The EU AI Act, in Plain English

AI is moving at breakneck speed and changing every day! Governments? Not always so much.

But the European Union has been working on some ground rules for how artificial intelligence should be used. The result is the EU AI Act, a sweeping law designed to make AI safer and more transparent while still allowing businesses and organizations to innovate.

If you’ve heard about the EU AI Act but haven’t quite figured out what it means, you’re probably not alone. Like most regulations, the details can get complicated pretty quickly. Recently, I did some digging.

The basic idea, however, is surprisingly simple:

The more potential an AI system has to harm people, the more rules it has to follow.

Think of it as a risk ladder.

The EU AI Act doesn’t treat every use of AI the same way. They designate three distinct uses – low risk, moderate risk, and unacceptable risk.

At the bottom rung are relatively low-risk applications. Think spam filters, AI, and many of the everyday AI-powered tools we already encounter. These generally aren’t the focus of heavy regulation.

Then there are AI systems where transparency becomes important. For example, if you’re chatting with an AI-powered customer service bot (like I was yesterday), it should be clear that you’re interacting with AI, not a person. We’re all getting used to seeing labels like “AI Agent” that make that distinction obvious. Similarly, certain AI-generated or manipulated content, such as deepfake videos, needs to be identifiable as such.

Things get more serious when AI starts making or influencing decisions that can significantly affect someone’s life.

Certain AI systems used in areas such as employment, education, lending, healthcare, critical infrastructure, and government services may be considered high risk.

For example, imagine a company using AI to screen job applicants. If that system unfairly filters out certain groups of people, the consequences are a lot more significant than an AI tool recommending a new song for your playlist.

That’s why high-risk systems can face additional requirements around testing, documentation, data quality, human oversight, accuracy and ongoing monitoring.

Some uses of AI cross the line.

The EU has also identified certain uses of AI that it considers too risky to allow.

The Act prohibits practices such as AI manipulation, social scoring, and certain uses of biometric identification and surveillance.

In other words, some situations require more than disclosure or oversight. The technology shouldn’t be used that way.

What about ChatGPT and other generative AI?

The Act also addresses general-purpose AI, which includes the underlying models that power many of the AI tools we’re now using.

Companies developing these models can have responsibilities related to documentation, transparency, and copyright compliance. Providers of especially powerful models may have additional responsibilities to evaluate and reduce broader risks.

So the law isn’t just concerned with how an individual company uses AI. It also looks at the companies building the technology underneath those applications.

Why should U.S. organizations care?

Here’s where things get particularly interesting.

The EU AI Act isn’t necessarily just a European issue.

In some cases, a company based in the United States could still be affected if it offers an AI system in the European Union or if its AI system’s output is used there.

That’s similar to what happened with GDPR. A European regulation changed conversations about privacy and data practices well beyond Europe.

The EU AI Act could have a similar influence on how organizations worldwide think about responsible AI.

What should organizations be doing now?

You probably don’t need to panic and create a 50-page AI compliance manual tomorrow.

But you should know where AI is being used in your organization.

Are employees using ChatGPT, Claude, Gemini, or other AI tools? Is AI built into your website, CRM, hiring platform, analytics tools, or marketing technology? Is it making recommendations, or is it actually making decisions?

Those are increasingly important questions.

The EU AI Act isn’t about stopping AI. It’s about creating some guardrails around it.

The basic message is actually pretty reasonable:

Use AI. Innovate. Experiment. But the greater the potential impact on people, the greater your responsibility to use it safely, transparently, and thoughtfully.

That’s not a bad rule to follow even if you never do business in Europe.