EU AI Act

What is the EU AI Act?

It’s the European Union’s first horizontal law on artificial intelligence. As a regulation, it applies directly in every member state without needing national legislation. It covers providers, who develop or sell an AI system, and deployers, who use one in a professional capacity. It can also reach companies outside the EU when their systems are used in the European market.

It doesn’t regulate the technology in the abstract, but how it’s used. The same model can be harmless in a spam filter and high-risk in a recruitment process.

How it works: the risk levels

1. Unacceptable risk (banned). Uses such as social scoring of individuals, manipulation that exploits people’s vulnerabilities, or emotion recognition in workplaces and schools, with limited exceptions.
2. High risk. Systems that shape important decisions about people: employment, education, credit and access to essential services, among others. They require risk management, good-quality data to limit bias, documentation, logging and human oversight.
3. Limited risk (transparency). People must be told they’re interacting with an AI, for example a chatbot or a voice agent, unless it’s obvious. Synthetic content such as deepfakes has to be identified as such.
4. Minimal risk. Most applications, like a spell checker or an email filter, with no new obligations.

On top of that, providers of general-purpose AI models, such as large language models, have their own documentation and copyright obligations. And every organisation using AI should make sure its staff have a sufficient level of AI literacy.

Example

An Irish chain of gyms with branches in Dublin and Cork wants to use AI in two places. First, an assistant that answers calls and books classes. That’s limited risk: the assistant has to say it’s an AI, and personal data remains subject to the GDPR.

Second, a tool that screens CVs for fitness instructors. That falls into the high-risk category: as the deployer, the gym will need to follow the provider’s instructions, assign trained people to oversee it and keep the logs. If in doubt, the sensible move is to get specialist advice.

The EU AI Act at UTIO

UTIO’s customer-facing agents are designed around that transparency framework. The voice agent tells callers at the start that it’s an AI and introduces itself as a virtual assistant: you can adjust the wording of the notice, but not remove it. Recordings, transcripts, the agent’s memory and the CRM are stored in Spain, under a data-processing agreement.

Autonomy is gradual and the agent starts in draft mode, which makes human oversight straightforward from day one. What it can’t replace is your own assessment: how you use AI, and which risk level each use falls into, depends on your business.