AIWiki
Malaysia

EU AI Act

The EU AI Act is the world's first comprehensive legal framework regulating artificial intelligence, classifying AI systems by risk level and imposing obligations on developers and deployers operating in the European Union.

5 min readLast updated June 2026Malaysian Context

The EU AI Act (officially Regulation (EU) 2024/1689 on Artificial Intelligence) is the world's first comprehensive legal framework specifically governing artificial intelligence systems. Adopted by the European Parliament in March 2024 and entering into force on 1 August 2024, the Act applies to any organisation that develops, deploys, imports, or distributes AI systems affecting people within the European Union, regardless of where that organisation is headquartered. Its risk-based structure has made it the primary reference point for AI governance discussions globally, influencing regulatory approaches in Malaysia, the United Kingdom, Singapore, and the United States.

Risk-Based Classification

The Act classifies AI systems into four tiers based on the potential harm they may cause.

Unacceptable risk systems are prohibited outright. These include AI that manipulates human behaviour subliminally, exploits vulnerable groups, operates real-time remote biometric identification in public spaces for law enforcement (with limited exceptions), ranks people by social behaviour in the style of social credit systems, and infers emotions in workplace or educational settings. These prohibitions took effect on 2 February 2025.

High-risk systems face the most stringent requirements. They include AI used in critical infrastructure, medical devices, educational assessments, employment screening, credit scoring, biometric identification, migration controls, and administration of justice. Providers must establish risk management systems, ensure high-quality training data, maintain technical documentation, enable human oversight, and register their systems in a public EU database before deployment.

Limited-risk systems, such as chatbots and AI-generated media including deepfakes, must comply with transparency obligations. Users must be informed when they are interacting with an AI system, and AI-generated content must be labelled as such.

Minimal-risk systems — the vast majority of AI applications such as spam filters, AI in video games, and recommendation engines for non-sensitive content — face no mandatory requirements under the Act, though voluntary codes of conduct are encouraged.

General-Purpose AI Models

A distinctive feature of the Act is its treatment of general-purpose AI (GPAI) models — large foundation models that can be adapted to a wide range of tasks. Provisions for GPAI models became applicable on 2 August 2025. All GPAI model providers must maintain technical documentation, provide information to downstream deployers, establish copyright compliance policies, and publish a summary of training data. Models trained on compute exceeding 10^25 floating-point operations — a threshold covering the largest frontier models — face additional systemic-risk obligations including adversarial testing and incident reporting to the European AI Office.

Governance Structure

The Act created the European AI Office within the European Commission, responsible for supervising GPAI models and coordinating enforcement across member states. Each EU country must designate a national competent authority. The Act also establishes an AI Board comprising national authority representatives to support consistent implementation.

Penalties

Non-compliance carries graduated penalties: up to EUR 35 million or 7 percent of global annual turnover for violations involving prohibited AI practices; up to EUR 15 million or 3 percent for violations by providers of high-risk systems; and up to EUR 7.5 million or 1.5 percent for providing incorrect information to authorities.

Compliance Timeline

| Date | Milestone | |------|-----------| | 1 August 2024 | Act enters into force | | 2 February 2025 | Prohibited AI systems rules apply; AI literacy obligations begin | | 2 August 2025 | GPAI model rules apply; governance bodies operational | | 2 August 2026 | High-risk AI systems rules (Annex I) apply | | 2 August 2027 | All remaining provisions, including high-risk embedded systems, apply |

See Also

References

  1. European Parliament. (2024). Regulation (EU) 2024/1689 on Artificial Intelligence. Official Journal of the European Union.
  2. Jones Day. (2025). EU AI Act: First Rules Take Effect on Prohibited AI Systems and AI Literacy. Jones Day Insights.
  3. European Commission. (2024). High-Level Summary of the AI Act. artificialintelligenceact.eu.
  4. Deloitte. (2025). EU AI Act: AI Governance Implications. Deloitte Consulting.