EU AI Act: What Every Developer Needs to Know Before August 2025

The European Union's AI Act passed the European Parliament in March 2024 and entered into force in August 2024, making it the world's first binding comprehensive AI regulation. For developers, the law's risk-based tiered framework means that compliance obligations depend heavily on what your system does and who it affects. Systems are classified as unacceptable risk (banned entirely), high risk (stringent requirements), limited risk (transparency obligations), or minimal risk (no specific requirements). The banned category includes social scoring systems, real-time biometric surveillance in public spaces with narrow exceptions, and AI that exploits vulnerabilities to manipulate behavior. For most developers, the high-risk category is where compliance costs concentrate.

High-risk AI systems — which include those used in critical infrastructure, education, employment, essential services, law enforcement, and migration — face requirements including mandatory conformity assessments, detailed technical documentation, human oversight mechanisms, data governance requirements, and registration in an EU database before deployment. The definition of "high risk" is deliberately broad and will be refined through implementing legislation. General-purpose AI models (GPAIMs), including large language models, face their own tier of requirements: providers of models trained with more than 10^25 FLOPs must submit to mandatory safety evaluations, provide detailed technical documentation, and maintain adversarial testing programs. This threshold captures GPT-4, Claude, Gemini, and Llama 3 at minimum.

The compliance timeline matters enormously for planning. Prohibited AI practices have been banned since August 2024. GPAI model requirements kick in August 2025. High-risk system requirements for most categories apply from August 2026, with some categories (existing high-risk systems under other EU frameworks) getting an additional year. For US-based developers, jurisdictional applicability follows an effects-based standard similar to GDPR: if your AI system is used in the EU or affects EU residents, the Act applies regardless of where you're incorporated. The European AI Office, established under the Act, will have investigative and enforcement powers including fines up to €35 million or 7% of global annual turnover for the most serious violations. The practical advice for developers building applications now: assume any user-facing AI system deployed at scale in the EU will face scrutiny, document your design decisions, build human oversight into agentic workflows, and follow the AI Office's implementing guidance as it emerges.

The EU AI Act is published in the Official Journal of the European Union. The European AI Office website at digital-strategy.ec.europa.eu provides compliance guidance.