AI Act explorer Every article that matters. One-line summaries.

Sets the AI Act's purpose: harmonised rules for AI placed on the EU market, ensuring high level of protection of health, safety, fundamental rights.

Extraterritorial reach: applies where the AI output is used in the EU, regardless of establishment location. Article 2(1)(c) is the US-targeting wedge.

Defines AI system, provider, deployer, importer, distributor, operator, GPAI model, biometric data, risk, etc. Critical for any compliance argument.

Must ensure sufficient AI literacy of staff dealing with AI systems. Operative since 2 Feb 2025.

Bans social scoring by public/private actors, exploitation of vulnerabilities, untargeted scraping for face databases, emotion recognition in workplaces/schools (with exceptions), biometric categorisation by sensitive attributes, real-time remote biometric ID in public spaces (narrow law-enforcement exceptions), predictive policing of natural persons.

Defines what makes a system high-risk: covered by Annex I safety legislation, OR listed in Annex III use cases. Determination is the gateway for the entire Chapter III obligation chain.

Continuous, iterative risk-management process across the lifecycle. Identification, estimation, evaluation, mitigation of known and reasonably foreseeable risks. Documented in technical documentation.

Training/validation/testing data must meet quality criteria: relevant, representative, free of errors, complete. Special-category data permitted only for bias mitigation. Documentation of data sources required.

Annex IV-prescribed dossier covering system description, design choices, training data, performance metrics, risk management, post-market plan. Must exist BEFORE placing on market. Single most underestimated artefact.

Automatic logging of events over the system's lifetime, enabling traceability. Logs retained by deployer (Art. 26(6)).

Instructions for use including system characteristics, accuracy, robustness, foreseeable misuse, hardware/software needs, human-oversight measures.

System must be designed to be effectively overseen by natural persons. 'Stop' button, ability to override, interpretability tools.

Appropriate accuracy levels declared in instructions for use. Resilience to errors and inconsistencies. Resilience to adversarial attacks (data poisoning, model evasion). State of the art at the time of placing on market.

Compliance with Chapter III, quality-management system (Art. 17), documentation retention 10 years (Art. 18), logging retention (Art. 19), corrective actions (Art. 20), cooperation with authorities (Art. 21), authorised representatives in EU for non-EU providers (Art. 22).

Use per instructions; assign human oversight; ensure input data appropriateness; monitor operation; keep logs ≥6 months; inform workers + workers' reps for workplace use; FRIA (Fundamental Rights Impact Assessment) for public-sector + credit/insurance use.

Fundamental Rights Impact Assessment before first deployment. Categories of natural persons affected, intended purpose, risks, oversight measures, human review of outputs.

Internal control (Annex VI) or third-party with notified body (Annex VII) depending on category. CE marking after success. Re-assessment required on substantial modification.

Single declaration per system stating compliance with the Act. Retained 10 years; updated as needed.

Public EU database of high-risk AI systems. Annex VIII data (system name, intended purpose, provider/deployer details, CE marking).

Disclose AI when interacting with humans; biometric categorisation/emotion recognition systems must inform subjects; deepfake content must be labelled; AI-generated text on matters of public interest must be disclosed unless edited by human.

GPAI = model with significant generality and capability across distinct tasks. Systemic-risk GPAI: above 10²⁵ FLOPs training compute OR designated by Commission.

Technical documentation (Annex XI), information for downstream providers (Annex XII), copyright-law-compliance policy, public summary of training content.

Model evaluation per state-of-the-art protocols, adversarial testing, assessment + mitigation of EU-level systemic risks, serious-incident tracking and reporting to AI Office, cybersecurity protection.

Sets up the EU AI Office (Commission DG-CNECT), the AI Board (Member State reps), and the Advisory Forum. The Office leads on GPAI; national authorities lead on other categories.

Documented plan, proportionate to risk. Active collection + analysis of relevant data from deployers throughout the lifetime of the system.

Report to market surveillance authorities within 15 days of awareness (or 2 days for widespread infringement / serious irreversibility). Investigation cooperation required.

Prohibited practices (Art. 5): €35M / 7% of global annual turnover, whichever higher. Most other violations: €15M / 3%. Incorrect info to authorities: €7.5M / 1%. SMEs and startups: lower of the two.

Up to €15M / 3% of global annual turnover. AI Office enforcement.

8 categories: biometrics, critical infrastructure, education, employment, essential services (credit, insurance, public welfare), law enforcement, migration, justice administration.

Required structure: general description; design specifications; description of monitoring/control; risk management; pre-determined changes; standards applied; declaration of conformity; post-market plan. Single most labour-intensive deliverable.