AI Act, the EU regulation on artificial intelligence.

Who is concerned?

Any organisation that develops, provides, imports, distributes or uses an AI system on the European market, whether as provider or deployer. If your teams use ChatGPT, Claude, Copilot, or an AI tool for HR screening, content moderation, decision automation, the AI Act applies.

Key obligations

Obligations depend on the risk level:

• Unacceptable risk (banned): social scoring by authorities, cognitive manipulation, vulnerability exploitation, real-time biometric identification in public spaces (with strict exceptions).
• High risk: HR (CV screening), access to education and essential services, law enforcement, border control, biometric identification. Major obligations: quality management system, technical documentation, human oversight, robustness, transparency, logging, CE marking.
• Limited risk: chatbots, deepfakes, content generators. Main obligation: transparency.
• Minimal risk: most uses. No specific obligation.

For general-purpose AI models (GPAI) like GPT-4, Claude, Gemini: technical documentation, training data transparency, copyright compliance.

Deadlines

• 2 February 2025: banned practices.
• 2 August 2025: GPAI model obligations, sanctions, governance.
• 2 August 2026: full application to high-risk systems (except sector-specific products).
• 2 August 2027: high-risk systems embedded in regulated products.

Sanctions for non-compliance

Heavy administrative sanctions: up to €35 million or 7% of worldwide turnover for banned practices; €15M or 3% for other AI obligation failures; €7.5M or 1% for incorrect information.

How Luxgap helps

The AI Act is part of our DPO mandate scope. Our AI advisory goes further: we deploy compliant-by-design AI agents (on-premise disconnected from the Internet for highly regulated sectors, or contractually scoped public GPAIs).