EU Approves New AI Rules for Online Services

The European Parliament approved with a wide majority a new regulation establishing specific obligations for the use of artificial intelligence in online services operating within the European Union's territory. The text, which enters into force in phases until 2028, complements the AI Act approved in 2024 with more detailed rules for consumer platforms, social networks, digital marketplaces, and automated recommendation services.

What the Regulation Requires

The main obligations affect AI systems classified as high-risk when applied to services with more than ten million monthly users in the EU. These systems will need to undergo independent technical auditing before any significant model update, maintain logs of automated decisions for at least 24 months, and offer a human-in-the-loop contestation mechanism for decisions that affect user rights — such as account suspension, content moderation, and denial of service access.

For recommendation systems, the regulation requires transparency about the criteria that determine which content is promoted, with an option to disable algorithmic personalization. E-commerce platforms that use AI for dynamic pricing must disclose when a price was algorithmically generated and offer the consumer the non-optimized base price.

Impact for Brazilian Companies

Brazilian companies operating in Europe or processing data from European citizens — which includes e-commerce platforms, fintechs, and SaaS with EU clients — will need to adapt their AI systems to the new regulation or risk fines of up to 3% of global annual revenue. Legal consultancies specializing in digital law already report a significant increase in demand for compliance analysis. The deadline for adapting the highest-risk categories ends in July 2027.