EU AI Act

The EU AI Act is a regulatory framework from the European Union that classifies AI systems by risk level (unacceptable, high, limited, minimal) and imposes obligations on providers and deployers. For operators running local AI, the Act matters because it may require documentation, transparency, or risk assessments for models used in high-risk applications (e.g., hiring, credit scoring) — even if the model runs locally. Open-source models are not automatically exempt; obligations depend on how the model is placed on the market or used in practice.

The EU AI Act, adopted in 2024, is the first comprehensive AI law. It uses a risk-based approach: unacceptable risk (e.g., social scoring) is banned; high-risk systems (e.g., in critical infrastructure, law enforcement) must meet conformity assessments, risk management, and human oversight requirements; limited risk (e.g., chatbots) requires transparency; minimal risk is unregulated. For local AI operators, the key nuance is that the Act targets the 'provider' (who develops or places the model on the market) and the 'deployer' (who uses it in a professional context). A hobbyist running Llama 3.1 locally for personal use likely falls under minimal risk. But a small business deploying a local model for resume screening may be a high-risk deployer and must comply with documentation and logging obligations. Open-source models are subject to lighter rules unless they are used as components in high-risk systems. The Act also includes rules for general-purpose AI models (like large language models), requiring transparency reports and risk mitigation for systemic risks.

An operator runs a local LLM (e.g., Mistral 7B via Ollama) to automate customer support for a small EU-based e-commerce store. Under the EU AI Act, this is likely limited risk (chatbot) — the operator must inform users they are interacting with AI. If the same operator uses a local model to screen job applications, that is high-risk, requiring a risk assessment, logging of inputs/outputs, and possibly a conformity assessment. The operator would need to document the model's intended purpose, training data, and performance metrics.

When using Hugging Face Transformers or Ollama for a commercial application in the EU, the operator should first classify the use case per the Act's risk categories. For high-risk use, the workflow must include: (1) documenting the model's capabilities and limitations, (2) implementing logging (e.g., saving prompts and outputs with timestamps), (3) ensuring human oversight (e.g., a review queue for critical decisions). Tools like the EU AI Act Compliance Checker (from the EU Commission) can guide the process. For open-source models, the operator should check the model card for any provider-declared intended uses.