EU AI Act bites

Europe’s artificial intelligence law is no longer a distant threat on a legal slide deck. Since Sunday, February 2, 2025, the first rules have already applied, and since August 2025 the rules for general-purpose models have applied across the European Union. (digital-strategy.ec.europa.eu 1) (digital-strategy.ec.europa.eu 2) The law works like airport security with four lanes. A small chatbot that writes marketing copy faces light duties, while a system used in hiring, policing, or critical infrastructure can be pushed into the high-risk lane with far heavier checks. (digital-strategy.ec.europa.eu) Those checks are not abstract ethics promises. The European Commission says high-risk systems need risk management, logging, human oversight, quality management, post-market monitoring, and technical documentation that can prove how the system was built and how it behaves. (digital-strategy.ec.europa.eu) That is why information technology teams are suddenly doing paperwork that looks more like aviation or medical devices than software. European standards bodies are now drafting the technical rules for record-keeping, transparency, quality systems, and monitoring so companies can show what the law calls conformity. (digital-strategy.ec.europa.eu) The squeeze is worst for general-purpose models, which are the base engines underneath many tools. The Commission says providers must now give clearer information on training, respect copyright rules, and publish a summary of the data used to train models sold into the European Union market. (digital-strategy.ec.europa.eu) For the biggest models, the bar rises again. The Commission uses a compute threshold of more than 10^25 floating-point operations to flag models with systemic risk, and those providers face extra duties on safety, security, and notification. (digital-strategy.ec.europa.eu) Europe is trying to make that burden easier to carry with a voluntary code of practice. The General-Purpose Artificial Intelligence Code of Practice was published on July 10, 2025, and the Commission says companies that sign and follow it get lower compliance burden and more legal certainty. (digital-strategy.ec.europa.eu 1) (digital-strategy.ec.europa.eu 2) Enforcement is also getting real institutions behind it. The European Artificial Intelligence Office supervises the most powerful general-purpose models, while national market surveillance authorities handle prohibited practices and high-risk systems inside each member state. (digital-strategy.ec.europa.eu) At the same time, Brussels is pushing an “AI Continent Action Plan” to build more local capacity. The plan, launched on April 9, 2025, is explicitly about turning Europe into an “AI continent” with stronger infrastructure, investment, and industrial deployment. (digital-strategy.ec.europa.eu) (commission.europa.eu) That creates a tension companies can already feel. The more Europe insists on local control, local compute, local oversight, and local documentation, the more it risks making access to the fastest-moving frontier models slower and more expensive than in the United States. (digital-strategy.ec.europa.eu) (commission.europa.eu) So the story in 2026 is not whether Europe will regulate artificial intelligence. The story is whether companies can turn a 458-page law into working audit trails, review gates, and engineering controls before the next deadlines hit, without falling a generation behind the firms shipping the models they depend on. (digital-strategy.ec.europa.eu 1) (digital-strategy.ec.europa.eu 2)