A Bengaluru Screening Tool Meets Brussels Law
A Bengaluru startup, call it Sieve HR, builds a resume-screening model that ranks job applicants for corporate clients. In 2024 the company signs its first European customer: a logistics firm in Rotterdam that wants Sieve HR's model to shortlist warehouse-management applicants. Nobody on Sieve HR's five-person engineering team has read a line of EU legislation. The servers sit in Mumbai, the company has no EU office, no EU employees, no EU bank account. Nine months later a compliance email arrives citing "Regulation (EU) 2024/1689" and asking for a technical file, a risk-management-system description, and evidence of human-oversight controls before the contract can proceed. The founders' first reaction is that a European law cannot possibly bind an Indian company with no European presence. That reaction is the single most consequential misconception a team building AI for export can hold. Unpacking exactly why it is wrong requires understanding what the EU AI Act regulates, how it decides which systems are dangerous enough to control, and what happens when a company finds out the hard way.
What the Act Actually Regulates
Regulation (EU) 2024/1689, known as the AI Act, entered into force on 1 August 2024 as the first comprehensive, cross-sector AI statute passed by a major regulator. It differs structurally from the EU's other famous export, the GDPR. GDPR imposes largely uniform obligations wherever personal data is processed. The AI Act does the opposite: it is risk-tiered. The same neural network architecture, even the same trained weights, can be unregulated in one deployment and heavily regulated in another, because the Act attaches obligations to what a system does, not to the algorithm that powers it.
Article 3(1) defines an "AI system" deliberately broadly: a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments, operating with some degree of autonomy. That definition covers a logistic-regression credit scorer built in a spreadsheet just as it covers a 500-billion-parameter transformer. Coverage is intentionally technology-neutral. What differentiates a spam filter from a hiring algorithm under this law is not model architecture; it is what happens to a person when the output is used.
The Four-Tier Risk Pyramid
The Act sorts every AI system into one of four tiers, and the tier alone determines the entire compliance burden.
Unacceptable risk (Article 5) is an outright ban with no compliance path: no paperwork, no conformity assessment, no way to sell the system legally in the EU regardless of how well documented it is. The banned list includes social scoring by public authorities, real-time remote biometric identification in public spaces for law enforcement (with narrow carve-outs such as searching for a specific missing child), emotion recognition in workplaces and education institutions, biometric categorisation that infers protected attributes such as race or political opinion, untargeted scraping of facial images to build recognition databases, and subliminal or manipulative techniques that exploit a person's vulnerabilities to cause them harm.
High-risk (Annex III and Annex I, Articles 6 to 49) is the compliance-heavy middle tier. Annex III lists eight sectors: biometrics, management of critical infrastructure, education and vocational training (including admission and assessment scoring), employment and worker management (including resume screening and promotion decisions), access to essential private and public services (credit scoring, insurance risk pricing, emergency dispatch), law enforcement, migration and border control, and administration of justice. Annex I covers AI embedded as a safety component in products already regulated under EU product-safety law, such as medical devices and machinery. Systems in this tier stay legal but must satisfy a full obligations regime before reaching the market.
Limited risk (Article 50) carries a single transparency duty: tell the user they are interacting with AI, or that content is AI-generated. Chatbots and deepfake generators sit here by default, unless the same system also happens to do something from the high-risk or banned lists, in which case the stricter tier governs.
Minimal risk is everything else: spam filters, AI opponents in video games, demand-forecasting models. No obligations attach at all.
Inside the High-Risk Obligations: Articles 9 to 15
Landing in the high-risk tier does not mean a system is banned; it means the provider must satisfy seven substantive articles before placing it on the EU market. Article 9 requires a risk-management system that runs through the entire lifecycle: identify foreseeable risks, test, then re-test after every significant update, not just once at launch. Article 10 governs data governance, requiring training, validation, and testing data to be relevant, representative, and examined for biases that could produce discriminatory outcomes. Article 11 requires technical documentation detailed enough (specified in Annex IV) that a regulator could reconstruct how the system was built and validated. Article 12 mandates automatic logging so that a decision can be traced after the fact. Article 13 requires instructions for deployers clear enough that a non-expert HR manager, for instance, understands the system's capabilities and limitations. Article 14 requires the system to be designed for effective human oversight, meaning a human reviewer must be able to actually understand, and override, an output rather than rubber-stamp it. Article 15 sets accuracy, robustness, and cybersecurity requirements appropriate to the system's purpose.
