June 25 -- a date that will profoundly reshape the global AI industry landscape.

After four years of legislative wrangling, dozens of rounds of revisions, and countless stakeholder lobbying efforts, the EU AI Act officially moves from the legislative phase to enforcement. This isn't a recommendation document, not an industry self-regulation framework -- it's law: hard rules with teeth, fines, and enforcement agencies. Any company wanting to provide AI services in the EU's 450-million-person market must take this seriously starting today.

This is the world's first comprehensive AI legislation, and by far the strictest AI regulatory framework to date. Its impact won't stop at Europe's borders -- just as GDPR became the de facto global standard for privacy protection, the EU AI Act is likely to define the basic paradigm of global AI governance for the next decade.

Four-Tier Risk Classification: The Core Logic

The EU AI Act's central design is classifying all AI applications into four tiers based on the potential risk to user rights and safety:

Tier 1: Unacceptable Risk -- outright banned. Includes: subliminal manipulation techniques targeting vulnerable groups (e.g., children, the elderly), social scoring systems (differential treatment based on predicted behavior), real-time remote biometric identification (indiscriminate facial recognition surveillance in public spaces), and certain applications using AI for emotion recognition and political orientation inference. These AI systems are completely illegal within the EU; deploying them is a crime.

Tier 2: High Risk -- strict compliance required. This is the largest and most detailed section of the Act. Domains include: medical diagnosis, educational assessment (e.g., AI grading systems), recruitment screening, credit evaluation, law enforcement prediction, border control, and judicial decision support. These AI systems must meet a stringent set of requirements: training data quality audits, complete technical documentation, explainability standards, human oversight mechanisms, pre-deployment conformity assessments, and post-market continuous monitoring. Providers of high-risk AI bear legal responsibility for the system's output.

Tier 3: Limited Risk -- transparency obligations. Primarily covers Deepfake content, AI-generated text/images/video, AI chatbots, and the like. These applications aren't banned, but must clearly inform users that "you are interacting with AI" or "this is AI-generated content." An AI face-swap video you see on Douyin or an AI-synthesized image in the news -- if unlabeled, it's illegal in the EU.

Tier 4: Minimal Risk -- free to use. Spam filters, AI game NPCs, video recommendation algorithms, and other applications with minimal impact on user rights are left unregulated; companies can use them freely.

Special Provisions for General-Purpose AI Models

The most controversial section of the Act -- and the one with the biggest impact on large model companies -- is the dedicated provisions for "General-Purpose AI Models" (GPAI). GPT, Claude, Gemini, Doubao, Tongyi Qianwen -- these foundation models that can perform multiple tasks and are widely called by downstream applications are classified in a separate category with additional obligations.

Specific requirements include: providing a training data summary (disclosing training data sources and composition, addressing copyright concerns); complying with EU copyright law (respecting rightsholders' opt-out rights); conducting red-teaming (systematically testing model safety and adversarial risks); publishing transparency reports (disclosing model capability boundaries, known risks, and mitigation measures); and if model capabilities reach "systemic risk" level (typically frontier models with massive parameter counts and broad impact), additional systemic risk assessments, incident reporting, and cybersecurity safeguards are required.

These requirements sound simple on paper, but each one carries real monetary cost. Training data summaries mean you can no longer be "closed-source + no explanation of training data"; red-teaming requires dedicated security teams with ongoing investment; transparency reports require establishing regular disclosure mechanisms -- these compliance tasks are manageable operating costs for large companies like OpenAI and Google, but can be an insurmountable barrier for small companies and startups.

Fine Levels: Harsher Than GDPR

The Act's fine levels demonstrate the EU's resolve.

Violating the ban on prohibited AI applications carries a maximum fine of 6% of global annual turnover; non-compliance for high-risk AI carries up to 4%; providing false information or failing to cooperate with regulators carries up to 2%. For comparison, GDPR's maximum fine is 4% of global annual turnover -- the AI Act is 50% higher than the famously strict GDPR.

What does 6% look like? If a company has $100 billion in global annual revenue, 6% is $6 billion. That number is enough to keep any company's legal team up at night.

Impact on Chinese AI Companies

Enforcement of the EU AI Act creates a substantial compliance barrier for Chinese AI companies expanding into Europe.

Doubao, Tongyi Qianwen, Kimi, Wenxin Yiyan, DeepSeek -- these Chinese large models that have achieved leading positions domestically must all meet the full compliance requirements for general-purpose AI models if they want to offer services in the European market. This isn't as simple as "adding a privacy policy page"; it involves deep transformations including training data copyright audits, model safety assessments, cross-border data transfer compliance, and EU user data localization.

AI startups going global need to factor compliance costs in from day one. The traditional Chinese internet company playbook of "launch first, grow users first, fix compliance later" won't work in the AI era -- because non-compliant AI products simply can't legally launch in the EU, and a violation carries a 6% global revenue ticket with no "develop first, regulate later" grace period.

But within the challenge lies opportunity. Compliance barriers will keep out large numbers of small players, free-riders, and players unwilling to invest in compliance; the European market could instead become a stage for the few large companies capable of doing compliance. ByteDance already proved one thing with TikTok: Chinese companies can absolutely succeed in the European market if they're willing to invest resources in compliance.

It's Not Just the EU

More notably, the EU AI Act isn't an isolated event.

While the US hasn't passed a unified AI act at the federal level, the White House has already imposed safety assessment requirements on high-risk AI through executive orders, and multiple states (notably California and Colorado) are advancing their own AI legislation. China issued the Interim Measures for the Management of Generative AI Services in 2025 and continues to refine supporting rules, with multiple regulations already in force across deep synthesis, algorithmic recommendation, and data security. The UK, Japan, Canada, and South Korea are all accelerating their own AI regulatory frameworks.

Global AI regulation is moving from "wild growth" to "rule of law." The EU played its card first, and by virtue of its 450-million-person unified market, effectively holds the rule-making power -- any AI company wanting to do global business will have to design compliance systems to EU standards, because building a separate product just for Europe is too expensive. This is the so-called "Brussels Effect": EU rules ultimately become global rules.

Regulation Is a Double-Edged Sword

One possibly unpopular view to close: regulation isn't all bad, but overregulation has costs.

On the positive side, compliance barriers will weed out irresponsible players, giving companies with real technical capability and willingness to invest in safety and compliance a healthier competitive environment. User trust in AI will also increase thanks to regulation, which benefits the long-term development of the entire industry. Just as financial regulation didn't kill the finance industry but made it more trustworthy and scalable, AI regulation could play a similar role.

But risks exist too. The EU didn't produce world-class tech companies in either the internet era or the mobile internet era -- one major reason being an over-tendency toward regulation and a conservative attitude toward innovation. If the AI Act is enforced too harshly and compliance costs run too high, the most likely outcome is: Europe becomes a "consumer market" for AI products rather than a "creation market"; the center of AI innovation remains in the US and China; European users enjoy AI services developed by others while paying the extra costs brought by compliance.

Eight years after GDPR, Europe hasn't grown its own Google, Meta, or TikTok -- but European users did get better privacy protection than the rest of the world. Will the AI Act repeat the same story? That question may take five years to answer.

But for Chinese AI companies, rather than debating whether regulation is reasonable, better to prepare in advance -- because the rules are written, and the game has begun.

See you tomorrow.