(?=…) is a lookahead: it runs a whole sub-pattern at the current position, and then puts the position back. If the sub-pattern matched, the lookahead succeeds and nothing has been consumed. If it did not, the lookahead fails.
That is what makes it useful. \d+(?= kg) finds a number that is followed by a unit without swallowing the unit, so the match is the number and the unit is still there for the next thing to read.
(?!…) is the negative form: it succeeds when the sub-pattern fails. It is how you say followed by anything except this, which a character class cannot express once this is longer than one character.
At the end of the input a negative lookahead always succeeds, because there is nothing there to match. That is usually what you want and occasionally a surprise.
Because a lookahead consumes nothing, several of them can be stacked at the same position, each testing something different. That is the whole trick behind a password rule: three lookaheads that each check one requirement, and then one pattern that checks the length.
Watch the step count on that one. Every lookahead runs its own search from the start of the input, so three of them is roughly three passes before the real pattern begins.