What Ibrahim said
Ibrahim's position, set out in an interview with CNBC on 6 October 2026 and reported by NDTV Profit, has three parts. Rules should be specific to what a system actually does, so that a rule written for a chatbot is not applied unchanged to a medical tool. Safety, responsibility and risk mitigation belong in development from the beginning rather than as a review step at the end. And governance needs more than one actor, because no single organisation can oversee systems that cross borders by design.
On education she made a narrower point. AI in schools should support teachers and help personalise learning, not stand in for the teaching itself.
The EU already regulates by use case
That is roughly how the EU AI Act is built. It does not regulate "AI" as a single technology. It sorts systems by what they are used for. A short list of practices has been banned outright since 2 February 2025, including social scoring by public authorities and certain uses of biometric data in public spaces. Systems used in hiring, credit scoring, education admissions or critical infrastructure fall into the high-risk group, whose duties around documentation, data governance, human oversight and logging apply from 2 December 2027. AI embedded in regulated products such as medical devices is covered under Annex I and follows on 2 August 2028. Most everyday tools, chatbots included, sit in the limited-risk group and face mainly transparency duties. Everything else faces no new requirements.
For someone running a small business in Prague, Berlin or Milan, the practical difference is this: a photo filter and a system that decides who gets a mortgage are not treated as the same thing. The Act assumed that long before Ibrahim gave her interview. Its final text runs to 113 articles and 13 annexes.
Enforcement is no longer theoretical
For five years the argument about AI rules was mostly about wording. That phase has ended. Since 2 August 2026, the AI Office can send formal information requests, run evaluations of general-purpose models, and impose fines. Article 50 transparency duties came into force on the same date: people should be told when they are interacting with an AI system, and synthetic or manipulated content has to be marked as such.
The penalties are not symbolic. Prohibited practices can draw fines of up to €35 million or 7% of worldwide annual turnover, whichever is higher. Other breaches sit at €15 million or 3%, and supplying incorrect information to authorities at €7.5 million or 1%.
The classroom test
Education is one of the areas the Act names directly. AI systems used to decide who is admitted to a school, to evaluate learning outcomes, or to monitor pupils during tests are classed as high risk, and the obligations attached to that category start on 2 December 2027. A teacher using a chatbot to draft a worksheet is not in that category. A system that sorts eleven-year-olds into different school tracks is.
There is a second rule that gets less attention. Article 4 of the Act has required since February 2025 that organisations using AI make sure their staff have enough AI literacy to work with it safely. For a school, the training burden falls on the school as much as on the supplier.
Where DeepMind's position differs
DeepMind's leadership has floated industry-led oversight, with a self-regulatory body backed by government and modelled loosely on how financial regulators work, to handle risks around AGI and national security. Ibrahim's emphasis on application-specific rules points away from one body writing a single global rulebook. Brussels chose a third route: binding law, split by use case, with a central office to enforce it.
Who the rules apply to
Any provider placing an AI system on the EU market is covered, whether it is registered in Dublin, San Francisco or Beijing. Open-weight releases are not automatically exempt. Deployers, meaning the companies and public bodies that use AI rather than build it, carry their own duties when the use is high risk: human oversight, monitoring, and keeping records.
Human oversight only means something if a person actually checks what a model produces. That is the part of the job we cover in AI Arena, running local and cloud models side by side.
Smaller organisations get some relief. The Act offers lighter documentation and simplified quality management for SMEs and start-ups, though the obligations themselves still apply. The lighter paperwork does not change which risk category a system falls into, and that category depends on the use, not on the size of the company.
Does the EU AI Act ban tools like ChatGPT?
No. The ban list covers specific practices such as social scoring by public authorities and some uses of biometric identification. General-purpose chatbots fall into the limited-risk group, where the main duty is telling users they are dealing with a machine.
If a school or a clinic uses an AI tool, who is responsible?
Both sides. The provider must meet the requirements for its risk category and supply the documentation. The deployer, so the school or the clinic, must use the system as intended, keep human oversight, and in high-risk cases monitor it and retain logs.
Has the whole AI Act taken effect yet?
In force now are the ban on prohibited practices and the AI literacy duty, both since February 2025, plus the Article 50 transparency rules and the AI Office's enforcement powers, which took effect on 2 August 2026. The strict obligations for high-risk systems listed in Annex III begin on 2 December 2027; AI embedded in regulated products such as medical devices, covered by Annex I, follows on 2 August 2028, and other parts of the framework are still being implemented. A ninth prohibition, covering AI systems that generate nudification material or child sexual abuse material, applies from December 2026 under the AI Omnibus.
