A law for AI and for the real world

The European Union’s Artificial Intelligence Act (AI Act) is the world’s first sweeping legal framework regulating how AI systems are developed and used. It sets rules based on different risk levels, ranging from minimally regulated to entirely prohibited practices like AI-driven social scoring or emotion-monitoring at work.

Key Dates & Compliance Timeline

• 1^st August 2024 – Entry into force. The law was published on the 12th July and became official on 1st August 2024.

• 2^nd February 2025 – First enforcement wave. At this point:

  • Bans on prohibited AI systems kick in (e.g., employee emotion monitoring, manipulative ‘dark pattern’ websites, biometric profiling).

  • AI literacy obligations start: organisations must ensure staff and partners are trained in ethical, legal, and safe AI practices.

• 2^nd August 2025 – Rules on GPAI and governance begin. General‑Purpose AI (GPAI) models such as ChatGPT and Siri must comply with transparency and safety requirements like sharing training data summaries, documentation, and incident reporting. Member States also establish regulatory bodies; confidentiality and penalty rules activate.

• 2^nd August 2026 – Full enforcement starts. All remaining AI regulations, especially for high-risk systems, become fully applicable. Rules around prohibited AI also become more strictly applied through guidelines on misuse by employers, police, and online platforms.

• By mid‑2027 – Final phases apply. Particularly for high-risk systems embedded in products; full conformity assessments and surveillance requirements will likely be in force.

  
  

What the Act Covers

• Scope & reach: The AI Act applies to any organisation (developer, deployer, importer, distributor) whose AI systems affect individuals in the EU. Importantly, it applies even if the company is based outside the EU.

• Risk-based approach:

  • Prohibited AI: Systems that manipulate emotions, enable social scoring, or are used for discriminatory biometric surveillance are banned.

  • High-risk AI: Includes safety‑critical systems like driverless cars or medical diagnostics. These require conformity assessments and ongoing monitoring.

  • Limited transparency: AI that generates content must be labelled so users know it’s AI-generated.

  • Minimal risk: Routine, non‑critical systems are largely unregulated.

  • GPAI-specific rules: General-purpose AI systems must disclose training data, support downstream compliance, and report serious risks, especially if they pose systemic threats.

    
    

Impact on UK Companies

• Extraterrestrial reach: UK firms must comply if their AI affects the EU market, regardless of Brexit.

• Risk of fines:

  • Up to 7% of global turnover or €35 million for banned AI.

  • Up to 3% or €15 million for transparency/high-risk violations.

  • Up to 1.5% or €7.5 million for incorrect information.

• Governance burden: UK companies may need new processes such as risk assessments, documentation, staff training, transparency labels, and resource allocation to manage conformity and regulatory filings.

• Strategic advantage: Early compliance (investing in AI governance and aligning with EU rules now) can offer reputational and operational benefits.

• Broader influence on UK law: The EU AI Act is spurring UK policy discussions. It’s nudging changes in data protection, consumer rights, equality, and emerging digital regulation. The UK may align or diverge, but pressure to keep pace is growing.

  
  

Popcorn Learning Agency Knows AI and Compliance

At Popcorn Learning Agency, we combine digital learning content with a deep understanding of emerging regulations. We’ve seen how fear of compliance can stifle innovation. That’s why we stand ready to help UK organisations embed AI literacy training and governance practices effectively, making compliance both strategic and empowering.

In Summary

• The EU AI Act is in force from 1^st August 2024, but takes effect in stages through 2025–2027.

• It covers all AI systems serving EU citizens - even by UK firms.

• It uses a risk-based model: banned practices, high-risk oversight, transparency mandates, GPAI rules.

• Non-compliance risks heavy fines - up to 7% of global turnover.

• UK companies need smart governance, documentation, trained staff, and strategic readiness.

• Popcorn can guide you through this, both legally safe and creatively engaging.