Authored By: Ella Bailey
Royal Holloway, University of London
Artificial intelligence is increasingly transforming modern society, with significant implications for the economy, education, healthcare, national defence, and private commercial sectors. As AI systems become more sophisticated and widely integrated into everyday life, concerns over the misuse of AI become prominent. While the benefits of AI feel endless, and have much aspirational qualities around them, the evolving nature of AI opens risk to abuse of such a powerful tool. For this exact reason, many critics, legal experts, and computer scientists, deem it necessary to reconsider the regulatory strength nations have over the uses of technology, specifically AI. In response to these challenges, the European Union (EU) enacted the EU Artificial Intelligence Act (AI Act)[1] with the intention of regulating artificial intelligence (AI), particularly when concerning infringing on citizens fundamental rights. This act ‘takes a risk-based approach to safeguard fundamental rights, democracy, the rule of law, and environmental sustainability.’[2] This act serves as a comprehensive legal framework, horizontally applying across all 27 EU member states. The AI Act represents a significant step towards AI accountability, but the existence of regulation does not automatically guarantee effective accountability. While this is certainly a strong move concerning governing AI, much room is left to discuss whether or not it is stringent enough to sufficiently protect EU citizens and interests.
Background
Over the past five years, AI has boomed, infiltrating healthcare, employment and recruitment, education, law enforcement, financial services, public administration, and social media platforms. Data showing how Nvidia ‘brought in $108bn (£71bn) of revenue during the second quarter, more than double the amount for the same period a year earlier,’[3] demonstrates the extent of growth companies centred on AI are experiencing. Not only does this raise issues for the EU regarding commercial and corporate arenas but similarly the private life of an EU citizen can be impacted greatly by this boom of AI. Evidently, ‘more than a third of all adults across the EU now use AI tools on a regular basis, according to Eurostat data published in December 2025.’[4] AI has moved from being a primarily experimental technology to something that can and has already begun creating real-world consequences. Against this background, the EU’s AI Act emerged as an ambitious attempt to establish a comprehensive system of AI governance.
Citizens Protections under the EU AI Act Framework
The important concern when regulating AI is balancing protective regulations while not diminishing opportunities for growth. Overly restricting the uses of AI could cause EU nations to fall behind their international counterparts, especially in comparison to the titans of AI, the United States and the People’s Republic of China. Nations must play a balancing act in order to ensure their standards for business regulation and human rights are settled fairly alongside the need for economic growth. The EU AI Act ‘aims to ensure that AI systems are: safe, respect fundamental rights, foster AI investments, improve governance, and encourage a harmonized single EU market for AI.’[5]
Under Article 3 of the EU AI Act (EU AIA), AI System is defined as meaning ‘a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predications, content, recommendations, or decisions that can influence physical or virtual environments.’[6] This has been regarded as a ‘broad definition of an AI system… deliberately kept broad to cover the whole spectrum, from simpler technologies and systems focusing on single-use cases to advanced applications of deep learning and generative AI.’[7]
Regarding regulations, the AIA divides ‘AI systems into different risk levels: unacceptable, high, limited, and minimal risk.’[8] The first being completely prohibited, such as systems that are ‘deploying subliminal, manipulative, or deceptive techniques…exploiting vulnerabilities related to age, disabilities, or socio-economic circumstances…[as well as] biometric categorisation systems inferring sensitive attributes… generating non-consensual intimate imagery and child sexual abuse material…social scoring…assessing the risk of an individual committing criminal offenses solely based on profiling…’[9] This is a highly desired step in protecting the fundamental rights of EU citizens from the potential abuses of AI.
