AI regulation in Israel and Europe: a legal guide for high-tech companies

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

Why wait? The regulation is already here

AI is no longer experimental; it is infrastructure. AI systems decide who gets a loan, who passes a job interview and what the user sees in their feed. Such power comes with responsibility, and regulators around the world are starting to require it in a binding way. The European Union has already legislated. Israel is on its way.

Israeli high-tech companies that develop, integrate or sell AI solutions must drop the assumption that “we don’t have to yet”. They do. Here is why.

What does the European AI Act require, and what are the sanctions for non-compliance?

The European AI Act (Regulation (EU) 2024/1689) is the world’s first comprehensive law regulating artificial intelligence (AI). It entered into force in August 2024; the prohibitions on unacceptable-risk systems apply from 2 February 2025, the obligations for general-purpose AI (GPAI) models from 2 August 2025, and general application from 2 August 2026. According to the European Commission’s page, the obligations for high-risk systems were postponed by the Digital Omnibus amendment (which entered into force in July 2026) to 2 December 2027 (systems under Annex III) and to 2 August 2028 (systems embedded in regulated products). Any company that sells AI to the European market, including Israeli companies with one customer in Europe, is subject to the law. The sanctions (Article 99 of the regulation): an administrative fine of up to EUR 35 million or 7% of total worldwide annual turnover (whichever is higher) for using a prohibited practice, and up to EUR 15 million or 3% of turnover for breaching most other obligations.

The main points of the AI Act:

• Risk classification: every AI system is classified into one of four levels: unacceptable risk (prohibited), high risk, limited risk and minimal risk. Each level requires a different degree of compliance.
• Systems that are prohibited outright: social scoring of people, by public or private bodies; subliminal manipulation; exploiting the vulnerability of disadvantaged groups; assessing the risk that a person will commit an offense based on profiling alone; building facial recognition databases by untargeted collection of images from the internet or from cameras; emotion recognition in the workplace and in educational institutions; biometric categorization to infer sensitive characteristics such as race, political opinions or sexual orientation; and real-time remote biometric identification in public spaces for law enforcement purposes, except for narrow exceptions (Article 5). Do not build. Do not integrate.
• High-risk systems: systems that affect recruitment, loans and credit scoring, court systems, education and critical infrastructure require detailed documentation, bias testing, human oversight and registration in the EU database.
• Transparency: any system that interacts with users as if it were human (chatbots, deepfakes, synthetic voices) must disclose that it is AI.
• Human oversight: every high-risk system must have a person who can step in, cancel and reject a decision.

The AI Act is the GDPR of artificial intelligence. Companies that do not prepare for it will find themselves exposed.

What is the Israeli approach, and where are the gaps compared with Europe?

In Israel, the approach to AI regulation is still at an earlier stage than in Europe. Even so, there have been a few important moves:

• A national AI initiative: the government has published a national AI policy that includes ethical principles and guiding standards. These are not binding obligations yet, but they signal the direction.
• The Privacy Protection Authority: in April 2025 it published a draft guideline on the application of the Protection of Privacy Law to artificial intelligence systems. Any AI system that processes information about people is subject to the Protection of Privacy Law, 5741-1981, and sometimes also to the GDPR, when goods or services are offered to people in the EU or their behavior there is monitored (Article 3(2) of the GDPR). Since Amendment No. 13 (14 August 2025), processing personal information in a database for a purpose that is not lawful (section 8(b)) can lead to a monetary sanction of NIS 4 for each person whose information is in the database, NIS 8 for information of special sensitivity, and if that amount is lower than NIS 200,000, the head of the Authority may impose NIS 200,000 (section 23Z(e)).
• Consumer Protection Law, 5741-1981: using AI for dynamic pricing, targeted advertising or personalized results without disclosure may be considered prohibited misleading of consumers (section 2 of the Law).
• Competition law: using AI for algorithmic price coordination may be a restrictive arrangement prohibited under the Economic Competition Law, 5748-1988 (חוק התחרות הכלכלית, התשמ״ח-1988) (sections 2 and 4), even when the coordination is done through an algorithm; and anyone who was a party to a restrictive arrangement that was not approved and is not exempt commits an offense (section 47(a1)).
• Financial institutions: banks and insurance companies are also subject to the directives of their financial regulators, the Banking Supervision Department and the Capital Market, Insurance and Savings Authority, which may also apply to the use of AI.

Israel does not yet have a dedicated law regulating AI, but “no dedicated law” does not mean “no obligations”. Companies that act as if they had no obligations at all are mistaken.

What is your system’s risk level, and what are the legal duties?

Whether you are already subject to the AI Act or are preparing for the future, you should assess the risk level of your AI systems:

1. Minimal risk: spam filters, basic recommendation systems, simple automation tools. The AI Act imposes no binding obligations on them; basic documentation and a voluntary code of conduct are recommended.

2. Limited risk: chatbots, systems that generate synthetic content (deepfakes), and emotion recognition or biometric categorization systems (some of which are also classified as high-risk under Annex III, and emotion recognition at work and in education is prohibited). The requirement (Article 50 of the regulation): clear disclosure that AI is involved; users must know that they are interacting with a machine or are exposed to such a system.

3. High risk: systems that affect significant decisions: recruitment, loans, credit scoring, legal decisions, medicine, education. The requirements are heavy: full technical documentation, risk management and bias testing, real human oversight, a conformity assessment before the system is placed on the market, and registration in the EU database.

4. Prohibited outright: social scoring, manipulation and exploitation of vulnerable people, assessing the risk of committing an offense based on profiling alone, facial recognition databases built from untargeted collection, emotion recognition at work and in education, biometric categorization by sensitive characteristics, and real-time remote biometric identification in public spaces for law enforcement purposes (with exceptions). Do not build. Do not integrate. Do not buy from vendors.

What steps need to be taken now?

It is not too late to start. Here is what needs to be done now:

• Map your AI inventory: list every AI system the company develops or uses, including software from external vendors. Every one of them.
• Risk classification: examine each system under the AI Act framework. Use the official European Union checklist.
• Documentation: how the system works, what data it was trained on, what its limitations are, and how bias is tested.
• Bias testing: for high-risk systems, periodic testing for discrimination by sex, age, origin and other sensitive characteristics.
• Appoint an AI compliance officer: who in the company is responsible for the subject? If you have not yet appointed someone to the role, do it now, not after you receive a fine.

AI is power, and the law requires that power to be used responsibly. Companies that build transparent, documented and supervised systems will not only avoid fines; they will build trust, which is a real competitive advantage.