Can you summarize the EU AI Act in one page?

Article 4 of the EU AI Act, Regulation (EU) 2024/1689, obliges every provider and deployer of an AI system to ensure their staff have "a sufficient level of AI literacy." That clause has been in force since 2 February 2025. It appears in almost no one-page summary of the law, and yet it is among the first obligations that reached ordinary companies, because it applies to a firm using a chatbot as much as to a firm building one. The Act is easy to summarise in a sentence and hard to summarise in one clear page, for a good reason: the regulation is complete and multi-layer, in particular where attaches obligations to different uses of AI, and so most summaries end up being useless oversimplifications.

But I'm going to do my best to avoid that, starting from the the thing that can be put in a sentence: The EU AI Act is the first broad legal framework for artificial intelligence, it applies to any organisation that places an AI system on the EU market or puts one into service in the Union regardless of where that organisation sits. It sorts systems into tiers by the risk they pose and attaches duties to each tier. Some uses are banned outright. A defined set of high-risk uses carries the heavy compliance load. Many AI systems fall outside the high-risk category and face limited obligations, although some systems such as chatbots and synthetic-content generators face transparency requirements. The penalties run higher than most people expect, and the deadlines arrive not as a single date but on a phased calendar that runs from 2025 into 2027.

Before setting requirements for different levels of risk, the Act draws a distinction between the practices that are allowed under conditions and those that are not permitted at all. The prohibited practices in Article 5, which applied from 2 February 2025, cover uses the Commission decided were unacceptable in a democracy: social scoring by public authorities, untargeted scraping of facial images to build recognition databases, certain kinds of biometric categorisation, emotion recognition in workplaces and schools. The ceiling for the penalties of breaching one of these reaches up to 35 million euros or 7 percent of global annual turnover of the organization, whichever is higher. By comparison, the equivalent ceiling under the General Data Protection Regulation is 4 percent. The maximum fine for prohibited AI practices exceeds the GDPR's maximum percentage-based penalty, reflecting the EU's view that certain AI practices can pose particularly serious risks to fundamental rights.

The bulk of the law covers the high-risk tier, which is about systems used to screen job applicants, score creditworthiness, allocate medical triage, or to operate as a safety component in machinery. Such uses must carry a risk-management system, documented training data, human oversight, logging, and a conformity assessment before it reaches the market. Most high-risk AI system obligations do not apply immediately. Their timeline depends on the category: high-risk systems under Annex III are scheduled for December 2027, while high-risk AI systems embedded in regulated products follow a longer transition until August 2028. Beneath high-risk, systems that interact with people or generate synthetic media are expected to share a degree of transparency: a user should know they are talking to a machine, and AI-generated content should be marked as such.