The EU AI Act just moved
Xavier Vallée, Founder, Sapionic
There is a lot of noise about new AI rulebooks forming around the world. For most European and UK businesses, only one of them is already law, and it just quietly moved.
The EU AI Act is the world’s first comprehensive AI regulation. Its principle is simple. Sort AI systems by the risk they pose, then regulate each tier accordingly. A small set of uses is banned outright.
A larger high-risk category, covering AI used in hiring, credit, insurance, medical devices and critical infrastructure, carries heavy obligations around testing, human oversight and documentation.
Most everyday AI sits below that line with light-touch rules.
Two things every leadership team should sit up for.
- First, it reaches you even if you are not in Europe. The Act applies to any company placing an AI system on the EU market, or whose AI output is used inside the EU. A UK business selling into Europe is squarely in scope. This is the GDPR model applied to AI.
- Second, the penalties are turnover-based. Up to 35 million euros or 7 percent of global revenue for prohibited uses, and up to 15 million euros or 3 percent for breaching high-risk obligations. That makes this a board and audit-committee matter, not something to leave with IT.
The dates have just shifted. The bans on unacceptable uses have applied since early 2025, and the rules for general-purpose AI models since August 2025. Those are not moving. But the high-risk obligations that were due to bite in August 2026 have been deferred, under a new Digital Omnibus package, to December 2027 for standalone systems and August 2028 for AI embedded in regulated products.
The temptation is to read the delay as a reprieve. It is not. It is breathing room, and the difference is what you do with it.
The businesses that absorb this cheaply will use the next eighteen months to inventory where AI touches their operations, including inside the vendor tools they already pay for, classify each use against the risk tiers, name an accountable owner, and start the documentation trail while it is still cheap to build. The ones treating December 2027 as a distant problem will meet it as a fire drill.
Regulation rarely moves a market on the day it lands. It moves it in the quiet eighteen months beforehand, in the work of the firms that took it seriously early.