The European Union is introducing groundbreaking regulation in the form of the Artificial Intelligence Act, which will fundamentally impact the technology sector and everyday business. The regulation applies not only to European entities but also to all providers who place AI systems on the EU market or put them into operation there, regardless of their country of origin. Thus, American software companies and employers using automated systems to evaluate European job applicants also fall under EU jurisdiction.
Risk Categorization and Prohibited Practices
The new legislation divides artificial intelligence systems into four categories based on the degree of risk they pose to users and society. The strictest rules apply to systems labeled as unacceptable, which the Union completely prohibits. These include, for example, social scoring, certain forms of biometric identification, or systems used for emotion recognition in sensitive contexts.
The category of high-risk systems includes solutions used in critical areas of infrastructure and public life:
- employee recruitment and human resource management,
- education and training,
- healthcare and insurance,
- law enforcement and administration of justice.
For these technologies, operators must ensure human oversight, maintain detailed technical documentation, and perform monitoring even after the system is put into practical operation. Conversely, most common consumer applications fall into the limited or minimal risk category, where the main requirement is transparency, for example, clear labeling of AI-generated content.
Draconian Sanctions and Preparation for Control
Enterprises that underestimate the rules face the risk of extreme financial penalties. The upper limit of the fine can climb up to 7% of the company's worldwide annual turnover. Experts therefore advise companies to conduct thorough stress tests and identify weaknesses in documentation before full enforcement of the rules by European regulators begins.
“Companies should have crisis plans ready in case they come under the scrutiny of regulators and proactively communicate with investors and the media about how they manage AI-related risks.”
Part of the strategy should be to develop an overview of the systems used and their risk classification. Proper setup of internal processes and clear definition of responsibility for managing AI tools are now essential for medium and large companies to prevent not only financial losses but also fatal damage to their market reputation.