However, some critics focus on how real-time biometric identification (RBI) has some leeway under this section. RBI can be understood to involve ‘live capturing, comparison, and identification, whereas post RBI system performs these functions retrospectively.’[10] Under the AIA, ‘this prohibition is not absolute. Article 5(1)(h) of the AIA permits the use of this technology if it is strictly necessary’[11] for public authorities in conducting investigations under a limited scope listed in the act. As some critics from the Verfassungsblog have noted, ‘in ticking-bomb scenario’[12] it may be unreasonable to assume authorities can follow exact procedure outlined in Art 5(1) and (2). ‘As a result, this may legitimise the use of real-time RBI systems to identify individuals who are not formally the object of a criminal investigation… but who have merely been targeted.’[13] Consequently, the protections afforded are not entirely certain that it will protect citizens from unfair use of AI that infringes on their fundamental rights. However, it must be considered that this exception has been created in order to encourage authorities to utilise equipment like RBI in order to effectively carry out investigations as swiftly as possible.
Moving on, the AIA’s high-risk section included regulated AI tools where ‘providers of those systems will be subject to additional requirements.’[14] This section contains two categories: ‘AI systems that are used in products falling under the EU’s product safety legislation [and] AI systems falling into specific areas that will have to be registered in an EU database.’[15] Under this section, ‘deployers of high-risk AI systems who are public authorities – or those acting on their behalf – will be obliged to register the use of the system. They will be required to enter information in the databases such as a summary of the findings of the fundamental rights impact assessment (FRIA)… However, deployers of high-risk AI systems in the private sector area will not be required to register the use of high-risk systems’[16]
A repeated concern over the EU AIA, including the high-risk section, is over the exemptions granted. ‘The major shortcoming of the EU database is that negotiators agreed on a carve-out for law enforcement, migration, asylum and border control authorities… This will prevent affected people, civil society, journalists, watchdog organisations and academics to exercise public scrutiny of these high-stake areas which are prone to fundamental rights violations and hold them accountable.’[17] These carve-outs may breed a culture of secrecy that may encourage misuse of AI.
Military Concerns
One major concern raised from the EU AIA, is the complete lack of regulation over military uses of AI. Arguably one of the most concerning areas for AI adoption, is the potential uses of AI in warfare. Governments must now consider how AI can be used against them to penetrate national security, and how they might utilise AI in military operations in order to improve efficiency and reduce causalities in foreign based operations. ‘In the final stages of the trialogue negotiations, Article 2(3) of the AI Act was established to exclude from its scope “AI systems where and in so far they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purpose, regardless of the type of entity carrying out those activities.” Under Art 4(2) of the Treaty on European Union[18], the EU will ‘respect their essential State functions, including ensuring the territorial integrity of the State, maintaining law and order and safeguarding national security.’[19] This has opened debate over the safety and protections given to citizens who may be impacted, both EU and foreign.
Firstly, military exemptions under the EU AIA recognises that warfare is different from civilian life and that situations involving armed conflict will arise where AI could significantly reduce casualties or improve efficiency. These situations would likely be time pressured, therefore requiring less regulatory paperwork to work through. Exemptions under Art 2(3) AI Act allows for military organisations to develop and deploy technologies quickly. Further, this exemption would respect the EU Member States’ control over their defence, ensuring that the EU does not become too powerful, which has already been the concern of Member States due to EU legal supremacy. A regulation over the Member States’ defence systems would infringe on the political independence Member States and raise concerns as to whether the EU is sui generis or rather a federal union of states.
Many consider this exemption to be ‘the latest chapter in the long history of Member States demarcating their hands-off zone and the Court of Justice for the EU (CJEU) responding with numerous conditions to national security invocations.’[20] Important to note, in ‘La Quadrature du Net (LQdN) ruling of 2020, the Court… clarified that the national security exemption applies solely to purely governmental practices, that is, without engaging any private actor… By disregarding the distinction made by the Court in LQdN between purely governmental action and activities involving private parties, this provision – arguably – goes against the CJEU jurisprudence, which is part of EU primary law, thus overriding the AI Act.’[21] Despite this, the military exemption is understandable legally and practically, but it is potentially problematic ethically due to the gap it creates precisely in the area where AI can have the most serious consequence.
