What will the EU AI Act require, and when?

On March 13, the European Parliament approved the Artificial Intelligence Act by 523 votes to 46, with 49 abstentions. One of its lead negotiators in Parliament called it the world's first binding AI law, and its content was agreed with EU governments in December. Two steps remain before it becomes law: a final legal and language review of the text, and formal approval by the Council, which represents the member states. After it is published in the EU's Official Journal, it enters into force 20 days later, and its obligations then start in stages.

This article explains what the text says and when each part applies. It is a general explanation, not legal advice; a business with real exposure should talk to a lawyer who works on EU law.

The four tiers of the Act

The law regulates AI according to how much harm a use could cause. The higher the risk, the heavier the duties.

Banned practices. A short list of uses will be forbidden, including social scoring, AI that manipulates behaviour or exploits people's vulnerabilities, emotion recognition in workplaces and schools, building facial recognition databases by scraping images from the internet or CCTV, biometric categorisation based on sensitive characteristics, and some forms of predictive policing. Police use of remote biometric identification is banned in principle, with narrow exceptions under strict safeguards.

High-risk systems. These include AI used in schools and job training, in critical infrastructure, in employment, in essential services such as banking and healthcare, parts of law enforcement, migration and border control, and the justice system. The Commission's original proposal gave concrete examples, such as software that screens job applications or assesses creditworthiness. High-risk systems must assess and reduce risks, keep logs of their use, be transparent and accurate, and have human oversight. People will be able to complain about AI systems and get explanations of high-risk decisions that affect their rights.

General-purpose AI. Models that can be used for many tasks, like the ones behind ChatGPT, Claude or Gemini, must meet transparency requirements, including compliance with EU copyright rules and a published, detailed summary of their training material. The most powerful models, those that could pose "systemic risks," face extra duties such as model evaluations, risk mitigation and incident reporting.

Transparency for everyone else. Artificial or manipulated images, audio and video ("deepfakes") must be clearly labelled. AI uses outside these tiers face few or no new obligations; the original proposal encouraged voluntary codes of conduct for them.

Penalties scale with the breach. In December, Parliament described fines ranging from 35 million euros or 7% of worldwide turnover for the most serious violations down to 7.5 million euros or 1.5% for lesser ones, depending on the breach and the size of the company.

When each part applies

All times count from the date the law enters into force, which will be 20 days after publication.

If publication happens in the coming months, as the Parliament expects, the bans would apply around the end of this year or early next, and most of the Act about two years after that. Countries must also set up regulatory sandboxes, supervised spaces where companies, including small businesses and start-ups, can test AI before putting it on the market.

Does it apply to a Canadian business selling in Europe?

Very possibly, yes. The EU designed the Act to cover AI that reaches people in the EU, wherever the company is based. In the Commission's 2021 proposal, which the final text builds on, the rules applied to providers placing AI systems on the EU market whether they were established in the EU or in a third country, and also to providers and users outside the EU when the system's output is used in the EU. Being in Montréal or Vancouver is not, by itself, a way out. Check the final published text for the exact wording of the scope article.

Here is a worked first check for a small Canadian software-as-a-service (SaaS) company with European customers. Answer each question in order:

1. Is your AI used by, or does its output reach, people in the EU? If no, the Act likely doesn't concern you. If yes, continue.
2. Does any feature fall on the banned list? For example, inferring employees' emotions at work. If yes, it will have to stop in the EU six months after entry into force.
3. Is it used in a high-risk area? A tool that ranks job applicants or scores loan applications is the typical case. If yes, plan for risk assessments, logging, documentation and human oversight.
4. Do you build a general-purpose model, or simply use one? Most small companies call another company's model through an API. The model rules mainly fall on the model's provider, though you should ask that provider what documentation it will give you.
5. Does it generate images, audio or video that look real? Plan to label them.

Take a scheduling assistant for clinics that uses a large language model to write appointment reminders. It reaches EU patients (question 1), bans nothing (2), is not in a listed high-risk area (3), uses a third party's model (4), and produces text, not realistic media (5). Its main tasks would be keeping track of the final text and its supplier's documentation. A hiring tool that ranks candidates would land very differently at question 3.