The European Union’s landmark artificial intelligence regulation enters its first enforcement phase on 2 February 2025, requiring organisations to cease deploying prohibited AI systems or face penalties of up to €35 million or 7% of global turnover. Legal experts and industry observers report widespread uncertainty amongst enterprises about compliance requirements, with many firms only now beginning comprehensive system audits.
The EU AI Act, which entered into force in August 2024, establishes a tiered regulatory framework that categorises AI systems by risk level. The February deadline specifically targets prohibited practices, including AI systems that deploy subliminal manipulation, exploit vulnerabilities of specific groups, enable social scoring by public authorities, and facilitate real-time biometric identification in public spaces by law enforcement with limited exceptions.
According to Kennedys Law LLP, organisations must immediately assess whether their current AI deployments fall within prohibited categories and prepare for subsequent compliance waves. The staggered implementation timeline continues through August 2027, when requirements for high-risk AI systems become fully enforceable, creating a 30-month compliance window that legal advisers describe as deceptively brief given the technical complexity involved.
Telefónica has publicly committed to aligning its AI operations with the regulation, whilst telecommunications and financial services sectors face particular scrutiny due to their extensive use of automated decision-making systems. The Act’s extraterritorial scope means non-EU companies deploying AI systems that affect European users must also comply, extending the regulation’s reach to major American and Asian technology firms.
The business impact varies considerably by sector and deployment model. Compliance costs will disproportionately affect small and medium enterprises, according to analysis from Bruegel, which notes that larger technology firms possess existing governance infrastructure that can be adapted more readily. Conversely, SMEs developing specialised AI applications may struggle with the documentation, risk assessment, and ongoing monitoring requirements mandated for high-risk systems.
Providers of general-purpose AI models face their own deadline in August 2025, when transparency obligations take effect. This includes major language model developers who must disclose training data sources, energy consumption metrics, and implement copyright compliance measures. The Guardian reports growing concern amongst AI startups that compliance costs could consolidate market power amongst well-resourced incumbents.
The Bloomsbury Intelligence and Security Institute has highlighted tensions between the Act’s public safety objectives and national security exemptions, particularly regarding law enforcement use of biometric surveillance. The Times notes that several member states are lobbying for broader exemptions to prohibited AI practices, potentially creating enforcement inconsistencies across the single market.
Legal practitioners report that many organisations remain unclear about classification thresholds, particularly the boundary between high-risk and limited-risk systems. A customer service chatbot, for instance, might be considered limited-risk in retail contexts but high-risk if deployed in healthcare settings, triggering substantially different compliance obligations.
The European Commission has published preliminary guidance, but detailed implementing acts and harmonised standards remain under development. This regulatory ambiguity leaves organisations making compliance investments without complete certainty about final requirements, according to legal analysis from Kennedys Law LLP.
Enforcement responsibility falls to national authorities, with the AI Office within the European Commission coordinating oversight of general-purpose AI models. Initial penalties are expected to focus on egregious violations of prohibited practices rather than technical non-compliance with documentation requirements, though this enforcement approach remains untested.
Organisations should monitor three developments: publication of harmonised standards for high-risk AI systems, expected in mid-2025; national authority enforcement priorities, which will emerge through initial cases; and potential amendments addressing general-purpose AI models, where rapid technological development has outpaced the regulation’s original scope.
The February deadline represents the opening phase of Europe’s comprehensive attempt to regulate artificial intelligence based on risk rather than technology type, establishing a template that jurisdictions from California to Singapore are studying closely as they develop their own AI governance frameworks.
