Does the EU AI Act Apply to “Old” AI Systems?
As the discussion around artificial intelligence (AI) regulation intensifies, a pressing question emerges: What happens to AI systems that were built and deployed before the EU AI Act enters into force? The short answer is that the Act is generally not retroactive, but important exceptions and transitional obligations exist.
The Non-Retroactivity Principle
The AI Act is not retroactive, meaning that:
- AI systems placed on the market or put into service before 2 August 2025 are largely exempt from the Act’s new obligations.
- However, this exemption does not apply to certain prohibited AI practices under Article 5 of the Act.
Key Prohibited Practices Affecting All AI Systems
Regardless of when the AI system was deployed, the following uses are banned and must be phased out:
- Social scoring by governments
- Real-time biometric identification in public spaces (with limited exceptions)
- Exploitative manipulation of vulnerable groups
- Dark pattern AI designed to materially distort user behavior
Any legacy AI falling under these categories must be immediately remediated or discontinued.
Important Transition Dates & Compliance Triggers
When Do Legacy AI Systems Have to Comply?
1. Substantial Modification
If an AI system placed on the market before 2 August 2025 is substantially modified after 2 August 2026, it is treated as a new system and must comply fully with the AI Act.
- Substantial modification refers to significant changes to design, functionality, or intended purpose (see Article 3(23), Recital 177).
- The party performing the modification could be considered a quasi-provider and thus take on legal obligations.
2. Special Rules for General-Purpose AI Models (GPAI)
For foundation models like GPT, LLaMA, and similar systems:
- Models already on the market before 2 August 2025 must comply with certain transparency, risk management, and copyright obligations starting 2 August 2027.
- This transition period allows for auditing, policy updates, and implementation of safeguards against systemic risks.
3. Public Sector High-Risk AI Systems
Public authorities using high-risk AI systems deployed before 2 August 2025 have until 2 August 2030 to ensure full compliance.
- The AI Act acknowledges the complexity and budget cycles of public administrations.
- Providers and deployers in this space must retrofit, replace, or decommission older AI to meet requirements by this deadline.
4. Special Consideration: Large-Scale European Information Systems
Legacy AI systems used in critical EU public infrastructures (under Annex X, e.g., Schengen Information System, Eurodac):
- Exempt only temporarily if deployed before 2 August 2027.
- Any substantial modification triggers compliance immediately.
- New deployments after this date must comply fully from the outset.
Summary: AI Act Applicability to Legacy AI
While the AI Act generally exempts legacy AI systems from most new obligations, non-compliance, especially related to prohibited practices or high-risk AI, can lead to substantial fines under Article 99. These penalties can reach up to €35 million or 7% of global annual turnover.
Importantly, the AI Act is not intended to hinder technological progress. Instead, it reflects the EU’s commitment to strike a balance between innovation and the protection of fundamental rights and critical infrastructure.
Effective AI Governance
Effective AI governance begins with proactive readiness. Organizations should first identify their most opaque or high-impact AI systems, those where risks and uncertainties converge, and prioritize these. From there, building a structured, risk-based AI management approach becomes not just a regulatory necessity but a strategic advantage.
