Europe agrees on world's first comprehensive AI Act

After marathon negotiations, the European Union just agreed on the world's first comprehensive set of rules governing artificial intelligence.

On Friday, negotiators from the European Parliament and the Council reached a provisional political deal on the Artificial Intelligence Act, setting up a risk-based legal framework that comes with serious teeth.

Fines for breaking the rules will be massive, ranging from 7.5 million euros or 1.5% of global turnover up to 35 million euros or 7% of annual worldwide revenue.

Outlawed systems and strict limits

The deal outright bans AI practices deemed harmful to fundamental rights and democracy.

Prohibited uses include biometric categorization systems that sort people by sensitive traits like race, political views, or religion. Untargeted scraping of facial images from the web or CCTV footage to build facial recognition databases is also banned.

The law also forbids emotion recognition in workplaces and schools, social scoring systems, and AI designed to manipulate human behavior or exploit vulnerable groups such as children or people with disabilities.

Law enforcement faces narrow exceptions. Live remote biometric identification in public spaces is barred unless police have prior judicial approval to search for targeted victims of kidnapping or trafficking, prevent immediate terrorist threats, or track suspects of specific serious crimes.

For systems labeled high-risk, like those used in banking, insurance, or voter targeting, companies must conduct mandatory fundamental rights impact assessments, and citizens gain the right to receive meaningful explanations for automated decisions.

Leashes on frontier models

The agreement also introduces explicit obligations for general-purpose AI (GPAI) foundation models.

All GPAI developers must meet baseline transparency rules, including maintaining technical documentation, respecting EU copyright laws, and publishing detailed summaries of their training data.

Models posing systemic risks face much tighter controls. Their creators must perform model evaluations and adversarial testing, assess and mitigate systemic risks, report serious incidents to the European Commission, and disclose energy efficiency data.

To keep smaller players from getting crushed by tech giants, the deal promotes national regulatory sandboxes where startups and SMEs can test novel systems before commercial launch.

Why it matters

This is the most aggressive move yet to regulate artificial intelligence, and Brussels is effectively attempting to set the global standard just as it did with GDPR.

For regular consumers, the law provides actual legal recourse against invasive facial scraping, workplace surveillance, and unexplainable algorithmic rejections in critical areas like loans.

For tech giants and frontier labs, the regulatory landscape just got much more expensive. The mandatory disclosure of training data hits right where leading AI models are most legally vulnerable regarding copyright infringement.

We think the EU took a calculated risk here. Anchoring obligations to risk levels rather than static technology is smart, but the compliance burden could easily backfire. If red tape slows European startups down while US competitors run free, Europe risks solidifying its role as a global rule-maker that does not actually build the technology it regulates.