Before sale, most Annex III systems undergo internal conformity assessment (the provider self-certifies against these articles); certain categories, mainly biometric identification, require third-party assessment by a notified body. A successful assessment allows the CE mark and registration in the EU's public high-risk AI database (Article 71) before the system can be placed on the market.
General-Purpose AI Models and the Systemic-Risk Threshold
Large language models do not fit neatly into the Annex III sector list, because a single foundation model can be fine-tuned into a hiring tool, a chatbot, and a medical-triage assistant simultaneously. Chapter V of the Act (Articles 51 to 56) handles this with a separate, parallel track for General-Purpose AI (GPAI) models, independent of the four-tier pyramid above. Every GPAI provider must maintain technical documentation, publish a summary of the training data used (partly to address copyright concerns), and put a copyright-compliance policy in place under Article 53.
A second, stricter layer applies only to GPAI models classified as carrying "systemic risk." Article 51(2) sets a quantitative trigger: a model is presumed to pose systemic risk when the cumulative compute used to train it exceeds 1025 floating-point operations (FLOPs). Systemic-risk providers must additionally run model evaluations and adversarial ("red-team") testing, track and report serious incidents, maintain cybersecurity protections, and report energy consumption under Article 55.
Ten to the twenty-fifth FLOPs is an abstract number until you actually compute it for a real training run. The standard approximation from Kaplan et al. (2020, "Scaling Laws for Neural Language Models") and used again in Hoffmann et al. (2022, the Chinchilla paper) is that training compute in FLOPs is approximately six times the parameter count times the number of training tokens: C ≈ 6 · N · D. The factor of six comes from counting one forward pass at roughly 2N FLOPs per token and a backward pass at roughly 4N FLOPs per token.
def training_compute_flops(params, tokens):
return 6 * params * tokens
THRESHOLD = 1e25 # Article 51(2) presumption of systemic risk
scenario_A = {"name": "Model A (70B params, 1.4T tokens)", "params": 70e9, "tokens": 1.4e12}
scenario_B = {"name": "Model B (500B params, 15T tokens)", "params": 500e9, "tokens": 15e12}
for s in (scenario_A, scenario_B):
c = training_compute_flops(s["params"], s["tokens"])
flag = "SYSTEMIC RISK" if c >= THRESHOLD else "standard GPAI"
print(f"{s['name']}: C = {c:.3e} FLOPs -> {flag}")Trace it by hand before trusting the printout. Scenario A: 6 × 70×109 × 1.4×1012 = 6 × 98×1021 = 5.88×1023 FLOPs, roughly seventeen times below the threshold. Scenario B: 6 × 500×109 × 15×1012 = 6 × 7,500×1021 = 4.5×1025 FLOPs, above threshold. The code prints exactly:
Model A (70B params, 1.4T tokens): C = 5.880e+23 FLOPs -> standard GPAI
Model B (500B params, 15T tokens): C = 4.500e+25 FLOPs -> SYSTEMIC RISKThe gap between the two scenarios is instructive: a 70-billion-parameter model trained on 1.4 trillion tokens, a genuinely large system by most standards, still sits comfortably under the systemic-risk line. Only training runs at the frontier of publicly known compute budgets cross it, which is precisely the Act's intent: the extra Article 55 obligations target the handful of labs training at the largest scale, not the much larger population of companies fine-tuning or deploying existing open models.
Classifying a System: A Traced Decision Function
The classification logic across all four tiers can be written as a short function, and the order of the checks inside it matters as much as the checks themselves, because Article 5 bans take precedence over everything else.
def classify_eu_ai_act_risk(use_case, sector=None):
PROHIBITED = {
"social_scoring_by_government",
"realtime_remote_biometric_id_public_law_enforcement",
"emotion_recognition_workplace",
"emotion_recognition_education",
"subliminal_manipulation_causing_harm",
"untargeted_facial_scraping",
}
HIGH_RISK_SECTORS = {
"biometrics", "critical_infrastructure", "education_admission",
"employment_screening", "essential_services_credit_scoring",
"law_enforcement_risk_assessment", "migration_asylum_border",
"justice_administration",
}
TRANSPARENCY_ONLY = {
"chatbot_customer_service", "deepfake_generation", "ai_generated_text_publication",
}
if use_case in PROHIBITED:
return "unacceptable_risk (Article 5): banned outright"
if sector in HIGH_RISK_SECTORS:
return "high_risk (Annex III): Articles 9-15 obligations apply"
if use_case in TRANSPARENCY_ONLY:
return "limited_risk (Article 50): disclosure obligation only"
return "minimal_risk: no obligations under the Act"Trace three calls. classify_eu_ai_act_risk("emotion_recognition_workplace") matches the PROHIBITED set on the first condition and returns "unacceptable_risk (Article 5): banned outright" immediately; the sector argument is never even supplied, and would not matter if it were, because the function returns before reaching the sector check. classify_eu_ai_act_risk("resume_screening", sector="employment_screening") fails the PROHIBITED test, but sector matches HIGH_RISK_SECTORS, so it returns "high_risk (Annex III): Articles 9-15 obligations apply": this is Sieve HR's actual product. classify_eu_ai_act_risk("chatbot_customer_service") fails both the prohibited and high-risk-sector checks, matches TRANSPARENCY_ONLY, and returns the Article 50 result.
