The EU AI Act in Practice: One Year Later

The AI Act classifies artificial intelligence systems into risk categories with corresponding obligations. Unacceptable-risk applications, social scoring, real-time biometric surveillance in public spaces, and manipulation of vulnerable individuals, are prohibited outright. High-risk systems used in critical infrastructure, education, employment, and law enforcement face extensive requirements including risk assessments, data governance, human oversight, and conformity certifications.

General-purpose AI models, including the large language models that power ChatGPT and similar applications, face transparency requirements and, for the most capable systems, additional obligations around systemic risk assessment. Lower-risk applications face only minimal transparency requirements.

Companies operating in Europe have invested heavily in compliance infrastructure. Large technology firms report spending hundreds of millions of euros on legal analysis, documentation systems, testing protocols, and organizational restructuring to meet AI Act requirements. These costs fall disproportionately on smaller companies that lack dedicated regulatory affairs capacity.

Some companies have restricted European availability of AI features rather than bear compliance costs. Others have developed Europe-specific product versions with additional safeguards and limitations. The fragmentation of product offerings across jurisdictions has increased operational complexity.

Enforcement has proven uneven as national authorities develop capacity and interpretive approaches. Germany's rigorous implementation contrasts with lighter-touch approaches in some Eastern European members. This variation creates regulatory arbitrage opportunities and complicates compliance planning for companies operating across the bloc.

The impact on European AI innovation remains contested. Proponents argue that clear rules reduce uncertainty and create market opportunities for compliant solutions. Critics point to startup funding data showing European AI investment lagging American levels, though establishing causation is difficult given multiple contributing factors.

Some European AI companies have positioned compliance expertise as a competitive advantage, developing tools and services that help other organizations meet AI Act requirements. This compliance technology sector has grown rapidly, representing both an economic opportunity and a cost of regulation.

The AI Act's most significant impact may be global rather than European. Companies seeking to access the European market must comply with its requirements regardless of where they are headquartered. This dynamic, the Brussels Effect, has historically pushed global standards toward European preferences in areas from privacy to chemical safety.

Early evidence suggests the pattern is repeating. American companies are implementing AI Act requirements in global products rather than maintaining separate European versions. Asian regulators have borrowed AI Act concepts and language in developing their own frameworks. The European approach to AI governance is becoming, by default, a global template.

Unintended consequences have emerged as the regulation encounters reality. The transparency requirements for general-purpose AI models have created tensions with intellectual property protection, as companies resist disclosing training methodologies they consider competitive advantages. The documentation requirements for high-risk systems have incentivized some operators to argue their applications fall into lower-risk categories, potentially creating regulatory gaps.

The human oversight requirement has proven particularly complex. Determining what constitutes meaningful human control over AI decision-making systems challenges both regulators and implementers. Some organizations have created nominal oversight processes that satisfy compliance requirements without genuinely empowering human intervention.

The AI Act's true impact will become apparent over years rather than months. The prohibitions on unacceptable applications take full effect in 2025, with high-risk system requirements following in 2026. Enforcement actions and judicial interpretations will clarify ambiguities that currently complicate compliance.

Europe has made a bet: that setting guardrails for AI development will enhance rather than undermine innovation, and that global companies will adapt to European requirements rather than exit the market. One year in, the jury remains out on whether this bet will pay off.