Enforcement
The enforcement framework of the EU AI Act is significant in demonstrating the EU’s attempt to make AI regulation meaningful rather than merely aspirational. Enforcement is ‘shared between the European Commission’s AI Office, the European Data Protection Supervisor, and national competent authorities designated by the Member States… Infringement involving prohibited AI practices are subject to the highest penalties, of up to 35 million (Euro) of 7% of the offender’s total worldwide annual turnover, whichever is higher.’[22] However, the effectiveness of this framework is open to criticism. Enforcement is partly reliant on Member States successfully implementing their own penalties and enforcement practices. This may lead to an inconsistency due to Member States regulatory capacity’s varying across nations. Therefore, the EU AIA can be viewed as having the potential to hold a robust enforcement mechanism but depends upon how effectively this is implemented in each Member State.
Conclusion
In conclusion, the military, defence, and national-security exemptions within the EU AIA present significant tension between the need for effective AI regulation and the practical requirements of national security. On the one hand, the exemptions can be justified because military operations require flexibility and rapid technological deployment, thereby requiring a lower amount of regulation to adapt to sensitive, pressured situations. However, excluding these uses from the AI Act creates a potentially significant gap in accountability, particularly as AI in the military will likely involve some of the most serious and harmful adoptions thought of. Furthermore, the concern is exemplified when considering enforcement. As it operates through a shared governance structure, with national competent authorities responsible for supervising majority of AI systems, there leaves a risk for fragmentation in enforcement. Overall, this Act is a strong move towards protecting citizens and their fundamental rights in the EU from being violated. As well, it is established that the EU AI Act is emerging ‘as the de facto new global standard for AI regulation’[23] which demonstrates the influence this Act will have on other Unions and Nations within the international community. Despite this, there is genuine concern left open regarding military uses of AI in the 27 Member States, and it will be interesting to see how the different States manage using AI alongside international humanitarian law and their own national interests. While some may consider that Article 4 (2) of the TEU: ‘In particular, national security remains the sole responsibility of each Member State’[24] to be a fundamental part of the EU Member States’ independence and sovereignty, others may question if with the advent of AI and increasing global tensions, whether the EU should have a conclusive regulation over the military uses of AI. Regardless of this deficit, it remains a rather strong step towards regulating a very complex area of law and sets a strong example for protecting citizens against the dangers of AI abuse.
BIBLIOGRAPHY
Table of Legislation
Consolidation Version of the Treaty on European Union [2008] OJ C 115/13
Regulation (EU) 2024/1689 (Artificial Intelligence Act) [2024] OJ L 2024/1689
Secondary Sources
Directorate General for Communication, ‘EU AI Act: First Regulation on Artificial Intelligence’ (European Parliament, 2023) https://www.europarl.europa.eu/topics/en/article/20230601STO93804/eu-ai-act-first-regulation-on-artificial-intelligence#ai-act-different-rules-for-different-risk-levels-6 accesses 3 September 2026
EDRi and AI coalition partners, ‘EU’s AI Act Fails to Set Gold Standard for Human Rights’ (EDRi, 2024) https://edri.org/our-work/eu-ai-act-fails-to-set-gold-standard-for-human-rights/ accessed 2 September 2026#
European Commission, ‘The Enforcement Framework of the AI Act’ (2026) https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act accessed 1 September 2026
