The EU AI Act and what it means for Pakistan

Three ways to see it

1. 1

   The EU AI Act came into force in August 2024, with most obligations becoming binding in stages through 2025 and 2026. It is the world's first horizontal AI law. Its design idea is risk tiering. Every AI system sold or operated in the EU is sorted into one of four buckets: prohibited, high-risk, limited-risk, and minimal-risk. Each bucket has its own obligations. General-purpose AI models, the foundation models like GPT-class systems, sit in a fifth track with their own rules. Pakistan is not in the EU, but Pakistani exporters and BPOs serving EU customers are inside the scope.

2. 2

   Way one to read the Act: by what it bans outright. Real-time biometric surveillance of public spaces by law enforcement (with narrow exceptions). Social scoring of citizens by public bodies. Manipulation of vulnerable groups in ways that cause harm. Untargeted scraping of facial images from the internet to build recognition databases. Emotion recognition in workplaces and schools. These prohibitions reflect a European bet that some AI use cases damage democracy faster than they help. Pakistani projects copying these patterns directly will be excluded from EU markets and increasingly from Gulf markets that follow the EU line.

3. 3

   Way two: by what counts as high-risk. Annex III of the Act lists the high-risk areas: critical infrastructure, education and vocational training, employment and worker management, access to essential services, law enforcement, migration and border control, administration of justice, and democratic processes. For systems in these areas, providers must run a conformity assessment, maintain a risk management system, ensure data governance, keep technical documentation, log usage, ensure transparency and human oversight, and meet accuracy and cybersecurity standards. A Pakistani fintech selling credit-scoring AI to a German neobank lands here.

The why-tree

Try this with Claude

AI-edge prompt to try: 'Acting as an EU AI Act notified body auditor, ask me 10 probing questions to decide whether the AI system I describe is high-risk under Annex III. After my answers, give a verdict with citations to specific Annex III categories.' Treat the answer as a draft, not gospel.