What is the EU AI Act?
The EU AI Act is Regulation (EU) 2024/1689, which classifies AI systems in the European Union by risk level and sets obligations for providers and deployers accordingly. It can reach companies outside the EU: a provider placing an AI system on the EU market, or one whose system's output is used in the EU, may be in scope wherever it is based.
Definition
The EU AI Act is Regulation (EU) 2024/1689, which classifies AI systems in the European Union by risk level and sets obligations for providers and deployers accordingly.
What are the risk levels?
The Regulation sorts AI uses by risk:
- Unacceptable risk. Practices such as social scoring of individuals are prohibited.
- High risk. Systems in areas such as recruitment, access to education, creditworthiness and critical infrastructure require risk management, data quality controls, documentation and human oversight.
- Transparency obligations. People must be told when they are interacting with an AI system such as a chatbot, and certain AI-generated content must be marked.
- Minimal risk. Most other uses, with no additional obligations.
Separate rules apply to providers of general-purpose AI models.
When should you take it into account?
Any company that exports to the EU, offers software or a chatbot to EU customers, or builds systems for an EU parent company should assess which risk class its uses fall into. This includes nearshore teams in Türkiye delivering AI systems to EU clients. If you use AI for hiring or credit decisions, the priority is high.
Relationship with GDPR and KVKK
The EU AI Act does not replace data protection law. GDPR continues to apply to personal data of people in the EU, and KVKK, Türkiye’s data protection law, to processing in Türkiye. Bringing these obligations under one roof is the job of AI governance. This page is general information; legal assessment should be done together with your legal adviser.
Related terms
- AI governanceAI governance is the set of policies, roles and processes that determine how an organisation selects, uses, oversees and manages the risks of its AI systems.
- KVKK (Turkish Personal Data Protection Law)KVKK is Türkiye's Personal Data Protection Law, Law No. 6698, which sets the rules for processing personal data and the rights of individuals in Türkiye.
- Agentic AIAgentic AI is an approach in which AI systems do more than generate answers: they set sub-goals, plan, use tools and carry out multi-step work with limited human intervention.
- AI hallucinationAn AI hallucination is output in which a language model presents information, a source or a figure that does not exist, fluently and confidently, as if it were true.
Frequently asked questions
When does the EU AI Act apply?
The Regulation entered into force on 1 August 2024 and applies in stages. Prohibited practices have applied since February 2025, rules for general-purpose AI models since August 2025 and transparency rules since August 2026. The AI Omnibus amendment, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the high-risk rules to 2 December 2027 for Annex III use cases and to 2 August 2028 for systems embedded in Annex I products.
We are based in Türkiye. Does the EU AI Act concern us?
It may, if you offer a product or service that includes AI to customers in the EU or if your system's output is used in the EU. Assess your role (provider, deployer, importer, distributor) together with your legal adviser.
Let’s talk about your transformation
Tell us which work repeats every week. We will tell you honestly whether it is worth automating.
How we start
- A free first callWe pin down the problem and the goal together.
- A 2-week discovery sprintWe look at the data, the process and the tools, and decide where to start.
- A written proposalScope, architecture and timeline, in writing.