The first major law in the world that tells artificial intelligence what it's not allowed to do. It applies to anyone selling AI in Europe, no matter where they run the code from.
The law sorts AI systems into four levels based on what they can do to you. At the top is what's banned: a government slapping a social score on your behavior, emotion recognition at work or in school, a street camera scanning your face in real time for police purposes (with narrow exceptions), a bot manipulating you because it knows you're a child or in a vulnerable state. At the bottom is the free zone - a spam filter, a movie recommendation. None of that touches the law.
Between the two sits the 'high-risk' level, where the real work happens. If you sell AI that filters job candidates, decides who gets a bank loan, or assesses an asylum application, you can't just release it and see what happens. You need documentation on how it was trained, error testing, a human who can stop or override it, and registration in a European database - before it ever reaches a user.
It exists because Europe learned its lesson the hard way with internet platforms - the rules arrived years after the damage was done, when it was too late to fix anything. This time they decided to flip the order: the framework is ready before the product floods the market, not after the crash. Whether the response is late or timely, decide for yourself - but the principle is new for tech legislation.
And here's the part that spooks American and Chinese companies more than anything else: the law doesn't ask where your office sits. If your chatbot, your hiring system, or your AI for approving insurance reaches a European user, you fall under its jurisdiction - no matter where you run the code from. Fines reach up to 35 million euros or 7% of the company's global annual turnover, whichever is higher.
The shape gives it away
This industry moves faster than any bureaucratic apparatus, including the European one. Twenty-seven countries have to enforce the same thing with equal strictness, and history shows that never happens in practice. Some will apply it to the letter. Others will leave it on paper.
But the principle behind the law is right - I'd rather work inside a framework with clear boundaries than the wild west we had before. The problem isn't the intent. The problem is whether 27 regulators, with different budgets and different will, will actually enforce it the same way. That's the test - not the text of the law itself.