EU AI Act: what you need to know, what you need to do, and why it’s rather brilliant

If you use AI in your organisation and you interact with the EU, this applies to you – as do the fines – and you need to act before the 2 August 2026.

You have been warned.

Call me a dirty socialist, but I generally believe regulation, when done well, can have an incredibly positive impact.

The financial regulation brought in to avoid 1929 again did precisely that for several decades. When it was removed, what happened? 2008.

AI is more versatile, accessible, and overall riskier than even nuclear technologies. Consequently, having some form of regulation is essential if we wish to avoid Claude Mythos working your codebase and accidentally deleting the human race.

Doing this in a way which doesn’t stifle innovation though is a fine line, and many have criticised the EU’s AI Act – enforced from the 2 August 2026 – for what they perceive to be a massive overstep by the bloc.

However, I’ve gone through it myself and come to a very different conclusion:

This is genuinely brilliant work by the EU.

The biggest risk in AI is you

The graph tracking the rate at which AI is exponentially growing in capability has become a vertical cliff face. Meanwhile, the majority of users are on free accounts, barely able to prompt. The result is ever growing power and capability in the user’s hands, with none of the knowledge, skill or responsibility required to use it.

This is a major problem, which becomes all the more critical when you map out the actual risks AI poses to an organisation:

Nearly all these risk factors are entirely on the user side:

• Your organisation’s reputation and credibility are directly tied to the individuals flying your flag.
• Your data security is dependent on your people not leaking it.
• The psychological risks of AI all arise from the user’s approach to AI, and these risks become an organisation’s when the quality of work drops and burnout rates skyrocket.

Consider a different technology for a moment - the car. When you drive, you’re in charge of a 2-tonne death machine.

All it takes is one slip, and you’ve ruined your life and others in a blink of an eye.

Over the years, we have mitigated this risk by adding a tonne of safety improvements to vehicles. But the most important safety improvement we have made isn’t the seatbelt or the airbag: it’s the driver’s licence.

Now consider AI. The risk profile of cars generally only reach as far as the road and the immediate location around it. AI is a risk factor to literally everything in human society - our cognitive ability, our economy and environment, and even our continued existence.

The kneejerk is to assume all this can be mitigated through provision of better, safer AI platforms.

To some extent, this is true – such as Claude’s Mythos launching as Fable which guides users hitting high risk areas to lower tier models. But even so, all of this can be mitigated massively by providing continuous enablement coaching – exactly what the EU regs make enforceable.

How the EU AI Act tackles this

The EU AI Act introduces its own risk tiers: minimal, limited, high and unacceptable.

Unacceptable risk carries with it a €35m or 7% of global turnover fine (whichever is higher), and prohibits using AI to manipulate or deceive, exploit the vulnerable, social scoring, criminal offence prediction, untargeted scraping of the internet, emotional recognition, deducing protected characteristics, and real-time biometric identification for law enforcement.

High risk is far broader, and will be enforced by a €15m or 3% turnover fine. These include AI deployments in infrastructure, education, management of workers and recruitment (including CV and application management AI), any system governing access to a service (eg. Credit scoring), biometrics identification as a whole, and more.

In these cases, the EU has introduced a pathway for their management:

This tier also requires companies which are either making AI or deploying it within their organisations to have deployed effective risk management strategies.

The act also enforces a fine of €7.5m or 1% turnover for any organisation which supplies incomplete, incorrect or misleading information when requested. This includes how your organisation is providing AI literacy, which the act clarifies as:

• Users must have an understanding of how the AI systems they operate work
• Users should be trained on how to work with AI (AI fluency)
• Explains the risk, opportunity & appropriate governance of AI.
• Awareness of legal, ethical and privacy obligations, including the AI Act itself.
• Training tailored to the specific role, knowledge and experience of staff.
• The training should be provided continuously.

This is the masterstroke. Somehow, some way, someone in the EU spotted that the greatest risks posed by AI are all user-side – aka. the problem is not on-screen but in-chair – all the way back in 2024, and got that signed into law.

The good news is, if you’ve been trained by me, you’ve likely already covered most of these bases. The bad news is that most other forms of AI training I’ve seen delivered (including Microsoft’s Masterclass) completely fail to meet these obligations. Going by the numbers I’ve got on my books, I hazard a guess that your organisation falls into the latter category.

But wait, didn’t we do a vote on this a few years ago here in the UK? Yes, but just like GDPR, this still applies to the UK. And, indeed, the rest of the world. Essentially, if your organisation is either creating AI platforms or deploying it, and you interact with EU citizens or organisations in any manner, then you are on the hook.

The Act was created in 2024, signed in during 2025, and will be enforced from 2 August.

If you’re not ready by then, tokens and seat allocation will be the least of your concerns when budgeting for AI.

Thanks for reading. If you found this useful, drop a like and a comment or share with your network. LI doesn’t like me adding links, so check the comments for EU Act and compliance checker.