The Extraterritorial Reach, and Sieve HR's Mistake
Article 2 defines the Act's territorial scope, and it does not mention where a provider is headquartered as the deciding factor. It applies to providers placing an AI system on the EU market or putting it into service in the EU, regardless of where the provider is established, and separately to providers and deployers located in a third country where the output produced by the AI system is used in the Union. Sieve HR is established entirely in India, but its shortlist, an output, is generated for and used by a Rotterdam employer to make an EU hiring decision. That single fact pulls the company inside Article 2(1)(c), the same extraterritorial logic GDPR uses in its own Article 3 for data processing that targets EU residents regardless of where the processor sits.
The common misconception, "this is EU law, so it cannot bind a company with no EU office, no EU staff, and no EU bank account," treats the Act as if it regulated companies. It regulates outputs used in a market. A provider never needs a single euro of EU revenue, a single EU employee, or a single server inside the Union to fall under the obligations; it only needs its system's output to be used there. For any Indian company selling AI-enabled software, services, or decision support to European customers, whether in HR technology, fintech credit scoring, or logistics, the practical consequence is that "we have no EU presence" is not a defense; it is the wrong question. The right question is where the output lands.
Enforcement: How the Fines Actually Compute
Article 99 sets three penalty bands, each expressed as the greater or the lesser of a fixed euro amount and a percentage of the violator's total worldwide annual turnover, depending on company size. Violating an Article 5 prohibited practice carries a fine of up to €35 million or 7% of global turnover, whichever is higher. Non-compliance with most other obligations, including the Article 9-15 high-risk regime and the GPAI provider duties, carries up to €15 million or 3% of turnover, whichever is higher. Supplying incorrect or misleading information to regulators carries up to €7.5 million or 1% of turnover, whichever is higher. Article 99(6) reverses the comparison for small and medium enterprises, including startups: rather than the higher figure, an SME's cap is set at whichever of the two amounts is lower.
Suppose regulators later find that Sieve HR's resume-screening product, correctly classified as high-risk rather than banned, failed to implement an adequate Article 9 risk-management system. That is an "other obligations" violation, the €15 million / 3% band. Sieve HR's parent group reports €40 million in global annual turnover and fewer than 250 staff, so it qualifies as an SME under the EU's SME Recommendation (2003/361), which requires both under 250 employees and turnover at or below €50 million (or balance sheet at or below €43 million). Three percent of €40 million is €1.2 million. Because Sieve HR is an SME, Article 99(6) takes the lower of €15 million and €1.2 million: the exposure caps at €1.2 million, not €15 million.
Now grow the company. If Sieve HR's global turnover later reaches €800 million, it no longer qualifies as an SME under the turnover leg of the test. Three percent of €800 million is €24 million. For a non-SME, Article 99(6) no longer applies; the general rule takes the higher of the two figures, so the cap becomes €24 million, roughly twenty times larger than before, driven entirely by turnover crossing the SME line, not by any change in the underlying violation.
Where Else in the World
The EU AI Act is not the only regulatory answer to the same problem, and the contrast sharpens what makes it distinctive. The United States' NIST AI Risk Management Framework, released in January 2023, is organized around four functions (govern, map, measure, manage) but is voluntary and carries no fines. China's Interim Measures for the Administration of Generative AI Services, effective August 2023, require security assessments and algorithm registration specifically for public-facing generative AI services, a narrower and more sector-specific net than the EU's cross-sector approach. India, as of this writing, has no binding cross-sector AI statute; the Ministry of Electronics and Information Technology has issued non-binding advisories on generative AI content labeling, and a broader Digital India Act remains under public consultation. The practical result for an Indian AI company selling into Europe is that binding, fine-backed AI regulation currently arrives from a foreign jurisdiction before it arrives at home, which is exactly the gap that caught Sieve HR by surprise.
