EU AI Act Article

Articles define the category of risk (Unacceptable, High, Limited, Minimal) based on the system's intended purpose. The classification triggers a cascade of obligations. For example, an article may prohibit a specific subliminal manipulation practice outright, while another mandates conformity assessments for biometric categorization systems. The logic hinges on the potential for adverse impact on health, safety, or fundamental rights.

Articles precisely assign legal duties to distinct entities in the AI value chain:

• Providers: Bear primary responsibility for compliance, documentation, and CE marking.
• Deployers: Must follow use instructions, ensure human oversight, and monitor operations.
• Importers & Distributors: Act as gatekeepers, verifying provider compliance before placing a system on the EU market.
• Authorized Representatives: Fulfill obligations for non-EU providers.

A core function of many articles is to prescribe the exact contents of technical documentation. This is not a vague suggestion but a rigid checklist including:

• System architecture and design specifications.
• Training methodologies and data lineage.
• Performance metrics and accuracy levels.
• Risk management and human oversight protocols. This documentation must be kept for 10 years and be intelligible to authorities.

Articles establish the right to explanation and notification. They mandate that deployers inform individuals when they are interacting with an AI system (e.g., a chatbot), are subject to emotion recognition, or are exposed to deep fakes. The provisions require clear, conspicuous, and timely disclosure, ensuring the output of the AI system is marked in a machine-readable format where feasible.

Articles detail the pathways to legal market entry, including internal control procedures and third-party conformity assessments by notified bodies. They grant market surveillance authorities the power to demand documentation, conduct unannounced inspections, and mandate corrective actions or recall of non-compliant systems. Penalties are defined as a percentage of global annual turnover.

Specific articles create a two-tier framework for foundation models. All GPAI models must provide a technical documentation summary and respect copyright law. Models posing a systemic risk—identified by a cumulative compute threshold of 10^25 FLOPs—face stricter obligations: model evaluations, adversarial testing, serious incident reporting, and robust cybersecurity protection.

A regulatory designation for AI systems that pose significant potential harm to health, safety, or fundamental rights. These systems—including those used in critical infrastructure, education, employment, and law enforcement—must undergo conformity assessment before deployment. Obligations include risk management systems, human oversight mechanisms, and technical documentation. The classification triggers the most stringent requirements under the Act, including mandatory fundamental rights impact assessments and registration in the EU database.

A set of regulatory requirements specifically imposed on foundation models with broad applicability. Providers must:

• Draft and publish a transparency report detailing training data, compute, and capabilities
• Implement a policy to respect copyright law and disclose training data summaries
• Cooperate with the AI Office and downstream providers Models exceeding a systemic risk threshold (measured in FLOPs) face additional mandates including model evaluation, adversarial testing, and cybersecurity protections.

The formal process of verifying that a high-risk AI system meets the essential requirements of the EU AI Act before market placement. This involves internal checks by the provider or third-party notified body involvement for specific use cases. The assessment evaluates the quality management system, technical documentation, and risk mitigation measures. Successful completion results in CE marking affixation, signaling compliance. Re-assessment is required after substantial modifications to the system.

Protocols ensuring meaningful human control over AI system outputs, mandated for high-risk systems. These include:

• Human-in-the-loop: A human must approve each decision before action
• Human-on-the-loop: Real-time monitoring with the ability to intervene
• Human-in-command: Overarching governance of system design and operational limits Oversight must prevent automation bias and enable operators to override, ignore, or reverse AI outputs. The interface must provide interpretable explanations of system reasoning.

A compute-based benchmark that triggers additional regulatory scrutiny for general-purpose AI models. Initially defined as training runs exceeding 10^25 FLOPs, this threshold identifies models with potentially dangerous emergent capabilities. Providers must:

• Conduct adversarial testing and red-teaming
• Report serious incidents to the AI Office
• Ensure cybersecurity protections for model weights
• Assess and mitigate systemic risks at the Union level The threshold is dynamic and may be updated by the Commission.

The continuous, systematic monitoring of an AI system's real-world performance and safety after deployment. Providers must:

• Collect and analyze performance data and incident reports
• Implement a feedback loop from users and affected persons
• Report serious incidents and malfunctions to market surveillance authorities
• Update risk assessments based on operational evidence This creates a living compliance obligation that persists throughout the system's lifecycle, not just at launch.