The EU AI Act was formally adopted by the European Council on May 21, 2024, following its approval by the European Parliament on March 13, 2024, with the final text published in the Official Journal on July 12, 2024, and officially entering into force on August 1, 2024, with most provisions applying from August 2026. Significance lies less in its novelty, risk-based regulation is familiar in product-safety law than in its timing and constitutional ambition: it treats advanced AI as an internal-market technology that can amplify harms to fundamental rights at scale, and therefore as something that must be governed ex ante rather than merely litigated ex post. The Act responds to a practical dilemma that liberal democracies now face: AI systems can be deployed faster than courts, regulators, and citizens can understand their impacts, yet their outputs increasingly shape access to work, credit, education, public services, and information. In that setting, “move fast and break things” becomes “move fast and break due process,” and the rule of law is placed under pressure precisely where opacity, automation bias, and asymmetries of power already disadvantage individuals. 
The claim of timely enactment is supported by the Act’s staged application schedule, which is designed to make enforceable safeguards arrive in step with the diffusion of technology. The European Commission summarises the timeline as follows: the AI Act entered into force on 1 August 2024, with a general two-year runway to full applicability by 2 August 2026, while key pieces apply earlier or later depending on risk. Most notably, prohibitions on “unacceptable risk” practices took effect from 2 February 2025; governance rules and obligations for general-purpose AI models (GPAI) applied from 2 August 2025; and some high-risk rules embedded in regulated products extend to 2 August 2027. This sequencing matters: it prioritises the fastest intervention where the democratic cost of delay is highest (bans and baseline literacy), while giving industry and regulators time to operationalise standards, conformity assessment, and oversight capacity. 
As a regulatory instrument, the Act’s usefulness lies in how it translates broad rights (privacy, non-discrimination, effective remedy) into auditable duties across the AI lifecycle. It defines four risk tiers and attaches concrete obligations to the “high-risk” tier, including risk management, data governance, logging/traceability, technical documentation, transparency to deployers, human oversight, robustness, and cybersecurity, so that accountability is not left to after-the-fact explanations or voluntary ethics statements. It also directly targets classes of misuse that corrode civic equality, such as social scoring, specific biometric categorisation, and remote biometric identification for law enforcement in public spaces (subject to narrow conditions), while imposing transparency requirements for systems that interact with people or generate synthetic content (including labelling expectations for deepfakes and certain public-interest communications). The through-line is that the market may innovate, but it may not externalise harms onto individuals’ dignity, autonomy, and legal protections. 
Recent controversies around xAI’s Grok illustrate why this kind of framework is not bureaucratic “red tape” but a defensive infrastructure for human rights. On 3 February 2026, reporting described the UK data-protection regulator, the Information Commissioner’s Office, opening a formal investigation into Grok, linked to concerns about personal data processing and the generation of harmful sexualised imagery, including non-consensual and child-related content.  In parallel, the UK communications regulator Ofcom has been examining X’s compliance with online-safety duties and has indicated that it is still seeking answers about the risks posed by the standalone Grok service and is considering further investigation into pornographic content and age checks.  Meanwhile, French authorities have pursued related allegations concerning illegal content and deepfakes.  Even before liability is determined, the pattern is clear: generative models can be repurposed into scalable tools for privacy invasion, sexual exploitation, and informational harm, precisely the domains where democratic states have a heightened duty to protect individuals and ensure effective remedies.
For the UK, these developments sharpen the case for moving from a largely principles-led, regulator-by-regulator posture to a single, coherent, AI-specific statute with explicit prohibitions, high-risk controls, transparency duties, and enforceable governance comparable to the EU AI Act. Commentators tracking UK policy note that the UK has so far preferred a sector-based approach, anchored in the 2023 AI Regulation White Paper, rather than a dedicated AI law. Yet Grok’s alleged misuse demonstrates how cross-cutting generative-AI risks fall between silos: data protection, online safety, consumer protection, equality law, and criminal law each address fragments of the harm, but none alone supplies the lifecycle obligations, model/provider accountability, and risk-tiered duties needed for prevention at scale. Matching the EU model would not mean copying it uncritically; it would mean adopting the core constitutional insight that AI governance must be designed to protect the rule of law, privacy, and human rights against rapid, opaque, and commercially incentivised automation. In a moment when public institutions and civic trust can be destabilised by synthetic media and automated decision systems, the ethical “floor” cannot be optional, and the legal “ceiling” cannot be perpetually postponed.
US Institute of Diplomacy and Human RightsCentre for Human Rights and Democracy in AfricaUnited NationsHuman Rights WatchAfrican Committee of Experts on the Rights and Welfare of the ChildAfrican UnionInstitute for Human Rights and Development in Africa (IHRDA)African Court on Human and Peoples’ RightsUnited Nations Human RightsUnited States Institute of PeaceEuropean Convention on Human RightsAmnesty International UKUK House of CommonsUK House of LordsSky News
Dr Nelson A. Agbor
Certified Human Rights Consultant
V. Lecturer @Birmingham City University.
