EU AI Act
The European Union's Artificial Intelligence Act — the archetypal horizontal, binding, risk-tiered AI law: a single cross-cutting regulation that classifies AI systems by risk (unacceptable / high / limited / minimal) and attaches obligations (and penalties) accordingly. The reference regime against which the other founding sources position themselves.
Stub — created at spin-out as a key cross-source node. Expand when a source covers the Act directly.
Role in this wiki (so far)
- Compliance target. nemko-ai-governance-services aligns its services to the EU AI Act (alongside iso-iec-42001 and the nist-ai-rmf) — firms hire governance vendors largely to meet regimes like this.
- The contrast case. Israel deliberately avoids an EU-style horizontal law (israel-ai-regulation-overview, responsible-innovation), preferring sectoral soft law, while monitoring the Act's implementation to stay interoperable/"export-ready."
It exemplifies the horizontal-binding end of the central policy fork (vs sectoral-soft) in synthesis, built on risk-based-regulation.
What enforcement has actually looked like
Nothing under this Act yet. The corpus's first enforcement decision touching an AI system is a GDPR case, garante-openai-jurisdiction-ruling, and it turned entirely on who was allowed to decide — the Court of Rome annulled Italy's €15M fine against OpenAI on the one-stop-shop rule in Article 56(1) without reaching the merits. That is worth holding beside a horizontal regime whose force depends on national authorities acting: a rights-driven law that applies everywhere still has to answer which regulator speaks, and the first time that question was put to a court the answer vacated the penalty.
What it does not require (2026-08-28)
Read at Articles 12, 19 and 72 for the corpus's denominator question — see ai-act-post-market-monitoring. The short version: post-market monitoring collects performance and compliance data, not usage volume; deployer input is permissive; law-enforcement operational data is excluded; and the only per-use record the Regulation mandates covers remote biometric identification alone, staying in the provider's logs. A regime can be this detailed about a system and still say nothing about how much it is used.
Related
ai-governance · risk-based-regulation · responsible-innovation · iso-iec-42001 · nist-ai-rmf · israel-ai-regulation-overview