Future of Life Institute, ‘High-Level Summary of the AI Act’ (2024) https://artificialintelligenceact.eu/high-level-summary/ accessed 2 September 2026
Giannini A and Tas S, ‘AI Act and the Prohibition of Real-Time Biometric Identification’ (Verfassungsblog, 2024) https://verfassungsblog.de/ai-act-and-the-prohibition-of-real-time-biometric-identification/ accessed 5 September 2026
KPMG International, ‘Decoding the EU AI Act’ (KPMG, 2024) https://assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2024/02/decoding-the-eu-ai-act.pdf accessed 3 September 2026
Velasquez F, ‘Nvidia Revenue doubles on continued AI demand’ (BBC, 2026) https://www.bbc.co.uk/news/articles/ce871n7lyvlo accessed 3 September 2026
Vogiatzoglou P, ‘The AI Act National Security Exception, Room for Manoeuvres?’ (Verfassungsblog, 2024) https://verfassungsblog.de/the-ai-act-national-security-exception/ accessed 5 September 2026
[1] EU AI Act (Regulation (EU) 2024/1689)
[2] KPMG International, ‘Decoding the EU AI Act’, KPMG, [2024] <https://assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2024/02/decoding-the-eu-ai-act.pdf> accessed 03/09/26
[3] Francisco Velasquez, ‘Nvidia revenue doubles on continued AI demand’, 2026, BBC, <https://www.bbc.co.uk/news/articles/ce871n7lyvlo> accessed 03/09/26
[4] Ibid
[5] KPMG International, ‘Decoding the EU AI Act’, KPMG, [2024] <https://assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2024/02/decoding-the-eu-ai-act.pdf> accessed 03/09/26
[6] Regulation (EU) 2024/1689 (Artificial Intelligence Act) [2024] OJ L 2024/1689, Art 3
[7] KPMG International, ‘Decoding the EU AI Act’, KPMG, [2024] <https://assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2024/02/decoding-the-eu-ai-act.pdf> accessed 03/09/26
[8] Ibid
[9] Future of Life Institute, ‘High-level summary of the AI Act’, [2024] <https://artificialintelligenceact.eu/high-level-summary/> accessed 02/09/26
[10] Alice Giannini, Sarah Tas, ‘AI Act and the Prohibition of Real-Time Biometric Identification’, Verfassungsblog, [2024] < https://verfassungsblog.de/ai-act-and-the-prohibition-of-real-time-biometric-identification/> accessed 05/09/26
[11] Alice Giannini, Sarah Tas, ‘AI Act and the Prohibition of Real-Time Biometric Identification’, Verfassungsblog, [2024] < https://verfassungsblog.de/ai-act-and-the-prohibition-of-real-time-biometric-identification/> accessed 05/09/26
[12] Ibid
[13] Ibid
[14] Future of Life Institute, ‘High-level summary of the AI Act’, [2024] <https://artificialintelligenceact.eu/high-level-summary/> accessed 02/09/26
[15] Directorate General for Communication, ‘EU AI Act: first regulation on artificial intelligence’, European Parliament, [2023] < https://www.europarl.europa.eu/topics/en/article/20230601STO93804/eu-ai-act-first-regulation-on-artificial-intelligence#ai-act-different-rules-for-different-risk-levels-6> accessed 03/09/26
[16] EDRI and AI coalition partners, ‘EU’s AI Act fails to set gold standard for human rights’, EDRI, [2024] <https://edri.org/our-work/eu-ai-act-fails-to-set-gold-standard-for-human-rights/> accessed 02/09/26
[17] Ibid
[18] Consolidated Version of the Treaty on European Union [2008] OJ C115/13, Art 4(2)
[19] Ibid
[20] Plixavra Vogiatzoglou, ‘The AI Act National Security Exception, Room for manoeuvres?’, Verfassungsblog, [2024] < https://verfassungsblog.de/the-ai-act-national-security-exception/> accessed 05/09/26
[21] Plixavra Vogiatzoglou, ‘The AI Act National Security Exception, Room for manoeuvres?’, Verfassungsblog, [2024] < https://verfassungsblog.de/the-ai-act-national-security-exception/> accessed 05/09/26
[22] European Union, ‘The enforcement framework of the AI Act’, European Commission, [2026] <https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act> accessed 01/09/26
[23] KPMG International, ‘Decoding the EU AI Act’, KPMG, [2024] <https://assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2024/02/decoding-the-eu-ai-act.pdf> accessed 03/09/26
[24] Consolidated Version of the Treaty on European Union [2008] OJ C115/13, Art 4(2)
