VIP Deep Dive: The EU AI Act at Year One — What's Working, What's Not, and What Comes Next

One year after the EU AI Act came into force, the world's most comprehensive AI regulation is no longer a theoretical exercise. It is reshaping product roadmaps, hiring decisions, and capital allocation across the European tech industry. The early results are mixed: the law has accelerated compliance investment and pushed risky applications off the market, but it has also created loopholes that sophisticated actors are already exploiting.

What Was Supposed to Happen

The AI Act was designed around a risk-tier framework. Unacceptable-risk systems — social scoring, subliminal manipulation, real-time biometric surveillance in public spaces — were banned outright. High-risk systems — AI in healthcare, finance, education, criminal justice, employment — required documentation, testing, human oversight, and conformity assessments. Limited-risk systems needed disclosure. Minimal-risk systems faced few obligations.

The enforcement machinery was supposed to ramp up in parallel, with national authorities in all 27 member states hiring AI specialists, setting up oversight bodies, and standing up conformity-assessment infrastructure.