A practical breakdown
The world's first comprehensive law for artificial intelligence. The trick to understanding it: it doesn't regulate the technology — it regulates what you do with it, and the rules scale with the risk.
THE MENTAL MODEL
The Act is a sorting machine. Every AI system gets dropped in by its risk, and the weight of the rules matches the tier it lands in.
Most people expect a law that says "here are the rules for AI." The EU AI Act is built differently. It asks one question about each system — how much risk does this particular use create for people's rights and safety? — and sorts it into one of four tiers. Unacceptable uses are banned outright. High-risk uses carry heavy obligations. Limited-risk uses just need to be transparent. Everything else is free.
This is why the same piece of technology can sit in totally different tiers. A face-matching model is minimal-risk when it unlocks your phone, high-risk when it screens job applicants, and outright banned when it scrapes the open web to build a surveillance database.
Same tech · different use · different tier
01 — THE FOUR TIERS
The fewer the systems in a tier, the heavier its rules. A tiny number of uses are banned at the top; the vast majority of everyday AI sits unregulated at the bottom. Click any tier to open it.
One more track, running alongside
General-purpose AI models — the large models like GPT, Gemini or Llama that power many products — are governed by their own separate set of rules, not the pyramid. We cover those further down.
02 — TRY IT YOURSELF
The whole Act turns on classification. Pick a real-world AI use below and see where the sorting machine drops it — and why.
Interactive · the classifier
← Pick a use case to classify it.
03 — UNACCEPTABLE RISK
At the top of the pyramid, a short list of practices is prohibited outright across the EU — no compliance path, no exceptions for most. These are uses seen as a clear threat to people's rights. (Article 5.)
The narrow exception
Real-time facial recognition in public by police is banned by default, but narrowly allowed for things like searching for a missing child or preventing an imminent terror attack — and only with a fundamental-rights assessment and judicial sign-off.
04 — HIGH RISK
These systems are allowed, but heavily regulated — the bulk of the Act is about them. A use is high-risk if it's a safety component of a regulated product, or if it falls into one of eight sensitive areas (Annex III). Filter the areas, then see what providers must actually do.
IF IT'S HIGH-RISK, THE PROVIDER MUST…
05 — GENERAL-PURPOSE AI
The big foundation models don't fit the use-based pyramid — one model can be put to a thousand uses. So they get their own rules, in two layers: a baseline for every GPAI model, plus extra duties for the most powerful ones that pose "systemic risk."
Free & open-licence models only owe the last two — unless they hit systemic risk.
These stack on top of the baseline — systemic-risk models owe both sets.
WHAT COUNTS AS "SYSTEMIC RISK"? — DRAG TO EXPLORE
The headline trigger is raw training compute. A model is presumed to pose systemic risk once the compute used to train it crosses 1025 floating-point operations (FLOP).
The compute figure is the legal presumption; the Commission can also designate a model systemic on other grounds. Threshold illustrative of the rule, not a precise model ranking.
06 — WHO'S ON THE HOOK
The Act splits responsibility by role. Most of the weight falls on whoever builds the system, but the organisation that uses it has duties too.
Provider
The one who builds it
Develops the AI system (or has it built) and puts it on the market under their name. Carries the bulk of the obligations — risk management, documentation, testing, conformity assessment, registration.
Deployer
The one who uses it
Uses an AI system in a professional capacity (a hospital, a bank, an HR team). Lighter duties: use it as instructed, keep human oversight, monitor it, and — for some uses — inform the people affected.
Like the GDPR, the Act applies extraterritorially. If your AI system's output is used in the EU — even if your company sits in the US or anywhere else — you're in scope. That's why a law passed in Brussels shapes how AI is built worldwide.
07 — PENALTIES
Fines are tiered to match the severity of the breach, and — crucially — calculated as the higher of a fixed sum or a percentage of global annual turnover. For large companies, the percentage is what bites.
DO THE MATH — THE "WHICHEVER IS HIGHER" CATCH
For SMEs and start-ups, the rule flips to whichever is lower, to keep fines proportionate. Figures are statutory caps, not automatic penalties.
08 — THE ROLLOUT
The Act entered into force in August 2024, but its rules switch on in stages over several years — banned uses first, the heaviest high-risk duties last.
09 — TEST YOURSELF
Five quick questions. You get instant feedback and the why behind each answer.
SOURCES