Modified
The EU AI Act
The AI Act is the EU law on artificial intelligence. The AI Act sorts AI by risk: the most dangerous AI is banned, high-risk AI must meet strict requirements, and AI such as chatbots must be open about being AI. The law entered into force on 1 August 2024 and applies directly in Sweden and across the EU.
- Unacceptable riskBannedsocial scoring, manipulation
- High riskStrict requirementshiring, education, credit
- Limited riskTransparency dutieschatbots, deepfakes
- Minimal riskNo new requirementsspam filters, games
What is the AI Act?
The AI Act is Regulation (EU) 2024/1689 and the world's first broad law on AI. An EU regulation applies directly in every member state, without each parliament passing its own law. The law covers anyone who develops, sells or uses AI systems in the EU, including companies outside the EU, such as OpenAI and Google, when their AI is used here.
The aim is for AI to be safe and respect people's rights without stopping useful AI. So the requirements depend on how large the risk is, not on which technology is used.
What risk levels does the AI Act have?
The AI Act has four risk levels:
Unacceptable risk: banned
Banned AI includes social scoring of people, AI that manipulates people into decisions that harm them, scraping face images from the internet to build face databases, and AI that reads emotions at work and in schools. The bans have applied since 2 February 2025.
High risk: strict requirements
High-risk AI is AI that can affect people's lives, health or rights, for example AI that sorts job applicants, assesses pupils, decides who gets a loan or is used by the police. Such AI must have risk management, good data, documentation and human oversight, among other things.
Limited risk: transparency duties
Limited-risk AI includes chatbots and AI that creates images, sound and video. A chatbot must say that it is an AI, and AI-generated content and deepfakes must be labelled.
Minimal risk: no new requirements
Most AI systems are minimal risk, such as spam filters, recommendations and AI in games. For them the AI Act sets no new requirements.
When does the AI Act apply?
The AI Act applies in stages. The EU changed the timetable through the digital omnibus, Regulation (EU) 2026/1744, which entered into force on 27 July 2026: the high-risk requirements moved from August 2026 to December 2027 and August 2028.
- The AI Act enters into force.In force
- Banned AI becomes illegal, and the AI literacy duty starts.In force
- Rules for large AI models, such as those behind ChatGPT and Claude.In force
- Most of the Act applies, including the duty to say when you are talking to an AI.In force
- AI-generated content must be marked also from systems already on the market, and new bans on AI that makes sexual images without consent.
- Requirements for high-risk AI in areas such as hiring and education (moved from August 2026).
- Requirements for AI in regulated products, such as medical devices and machinery.
What does the AI Act mean for me?
If you use ChatGPT, Claude or Gemini privately, the AI Act mainly means you are told more: an AI must say that it is an AI, and images, sound and video made by AI should be labelled. You get no new duties.
For employers and companies that use AI, the AI Act requires AI literacy: whoever uses AI in their organisation must take measures to support the AI literacy of its staff. Since the 2026 amendment, the law requires no particular level from each person. Anyone using high-risk AI, for example to sort job applications, gets more duties from December 2027.
What happens if you break the AI Act?
Fines for using banned AI are up to 35 million euros or 7 percent of a company's global annual turnover, whichever is higher, under Article 99 of the AI Act. Other breaches carry lower fines. For small companies the lower of the amounts applies.
Who supervises the AI Act in Sweden?
Supervision in Sweden was examined by the AI inquiry, which reported in October 2025. The inquiry proposes that the Swedish Post and Telecom Authority (PTS) takes the main responsibility, and that the Authority for Privacy Protection (IMY) and Finansinspektionen share responsibility for high-risk AI. PTS is also proposed to run a regulatory sandbox where companies can test AI with support from the authorities.
The AI Act and GDPR
The AI Act and GDPR apply at the same time and do not replace each other. GDPR protects personal data, whether or not AI handles it. The AI Act regulates the AI system itself: how risky it is and what it may do. An AI that sorts job applications must follow both GDPR and the high-risk requirements.
Common questions about the AI Act
What is the difference between the AI Act and AI-förordningen?
The AI Act and AI-förordningen are the same law. AI Act is the English name, AI-förordningen the Swedish one, and the formal name is Regulation (EU) 2024/1689.
Does the AI Act apply to ChatGPT?
The AI Act applies to ChatGPT. The models behind ChatGPT have been covered by the rules for large AI models since August 2025, and ChatGPT as a chatbot must be open about being an AI.
Does my company have to train staff in AI?
A company that uses AI must, under Article 4, take measures to support the AI literacy of staff working with the AI, adapted to how the AI is used. The law requires no particular course, and since the amendment by Regulation (EU) 2026/1744 no particular level from each person either. A free AI course like Agentakademin is one way to start.
Is the AI Act a law in Sweden?
The AI Act applies as law in Sweden, because an EU regulation applies directly in every member state. Sweden only needs supplementary rules, for example on which authorities supervise.
Read next
Sources: EUR-Lex: the AI Act · Omnibus 2026/1744 · Government: AI inquiry · European Commission: AI Act