The EU AI Act has been in force since 2024 and is taking effect in stages. For everyday users of AI tools, it’s often unclear what this actually means: does it apply to me if I use ChatGPT or Claude? What’s actually banned? This article breaks down the key facts – without alarmism, but without downplaying it either.
Table of Contents
What Is the AI Act, Exactly?
The AI Act (officially Regulation (EU) 2024/1689) is the world’s first comprehensive law regulating Artificial Intelligence. It follows a risk-based approach: the greater the potential risk an AI application poses to health, safety, or fundamental rights, the stricter the requirements. The regulation applies directly across all EU member states and covers both providers (who develop AI systems) and deployers (who use them) – including companies outside the EU if their systems are used in the EU or affect EU citizens.
The Four Risk Categories at a Glance
The core of the AI Act is its classification of AI systems into four risk tiers:
Unacceptable Risk (Prohibited): Certain AI practices have been completely banned in the EU since 2 February 2025 (Article 5 of the AI Act). These include: manipulative techniques that subliminally influence human behavior and can cause harm; deliberately exploiting vulnerabilities due to age, disability, or social/economic situation; social scoring systems run by public authorities that rate people based on their behavior; untargeted scraping of facial images from the internet or CCTV footage to build facial recognition databases; and certain forms of real-time remote biometric identification in public spaces by law enforcement. Violations of these bans can result in fines of up to €35 million or 7% of global annual turnover, whichever is higher.
High Risk: AI systems used in sensitive areas – such as pre-screening job applications, credit scoring, medical diagnostics, critical infrastructure, or law enforcement – are classified as high risk. Strict obligations apply: risk management systems, high-quality training data, technical documentation, human oversight, and registration in an EU database. Important for context: in summer 2026, the so-called “Digital Omnibus” (Regulation (EU) 2026/1744, in force since 27 July 2026) introduced a delay – full obligations for stand-alone high-risk systems (Annex III, e.g. hiring, education, critical infrastructure) now apply from 2 December 2027 instead of the originally planned August 2026. For high-risk AI embedded in products (e.g. medical devices, machinery, toys), the deadline is 2 August 2028.
Limited Risk: This covers systems like chatbots, deepfakes, or AI-generated content. Transparency obligations apply here (Article 50 of the AI Act): users must be able to recognize that they’re interacting with AI, or that an image, video, or audio was artificially generated or manipulated. These labeling requirements have applied since 2 August 2026 for new systems; systems already on the market have a transition period until 2 December 2026.
Minimal Risk: The vast majority of AI applications in use today – such as spam filters, AI in video games, or simple recommendation algorithms – fall into this category. No mandatory obligations apply beyond existing law, though voluntary codes of conduct exist.
What Does This Actually Mean for You as an AI User?
For most people using tools like ChatGPT, Claude, or Gemini in everyday life, the AI Act initially changes little that’s directly visible. The obligations primarily target providers and businesses, not private users. In practice, you’ll notice the AI Act in two main places: first, through transparency notices – providers are increasingly required to label content as AI-generated (e.g. watermarks on AI images) or make clear when you’re talking to a chatbot rather than a human. Second, if you use AI tools in a professional context, especially in areas like HR, education, or healthcare – stricter requirements for the providers of these systems kick in from the dates above, which indirectly affects how they’re used within companies (e.g. an obligation to inform affected individuals).
In practical terms: a consumer tool like an AI writing assistant or a general chat assistant typically sits in the “limited risk” category and remains freely usable – but you should be able to tell that it’s AI. Want to know more about the specific models and their use cases? Check our current LLM leaderboard.
The AGI/ASI Debate: What Does It Have to Do with the AI Act?
Running parallel to the regulatory debate is a different, more speculative discussion: when will AI systems reach “AGI” (Artificial General Intelligence, general human-like AI) or even “ASI” (Artificial Superintelligence, AI that surpasses human capability in virtually every domain)? Leading AI labs like OpenAI, Anthropic, and Google DeepMind offer differing public views on this – predictions range from “this decade” to “many years to decades away,” and there is no consensus within the research community on a reliable timeline.
The AI Act itself is deliberately not designed around hypothetical superintelligence; instead, it regulates concrete risks that already exist today: algorithmic discrimination, manipulation, surveillance, lack of transparency. One exception is the rules for “general-purpose AI models with systemic risk” – particularly capable foundation models (roughly gauged by the compute used for training), which face additional obligations: risk assessments, model evaluations, reporting serious incidents to the EU Commission, and cybersecurity safeguards. These rules apply regardless of whether you consider the AGI debate realistic – they’re a pragmatic safety mechanism for very capable models, not a response to science-fiction scenarios.
For you as a user, this means: the AGI/ASI debate is interesting and relevant for long-term AI safety research, but has little direct bearing on your everyday use of AI tools. What matters more are the concrete, already-applicable rules on transparency and prohibited practices.
Frequently Asked Questions About the AI Act
Do I need to worry about the AI Act as a private ChatGPT user?
Not directly. The AI Act primarily targets providers and operators of AI systems, not private end users. As a user, the main change is that you can more clearly recognize when you’re interacting with AI or seeing AI-generated content.
What counts as a prohibited AI practice?
Among other things: manipulative techniques that subliminally influence human behavior, exploiting vulnerabilities of people, social scoring systems run by authorities, and certain forms of real-time biometric surveillance in public spaces. These bans have applied in the EU since February 2025.
When do the rules for high-risk AI systems fully apply?
Following the summer 2026 amendment (Digital Omnibus), full obligations for stand-alone high-risk systems apply from 2 December 2027, and for high-risk AI embedded in products from 2 August 2028. Transparency obligations (e.g. labeling AI content) have already applied since August 2026.
Is a chatbot like ChatGPT a high-risk AI system?
Usually not. General chat assistants typically fall under the limited-risk category: users just need to be able to recognize they are interacting with AI. High-risk classifications mainly cover sensitive areas like hiring, credit scoring, medical diagnostics, or law enforcement.
What does the AI Act have to do with the AGI/ASI debate?
Directly, not much. The AI Act regulates concrete, already-existing risks of current AI systems, not hypothetical future superintelligence. However, general-purpose AI models with very high capability (systemic-risk GPAI) are subject to additional obligations like risk assessments and incident reporting, independent of AGI speculation.
