Regulation (EU) 2024/1689 Deep Dive

Q: What is the EU AI Act?

The EU AI Act (Regulation 2024/1689) is the world's first comprehensive AI law. It categorizes AI by risk: unacceptable (banned), high-risk (strict obligations), limited risk (transparency), and minimal risk (voluntary codes).

Q: What AI systems are banned under EU AI Act?

Article 5 prohibits: social scoring, real-time biometric identification (with exceptions), emotion recognition in workplaces/schools, predictive policing based on profiling, and AI exploiting vulnerabilities of children/disabled.

Q: What are high-risk AI systems?

High-risk AI includes: biometric identification, critical infrastructure, education assessment, employment decisions, credit scoring, law enforcement, migration/asylum, and justice administration. These require conformity assessment and CE marking.

Q: Does EU AI Act apply to Indian companies?

Yes, the EU AI Act has extraterritorial scope. It applies to Indian companies placing AI systems on the EU market, deploying AI in the EU, or whose AI outputs are used in the EU.

Status

In Force

Title IArticles 1–4

Subject Matter & Scope

Article 2: Scope (The Brussels Effect)

The Act applies to providers placing AI systems on the EU market, regardless of establishment location. It also applies where the output produced by the system is used in the Union.

Article 3: Definitions

AI System: A machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment and that infers how to generate outputs such as predictions, content, recommendations, or decisions.

Title IIArticle 5

Prohibited AI Practices

Practices carrying Unacceptable Risk are banned outright:

Subliminal Manipulation

Techniques to distort behavior and impair informed decision-making.

Social Scoring

Evaluating persons leading to detrimental treatment in unrelated contexts.

Real-time Remote Biometric ID

In public spaces for law enforcement (narrow exceptions).

Emotion Recognition

Banned in workplace and education institutions.

Predictive Policing

Assessing risk based solely on profiling or personality traits.

Untargeted Scraping

Building facial recognition databases by scraping internet/CCTV.

Title IIIArticles 6–50

High-Risk AI Systems

Classification (Art 6)

1. Safety Components: AI used in regulated products (Toys, Cars, Medical Devices).
2. Annex III Systems: Biometrics, Critical Infrastructure, Education, Employment, Law Enforcement.

Core Obligations (Art 8-15)

Risk Management System

Data Governance

Technical Documentation

Record Keeping (Logging)

Transparency

Human Oversight

Accuracy & Robustness

Title VArticles 51–56

General Purpose AI Models (GPAI)

Regulates foundation models (GPT-4, Gemini, Claude). Distinguishes standard GPAI from those with Systemic Risk.

All GPAI Models

• Maintain technical documentation
• Comply with EU Copyright Law
• Publish training content summary

Systemic Risk Models

Threshold: 10²⁵ FLOPs

• Model evaluations (Red Teaming)
• Assess and mitigate systemic risks
• Report serious incidents to AI Office

Penalties

€35M

or 7% Turnover

Prohibited Practices (Art 5)

€15M

or 3% Turnover

High-Risk AI Obligations

€7.5M

or 1.5% Turnover

Incorrect Information