On December 8, 2023, after 38 hours of negotiation, the EU Parliament and Council reached political agreement on the AI Act. It is the world's first AI regulation, and it touches anyone selling or using AI systems in the EU.
The four risk tiers
- Unacceptable (banned): social scoring, subliminal manipulation, real-time biometric identification in public spaces (with strict exceptions).
- High-risk: healthcare, education, critical infrastructure, employment, justice. Requires conformity assessments, technical documentation, human oversight.
- Limited risk: chatbots, deepfakes. Transparency obligation (the user must know they are talking to an AI).
- Minimal risk: spam filters, recommenders. No specific duties.
"General-purpose" models (GPT, Claude, Llama)
A new category introduced in the deal. Models with systemic impact (above 10²⁵ FLOPS of training) carry specific duties: red-teaming, incident reporting, risk assessment, cybersecurity. Below threshold, just technical documentation and copyright compliance on training data.
Deadlines
- Entry into force: ~May 2024 (after EU Gazette publication).
- Prohibited practices: 6 months after (≈ November 2024).
- General-purpose models: 12 months after (≈ May 2025).
- Rest: 24 months after (≈ May 2026).
What Italian SMEs should do today
For most projects we run (internal chatbots, AI assistants, automations), the applicable regime is "limited risk". That means: transparency, no tricks, interaction logs. All doable without upheaval. For anyone touching healthcare, HR, education: the compliance work is serious — start now.