EU AI Act: First two chapters come into effect

The provisions of the first two chapters of the EU AI Act have now come into effect, as of 2 February 2025.  

What is the EU AI Act?

The EU AI Act, which was introduced in August 2024, is directly applicable across the European Union and is being phased in gradually over a 36-month period from entry into force. The aim of the Act is to promote the development and usage of safe AI systems. It adopts a risk-based approach which will categorise all AI systems into four risk categories, ranging from minimal risk to unacceptable risk. 

The Act consists of 12 different chapters which are being phased in gradually. The first two chapters, ‘Chapter 1: General Provisions’ and ‘Chapter 2: Prohibited AI Practices’, are now in effect.  

Chapter 1: General Provisions

Chapter 1 of the EU AI Act, ‘General Provisions’, states that providers and deployers of AI systems are obligated to ensure, as much as is possible, that their staff are sufficiently trained in AI literacy. A provider of AI systems is defined as any entity which develops AI systems, places AI systems on the market, or puts AI systems into service under their own name. Deployers of AI systems are those who use AI systems under their authority for professional activities.  

It is important to note that most businesses who use any AI systems will be considered ‘deployers of AI systems’, so it’s crucial that employers are fully aware of their obligations at this stage, and that they stay up to date with any future updates to the regulation. 

Chapter 2: Prohibited AI Practices

Chapter 2 of the Act, ‘Prohibited AI Practices’, details a list of eight harmful uses of AI which are considered unacceptable, and are therefore prohibited. The list consists of all systems which: 

• use subliminal techniques likely to cause a person, or another, significant harm 
• exploit vulnerabilities due to age, disability or social or economic situation 
• perform social scoring or profiling, leading to disproportionate detrimental or unfavourable treatment 
• profile individuals for prediction of criminal activity 
• perform untargeted scraping of facial images 
• are used to infer emotions in work or education 
• perform biometric categorisation of race, religion, or sexual orientation 
• perform ‘real-time’ remote biometric identification for law enforcement purposes 

What's Next?

The next milestone date for the regulation is 2 August 2025. On this date, EU member states will have to designate competent authorities for the purpose of the EU AI Act, and to legislate penalties for those who breach the rules set out in the Act.