Unacceptable risk
Banned uses that are considered incompatible with EU values and rights protections.
1. Risk model used by the Act
The EU AI Act uses a tiered model to calibrate obligations by impact level. Not every AI use case is treated equally. Compliance burden scales with potential harm and rights impact.
Use the risk model as a planning map: what can ship now, what needs stronger controls, and what should not ship. Re-check classification when model scope, data source, or user impact changes. In EU AI Act News tracking, this is usually the first decision point that drives all later work.
High risk
Strict lifecycle obligations for systems used in sensitive or consequential domains.
Limited risk
Transparency duties such as disclosure of AI interaction and synthetic content marking.
Minimal risk
Mostly unrestricted use, with voluntary governance and good-practice expectations.
2. Prohibited practices (Article 5)
Article 5 defines hard red lines. If your feature falls into these categories, operational controls are not enough; redesign or removal is usually required.
Product pressure often creates "partial deployment" proposals, but that does not solve prohibited-use issues. If feature logic depends on a banned practice, the right response is scope change, not wording changes in user messaging.
- Social scoring based on personal behavior or characteristics.
- Certain manipulative AI targeting vulnerabilities and causing harm.
- Untargeted large-scale facial image scraping for databases.
- Certain emotion-recognition use in work and education contexts.
3. High-risk systems obligations
High-risk systems require an operational compliance system covering governance, engineering controls, documentation, and post-market oversight.
High-risk compliance is execution discipline: traceable design choices, test records, clear ownership, and practical human oversight. Most delays come from unclear handoffs between ML, product, and compliance teams, so define ownership early. EU AI Act News updates frequently reinforce this operational gap.
- Risk management framework and iterative controls.
- Data governance and quality controls.
- Technical documentation and logging traceability.
- Human oversight design and robustness/cybersecurity measures.
- Conformity and registration duties for applicable use cases.
4. General-purpose AI (GPAI)
Chapter V introduces obligations for GPAI model providers, including downstream documentation and additional controls where systemic risk thresholds are met.
GPAI obligations are not only for frontier model labs. Application companies still depend on provider documentation to complete their own files. If upstream documentation is missing or vague, downstream controls become difficult to defend.
- Technical documentation and information sharing for downstream actors.
- Training data summary and copyright policy alignment.
- For systemic-risk GPAI: stronger evaluation, incident, and mitigation duties.
5. Transparency obligations (Article 50)
Transparency is one of the most visible compliance interfaces for customer-facing products.
Disclosure should be clear on first read. If users need legal interpretation to understand AI interaction, implementation is too opaque. The same applies to synthetic media labels that are present but easy to miss. EU AI Act News discussions around transparency repeatedly point to this issue.
- Users should know when they are interacting with AI systems in covered contexts.
- Synthetic or manipulated media must be labeled as required by law and guidance.
6. Penalties and enforcement
The penalties chapter defines administrative sanctions, including higher tiers for specific categories of serious non-compliance. Exposure assessment should be treated as governance input, not only legal text interpretation.
Penalty exposure affects more than legal reserves. It can change procurement outcomes, investor diligence, customer trust, and incident response expectations. Monthly exposure review and explicit risk-acceptance records help teams react before scrutiny rises.
7. Implementation timeline milestones
The timeline is a rolling program, not a one-time checklist. Use it as a quarterly anchor: what applies now, what applies next, and what proof must be ready on request. For most teams, EU AI Act News cadence is easiest to manage when it is tied to the same quarterly planning cycle used for product releases.
- 2025-02-02: First application phase, including initial prohibited-use and baseline duties.
- 2025-08-02: Additional implementation phases apply, including GPAI-related obligations.
- 2026-08-02: Main wave of broader obligations, especially high-risk operational requirements.
- 2027-08-02: Further staged requirements and transition completion points.
8. Sources
These links are the primary references behind this EU AI Act News summary. Keep them in your internal knowledge base so policy, product, and engineering teams verify the same material. If teams pull from different unofficial summaries, alignment breaks quickly and review cycles get longer.