For the first time, an algorithm has a legal address. Not the abstract "AI ethics" of a corporate slide deck, but a statute with article numbers, fines denominated in euros, and a date it takes effect. The European Union passed the AI Act — a body of rules that attempts something no jurisdiction has tried at continental scale: sort every AI system by how much damage it can do, and force the most dangerous ones to answer to a human being. Whether it succeeds is a separate question. But the attempt alone is already reshaping how the industry has to behave if it wants access to a market of half a billion consumers.

This is not a footnote for lawyers. It is the first time a government has tried to draw a line between "the algorithm helps you" and "the algorithm decides your fate without your knowledge" — and write law around that difference. Here is what it is made of, what it actually bans, and where the cracks are already showing.

A pyramid of risk: the law sorts AI into castes

The heart of the AI Act is not one set of rules for every system, but a four-tier risk pyramid. The logic is simple: the more a system can wreck your life, the harder the requirements bite.

At the top sits unacceptable risk — practices banned outright in the EU, no carve-out for "innovation." This tier covers government social scoring on the Chinese model. Manipulative techniques that bypass a person's conscious choice and cause harm. Untargeted scraping of faces from the internet and CCTV feeds to build facial recognition databases. Emotion recognition in workplaces and schools (with narrow exceptions for medical or safety use). Predictive policing based solely on profiling a person, with no concrete evidence of a crime. The signature moves of a surveillance state, named outright and put outside the law.

Below that: high risk — systems used in lending, hiring, education, healthcare, critical infrastructure, the justice system, migration control. These aren't banned; they're obligated. A conformity assessment before market entry. Documented risk-management practices. Human oversight built in. Registration in a public EU database. This is the same credit-scoring algorithm that decides whether you get a mortgage — now it has a paper trail you can actually demand to see.

Below that: limited risk — chatbots and content generators have to tell you you're not talking to a human. Deepfakes and synthetic images must be labeled as such. This is a transparency floor, not a ban — an obligation not to lie by default.

And at the base: minimal risk — the overwhelming majority of AI systems, from spam filters to movie recommendations, remain unregulated entirely.

The second front: general-purpose models

The AI Act was drafted when the industry still thought in terms of specific applications — "AI for credit scoring," "AI for hiring." Then large language models arrived, and it turned out one model could do everything at once. The law caught up with an amendment: general-purpose AI (GPAI) models — the engines under the hood of ChatGPT, Gemini, Claude, Llama — got their own regime.

The baseline requirement is transparency: technical documentation, a summary of training data, copyright compliance. But for models carrying so-called "systemic risk" — a threshold set by training compute, roughly 10^25 floating-point operations, meaning models at the frontier of what's currently on the market — the requirements sharpen: systemic-risk assessment and mitigation, incident reporting, cybersecurity. Oversight of this layer runs through a newly created AI Office inside the European Commission — an institution that has yet to prove it has the resources to go toe-to-toe with trillion-dollar companies.

Our record. In the Hall of Two Truths, the heart is weighed against the feather — but the point isn't the Scales themselves, it's that the weighing happens in the open, with someone who can name the weights. The AI Act is the first attempt to build such scales for algorithmic power at the scale of a state, not a corporate press release. This isn't Maat itself — the law can still collapse into empty geometry if enforcement is weak. But it's a step away from a Shadow Thoth that persuades through silence and omission, toward a demand: name what you built, and show how it decides.

Timelines, money, and the long arm of the law

The AI Act entered into force on August 1, 2024, but it doesn't apply all at once — it phases in, and the phasing is itself a story. The ban on unacceptable practices took effect in February 2025. Obligations for general-purpose models followed in August 2025. The bulk of requirements for high-risk systems land in August 2026. Certain systems embedded in regulated products — medical devices, for instance — get a reprieve until August 2027. Three years from signature to full effect is enough time for an industry to both prepare and lobby for softer edges.

The fines are designed to hurt even the giants: up to €35 million or 7% of global annual turnover, whichever is higher, for banned practices. Up to €15 million or 3% of turnover for other violations, including breaches of general-purpose model obligations. For a company the size of Meta or Google, 7% of turnover isn't a fine — it's a bill in the billions.

And like GDPR before it, this law doesn't stay inside European borders. If you place an AI system on the EU market, or its output gets used in the EU, the rules reach you regardless of where your servers sit. It's the same Brussels Effect: the continent that writes the law exports it de facto to the rest of the world, because rebuilding a product for every jurisdiction is more expensive than meeting the strictest standard everywhere at once.

The cracks are already showing

The law passed — but the fight over what it actually becomes in practice hasn't ended; it's just starting. Major players are pushing openly for softer terms: by some reports, companies including Meta delayed releasing certain multimodal models in the EU, citing regulatory uncertainty. By late 2025, the European Commission introduced a so-called "digital omnibus" package — a proposal to simplify and partly delay a number of AI Act and adjacent data-law requirements, officially in the name of keeping European business competitive against the US and China. How that lands is not yet settled.

Worth being honest here: model complexity is a genuine technical problem, not just an excuse. Extracting a faithful explanation of why a modern large model produced a specific output is an open research question, not simply a matter of developer goodwill. But it's equally true that complaints about "overregulation" are loudest from exactly the parties who benefit most from staying opaque. A law with no enforcement teeth curdles into a compliance ritual — checkboxes on a form instead of an actual weighing. The AI Office is still standing itself up, case law from the first enforcement actions hasn't accumulated yet, and the industry's lobbying budget isn't measured in euros so much as in orders of magnitude of them.

That's where the real fight is happening — not in the text of the regulation, which is already settled, but in who writes the implementing rules, who sits on the oversight body, and whether that body has the nerve to hand down the first genuinely large fine. The law gave you the right to ask a system why it decided what it decided. Asking is still on you — no regulation does that part for you.