AI Act · 5 min read
What is the AI Act?
The basics of the EU AI Act: why it exists, what it regulates, and key terminology.
Introduction
Section titled “Introduction”Learning goals
- Understand why the EU AI Act was created and what it aims to protect
- Know who and what is regulated, and what is explicitly out of scope
- Understand the difference between an AI system and a general purpose AI model — abbreviated GPAI
The EU AI Act consists of 113 articles, 13 annexes, and 180 non-binding recitals — all designed to strengthen the internal market and support innovation, while protecting health, safety, and fundamental rights. The Act is heavily inspired by product safety regulation.
Why do we need it?
Section titled “Why do we need it?”Europeans have some AI worries.
- Three-fourths of EU public sector workers worry about AI manipulation elections
- 80% of Norwegians are worried about not knowing what is true or AI
Globally, more people are now concerned than excited, and this trend is particularly seen in Sweden.
The EU can’t regulate trust. But it can regulate safety, and set strict requirements for the systems that pose inherently high risks.
Before the AI Act, more than half of Europeans did not think current rules effectively regulated AI. The Act was designed to fill the gaps left by existing product safety and digital platform laws, which were not written with AI systems in mind and were not adequately addressing AI-specific risks.
Who and what is regulated?
Section titled “Who and what is regulated?”The AI Act regulates:
- People or organizations using AI in a professional context
- Those that develop an AI system or a general purpose AI model (GPAI)
- Both public and private organizations, including public authorities
- Regardless of whether payment is involved — if you make your AI system available to others in the EU for free, you are still a provider
- Regardless of whether your AI system was on the market before the AI Act came into force
Jurisdictionally: if an organization (public or private) is in the EU, or if the output of their AI system is in the EU, or if the affected persons are in the EU.
The Act is not yet included in the EFTA agreement, so it is not enforced in Norway. Norway is expected to make it national law. The GDPR was included in Norwegian law within a month of becoming EU law.
Timeline
Section titled “Timeline”The AI Act entered into force on 1 August 2024, but its requirements have applied in stages:
| Date | What started to apply |
|---|---|
| 2 February 2025 | The prohibitions on unacceptable-risk AI systems, and the AI literacy requirement for staff using AI at work |
| 2 August 2025 | Obligations for providers of general purpose AI models (GPAI) placed on the market after that date, plus the Act’s governance structure and penalty rules |
| 2 August 2026 | The bulk of the Act, including the transparency obligations (Article 50) and the requirements on high-risk systems under Annex III |
| 2 August 2027 | High-risk AI that is a safety component of products already covered by EU product legislation (Annex I). The same date is the backstop for GPAI models already on the market before August 2025 |
So the prohibitions, the AI literacy requirement, the GPAI obligations and the transparency requirements apply today. What remains ahead is mainly the high-risk requirements for regulated products.
Note: the European Commission has proposed adjustments to parts of the high-risk timeline. Check the current position before you plan your compliance around a specific date, and confirm with your data protection officer or legal counsel.
What isn’t regulated?
Section titled “What isn’t regulated?”If you are using an AI system for a “purely personal non-professional activity” — like an app that takes a picture of the contents of your fridge and gives you easy recipe ideas — you are not regulated, because you are not a deployer. There probably isn’t a deployer in this case, only you as the user, and the provider of the system.
If you use Intric, we assume you are using it for work purposes, and your employer is the deployer. You should not use Intric for personal purposes.
Some exceptions, which are not regulated by the Act:
- AI used only for research
- AI being developed, but not yet put on the market or being used
- AI for national defence (think: weapons and the military)
For examples of specific AI systems that wouldn’t be regulated, see the out-of-scope section in Risk classes.
AI system versus general purpose AI model (GPAI)
Section titled “AI system versus general purpose AI model (GPAI)”The AI Act was almost finished before ChatGPT launched — and the Commission had to scramble to figure out how to incorporate large language models and other types of generative AI. The Act was never supposed to classify types of AI technologies, but suddenly, there was a very accessible and very popular new technology that behaved differently than almost all other AI systems, because it was intended to not be limited to a certain set of behaviors or outcomes.
The Act decided to differentiate between AI systems — which are classed according to unacceptable or high risk levels — and general purpose AI models, or GPAIs.
An AI system is the broadest term. A GPAI specifically refers to a model that is intended to be general purpose — to competently perform a wide range of tasks regardless of the way the model is placed on the market, and can be integrated into a variety of downstream systems or applications. In practice, GPAIs capture most large language models (like the ones underpinning Intric), because LLMs are intended for the user to be able to do a wide range of tasks. GPAIs are the only types of specific systems mentioned in the AI Act — aside from these, the Act managed to be technology-agnostic.
A general purpose AI system is an AI system that is based on a GPAI. This term isn’t used that much in the Act, but it is defined in the beginning.
Examples:
- ChatGPT is a GPAI, and because it’s a GPAI, it’s also an AI system.
- A machine learning algorithm used by the tax authorities to decide whether your tax return can be automatically accepted or flagged for human review, is an AI system. It is not a GPAI, because the algorithm was specifically trained and tested to do a distinct task.
- An AI agent is an AI system. Most agents will also be GPAIs, because of their intended level of autonomy, or in other words, ability to competently perform a wide range of activities.
Key takeaways
Section titled “Key takeaways”- The AI Act exists to protect health, safety, and fundamental rights — not to classify all AI systems
- It applies to anyone using AI in a professional context, regardless of payment or whether the system predates the Act
- It applies in stages: prohibitions and the AI literacy requirement since February 2025, GPAI obligations since August 2025, transparency and high-risk requirements since August 2026, and the requirements for regulated products from August 2027
- GPAIs (like the models powering Intric) are the only specific type of AI technology singled out in the Act; all other regulation is technology-agnostic
Test your knowledge
Question 1 of 4
Which of these uses is covered by the AI Act?