EU AI Act

The EU AI Act (officially Regulation (EU) 2024/1689 on Artificial Intelligence) is the world's first comprehensive legal framework specifically governing artificial intelligence systems. Adopted by the European Parliament in March 2024 and entering into force on 1 August 2024, the Act applies to any organisation that develops, deploys, imports, or distributes AI systems affecting people within the European Union, regardless of where that organisation is headquartered. Its risk-based structure has made it the primary reference point for AI governance discussions globally, influencing regulatory approaches in Malaysia, the United Kingdom, Singapore, and the United States.

Risk-Based Classification

The Act classifies AI systems into four tiers based on the potential harm they may cause.

Unacceptable risk systems are prohibited outright. These include AI that manipulates human behaviour subliminally, exploits vulnerable groups, operates real-time remote biometric identification in public spaces for law enforcement (with limited exceptions), ranks people by social behaviour in the style of social credit systems, and infers emotions in workplace or educational settings. These prohibitions took effect on 2 February 2025.

High-risk systems face the most stringent requirements. They include AI used in critical infrastructure, medical devices, educational assessments, employment screening, credit scoring, biometric identification, migration controls, and administration of justice. Providers must establish risk management systems, ensure high-quality training data, maintain technical documentation, enable human oversight, and register their systems in a public EU database before deployment.

Limited-risk systems, such as chatbots and AI-generated media including deepfakes, must comply with transparency obligations. Users must be informed when they are interacting with an AI system, and AI-generated content must be labelled as such.

Minimal-risk systems — the vast majority of AI applications such as spam filters, AI in video games, and recommendation engines for non-sensitive content — face no mandatory requirements under the Act, though voluntary codes of conduct are encouraged.

General-Purpose AI Models

A distinctive feature of the Act is its treatment of general-purpose AI (GPAI) models — large foundation models that can be adapted to a wide range of tasks. Provisions for GPAI models became applicable on 2 August 2025. All GPAI model providers must maintain technical documentation, provide information to downstream deployers, establish copyright compliance policies, and publish a summary of training data. Models trained on compute exceeding 10^25 floating-point operations — a threshold covering the largest frontier models — face additional systemic-risk obligations including adversarial testing and incident reporting to the European AI Office.

Governance Structure

The Act created the European AI Office within the European Commission, responsible for supervising GPAI models and coordinating enforcement across member states. Each EU country must designate a national competent authority. The Act also establishes an AI Board comprising national authority representatives to support consistent implementation.

Penalties

Non-compliance carries graduated penalties: up to EUR 35 million or 7 percent of global annual turnover for violations involving prohibited AI practices; up to EUR 15 million or 3 percent for violations by providers of high-risk systems; and up to EUR 7.5 million or 1.5 percent for providing incorrect information to authorities.

Compliance Timeline

| Date | Milestone | |------|-----------| | 1 August 2024 | Act enters into force | | 2 February 2025 | Prohibited AI systems rules apply; AI literacy obligations begin | | 2 August 2025 | GPAI model rules apply; governance bodies operational | | 2 August 2026 | High-risk AI systems rules (Annex I) apply | | 2 August 2027 | All remaining provisions, including high-risk embedded systems, apply |

Although Malaysia is not an EU member state, the EU AI Act carries significant implications for Malaysian technology companies, manufacturers, and exporters. Any Malaysian company whose AI systems process data of EU residents, or whose products containing AI are sold in the EU, may fall within the Act's extraterritorial scope. This includes Malaysian electronics manufacturers, financial services firms with EU operations, and software vendors offering SaaS products to European customers.

The Malaysia AI Governance Framework (AIGF), overseen by the National AI Office and MDEC, was developed with awareness of the EU AI Act's structure. Like the EU framework, Malaysia's AIGF adopts a principle-based approach emphasising fairness, accountability, transparency, and human oversight. However, Malaysia's framework is currently voluntary guidance rather than binding regulation, giving Malaysian companies flexibility while they build compliance capabilities.

Bank Negara Malaysia (BNM), through its Risk Management in Technology (RMiT) and Responsible AI framework consultations, has signalled that AI used in credit assessment, fraud detection, and customer interaction within the Malaysian financial sector should meet standards broadly aligned with international norms including EU requirements. Malaysian banks with branches or correspondent relationships in Europe face direct obligations under the EU AI Act for any AI systems deployed in those jurisdictions.

The Securities Commission Malaysia (SC) has similarly referenced international AI governance standards in its fintech regulatory sandbox and digital asset frameworks. Malaysian companies seeking EU market access — particularly in healthcare diagnostics, industrial automation, and HR technology — are advised to conduct AI impact assessments aligned with EU high-risk requirements even before formal enforcement affects them.

Trade bodies such as the Malaysia External Trade Development Corporation (MATRADE) have begun including AI compliance guidance in export advisory services for Malaysian technology companies targeting European markets. MDEC's Global Tech Hub programme, which supports Malaysian companies expanding internationally, has identified EU AI Act readiness as a priority area for its cohorts targeting European partners.

See Also

1. European Parliament. (2024). Regulation (EU) 2024/1689 on Artificial Intelligence. Official Journal of the European Union.
2. Jones Day. (2025). EU AI Act: First Rules Take Effect on Prohibited AI Systems and AI Literacy. Jones Day Insights.
3. European Commission. (2024). High-Level Summary of the AI Act. artificialintelligenceact.eu.
4. Deloitte. (2025). EU AI Act: AI Governance Implications. Deloitte Consulting.