Active Recall
Attempt each question before reading its answer.
1. Evaluate classify_eu_ai_act_risk("realtime_remote_biometric_id_public_law_enforcement", sector="law_enforcement_risk_assessment"). What tier does it return, and why does the sector argument never actually get checked?
2. Sieve HR's Rotterdam client also runs a careers-page chatbot that detects when a jobseeker has mentioned financial anxiety and then uses persuasive dark-pattern design to push a paid "priority review" upsell that provides no real advantage. A junior engineer classifies it as limited-risk because "it's just a chatbot" that discloses it is AI. What is the correct classification, and why is the disclosure irrelevant here?
3. Recompute Scenario B from the FLOP worked example with the token count changed from 15 trillion to 2 trillion, holding parameters at 500 billion. Does the model still cross the systemic-risk threshold, and which Article 55 obligations does the answer add or remove?
4. Suppose Sieve HR's turnover stays at €10 million, comfortably under the €50 million SME ceiling, but headcount grows to 300 employees. Does it still qualify as an SME under Article 99(6)?
5. Using the €40 million turnover and €800 million turnover scenarios from the enforcement section, state both fine caps for the same Article 9 violation and explain what single fact flips which comparison rule (higher-of vs. lower-of) applies.
6. Sieve HR's screening product launches on the EU market in March 2027. Which high-risk obligations are already binding at launch, and is there any grace period left to invoke?
Answers.
1. It returns "unacceptable_risk (Article 5): banned outright". The function's first condition checks use_case in PROHIBITED, and "realtime_remote_biometric_id_public_law_enforcement" is a member of that set, so the function returns on that line before the second condition, which checks sector, is ever reached. This mirrors the actual law: a use case that is banned under Article 5 is never routed into the Annex III high-risk compliance track, no matter what sector it would otherwise fall into.
2. The correct classification is unacceptable risk under Article 5, not limited risk under Article 50. The chatbot is exploiting a stated vulnerability (financial anxiety) through a manipulative design pattern to cause the user economic harm; that is precisely the prohibited practice the Act bans regardless of packaging. Disclosing "I am an AI" satisfies Article 50's transparency duty, but Article 50 never becomes the operative rule here, because Article 5 prohibitions apply first and are absolute; a system cannot disclose its way out of a ban.
3. C = 6 × 500×109 × 2×1012 = 6 × 1,000×1021 = 6×1024 FLOPs, below the 1025 threshold. It no longer counts as systemic risk. The additional Article 55 duties, model evaluation and adversarial testing, serious-incident reporting, cybersecurity protections, and energy-consumption reporting, all drop away. The baseline Article 53 duties (technical documentation, training-data summary, copyright policy) still apply to every GPAI model regardless of scale.
4. No. The EU SME definition (Recommendation 2003/361) requires both fewer than 250 employees and turnover at or below €50 million (or balance sheet at or below €43 million); these are joined by "and," not "or." Three hundred employees fails the staff-count leg outright, regardless of how low turnover is, so Sieve HR would be treated as a large enterprise for Article 99(6) purposes even at €10 million turnover.
5. At €40 million turnover (SME), 3% is €1.2 million, and Article 99(6) takes the lower of €15 million and €1.2 million, so the cap is €1.2 million. At €800 million turnover (not SME, since it exceeds the €50 million ceiling), 3% is €24 million, and the general rule takes the higher of €15 million and €24 million, so the cap is €24 million. The single fact that flips the comparison rule is SME status itself: crossing the turnover ceiling switches "whichever is lower" to "whichever is higher," which is why the cap does not just scale with turnover but jumps in kind.
6. All of them are already binding, with no grace period left. Annex III high-risk obligations (Articles 9-15, conformity assessment, EU database registration) became applicable on 2 August 2026, seven months before the March 2027 launch. Only Annex I "regulated products" systems, AI embedded as a safety component in machinery or medical devices already governed by separate EU product-safety law, get the longer runway to 2 August 2027, timed to align with those sectoral regimes' own review cycles. A software-only Annex III system like Sieve HR's has no such extension.
Think About It
Think about this: How would you explain eu ai act: global regulatory framework for ai systems to a friend who has never seen a computer? What real-world analogy would you use? Imagine you had to build a system using these concepts — what would be your first step? Try this: before moving on, write down three things you learned and one question you still have.