The European Union’s AI Act, which entered into force on August 1 2024, is fundamentally a piece of product regulation. It does not create individual rights or a private cause of action for citizens. Instead, it imposes duties on those who develop and deploy AI systems in a professional context.
The law treats AI much like other consumer goods: the responsibility lies with the maker to ensure the product is safe before it reaches the user, rather than allowing a person to sue after harm occurs. This mirrors the logic applied to items such as toasters or car brakes, where the expectation is that the product should not be unsafe in the first place.
The Act deliberately excludes several categories from its scope. AI used for military or national security purposes, AI developed purely for research, and any non‑professional use are all exempt. Its focus is therefore on commercial and institutional deployment, where the potential for systemic harm is greatest.
By regulating the product at the point of supply, the legislation aims to address risks before they materialise.
Risk Categories, Obligations and Implementation Timeline
Central to the Act is a risk‑based classification system. There are four main tiers – unacceptable, high, limited and minimal – plus an additional category for general‑purpose AI.
Applications deemed to present an unacceptable risk are prohibited outright. High‑risk AI triggers the most stringent requirements: providers must carry out a conformity assessment, meet security and transparency standards, and be open about the system’s capabilities and limitations. Limited‑risk applications face lighter rules, chiefly transparency obligations, while minimal‑risk AI is subject to no specific obligations under the framework.
This tiered structure is described as a ladder: the higher the potential for harm, the more procedural hoops the provider must navigate. The Act avoids a one‑size‑fits‑all mandate, instead tailoring the burden to the risk profile of each use case.
The provisions will not take effect all at once. They are scheduled to become operative gradually over a period ranging from six to thirty‑six months. This phased rollout is intended to give industry sufficient time to adapt its processes and to allow regulators across the twenty‑seven member states to build the necessary enforcement capacity.
Critics contend that the absence of individual rights and private enforcement means the Act does not go far enough, but its drafters emphasised that the goal was to craft a workable regulatory framework capable of keeping pace with rapid technological change, not to establish a bill of rights. Transparency duties for limited‑risk AI, while not burdensome, require providers to articulate what their systems can and cannot do.
This obligation aims to curb overclaiming and mis‑selling by compelling companies to define the boundaries of their technology clearly. Now that the Act is law, the clock is ticking on implementation. Providers of high‑risk systems will need to begin their conformity assessments soon, and as the phased schedule advances, different sets of obligations will start to apply at different times.
The overall direction is clear: the European Union has opted to regulate AI as a product rather than as a right, a choice that will influence the trajectory of AI development within the bloc for years to come.
{“@context”: “https://schema.org”, “@type”: “NewsArticle”, “headline”: “EU’s New AI Act Regulates Products, Not Individual Citizen Rights”, “description”: “The European Union’s AI Act, which entered into force on August 1 2024, is fundamentally a piece of product regulation. It does not create individual rights or “, “datePublished”: “2026-06-22T09:30:00+00:00”, “author”: {“@type”: “Person”, “name”: “Muhammad Asim”}, “publisher”: {“@type”: “Organization”, “name”: “InfoPulse Today”, “url”: “https://newsfeed.infopulsetoday.com/”}, “image”: “https://infopulsetoday.com/wp-content/uploads/sites/4/rehomed/s24/2026/06/companion_3439.jpg”}
