
-
Provider
A provider is the organisation that develops (or has it developed) an AI system and places it on the market under its own name or trademark.
-
Deployer
A deployer is the organisation that uses an AI system in its own operations.
-
High-risk AI
High-risk AI refers to systems that can significantly affect health, safety or fundamental rights and therefore fall under stricter rules.
-
General-purpose AI
General-purpose AI describes AI models that can be used for many different tasks, such as large language models.
-
Human oversight
Human oversight means that people can understand, supervise and intervene in how an AI system operates.
Meet the CRANIUM Specialists.
Bernd Fiten
Head of Digital Law &
AI specialist
Enzo Marquet
Principal Privacy Consultant &
AI specialist
Valérie Stragier
Senior Privacy & Digital Law Consultant &
AI specialist
Frequently Asked Questions about the AI Act.
Is all AI regulated by the AI Act?
No. Only AI systems within the scope of the regulation are covered, and many systems fall into the minimal risk category.
When do the AI Act obligations apply?
Does the AI Act apply outside the EU?
Do organisations need a specific AI role?
Take action today.
Get started on your AI Act compliance today. Reach out to our team for guidance and support.
