EU AI Act Compliance

AI practices deemed a clear threat to the safety, livelihoods, and rights of people are prohibited entirely. This includes systems that deploy subliminal techniques to materially distort behavior, exploit vulnerabilities of specific groups, enable social scoring by public authorities, and use real-time remote biometric identification in publicly accessible spaces for law enforcement, with narrow exceptions. The ban applies to the placing on the market, putting into service, or use of such systems within the EU.

Systems posing a significant risk to health, safety, or fundamental rights. This tier has two categories:

• Product Safety Components: AI used as a safety component in regulated products (e.g., medical devices, machinery).
• Specific Use Cases: Standalone systems listed in Annex III, including biometric categorization, critical infrastructure management, educational access scoring, employment and worker management, essential services eligibility, law enforcement, migration management, and administration of justice.

Obligations include conformity assessments, risk management systems, high-quality data governance, technical documentation, record-keeping, transparency, and human oversight.

AI systems subject to specific transparency obligations to ensure humans are aware they are interacting with a machine. This applies to:

• Chatbots and Conversational Agents: Users must be informed they are engaging with an AI system unless it is obvious.
• Emotion Recognition and Biometric Categorization: Deployers must inform individuals exposed to such systems.
• Deep Fakes and Synthetic Content: AI-generated or manipulated content resembling real persons, objects, or events must be labeled as artificial, with exceptions for artistic, creative, or satirical works and law enforcement purposes.

The vast majority of AI systems currently used in the EU fall into this category, including AI-enabled video games and spam filters. The Act imposes no specific regulatory obligations on these systems. However, providers and deployers are encouraged to voluntarily adopt codes of conduct that mirror the requirements for high-risk systems, promoting trustworthy AI development beyond legal mandates. This tier represents the Act's risk-based philosophy: regulatory intervention is strictly proportional to the severity of potential harm.

A distinct classification for foundation models with high-impact capabilities. A GPAI model is classified as posing systemic risk if it exceeds a cumulative compute threshold of 10^25 FLOPs during training, or is designated by the Commission based on criteria like user scale or autonomy. Providers must conduct model evaluations, perform adversarial testing, assess and mitigate systemic risks, report serious incidents, and ensure adequate cybersecurity protection. This tier addresses risks from the most powerful frontier models.

A classification under the EU AI Act for systems posing significant risk to health, safety, or fundamental rights. These systems must comply with strict requirements before deployment.

• Mandatory Requirements: Conformity assessments, technical documentation, and human oversight.
• Examples: Biometric identification, critical infrastructure management, and credit scoring algorithms.
• Obligation: Providers must implement a quality management system and post-market monitoring.

A core pillar of the Act requiring that users are informed when interacting with an AI system. This is especially critical for systems that generate or manipulate content.

• Direct Interaction: Users must be notified they are engaging with an AI, not a human.
• Synthetic Content: AI-generated deepfakes must be labeled as artificially generated or manipulated.
• Emotion Recognition: Deployers must inform individuals exposed to emotion recognition systems.

A tiered regulatory framework for foundation models based on systemic risk. All GPAI models must provide technical documentation, while those with high-impact capabilities face additional scrutiny.

• All GPAI Models: Must publish a sufficiently detailed summary of training data, respecting copyright law.
• Systemic Risk: Models trained with cumulative compute above 10^25 FLOPs are presumed to have systemic risk.
• Additional Obligations: Systemic models require model evaluations, adversarial testing, and serious incident reporting.

A specific mandate requiring GPAI model providers to publicly summarize the content used for training. This directly addresses the tension between AI development and intellectual property rights.

• Opt-Out Compliance: Providers must implement a policy to respect the opt-out of rights reservation expressed by content owners.
• Machine-Readable Opt-Out: The Act encourages the use of technical standards like robots.txt and TDM protocol signals to block scraping.
• Enforcement: This creates a legally binding link between technical crawler directives and regulatory compliance.

The mandatory process by which high-risk AI system providers verify and document compliance with the Act's requirements before a product can be placed on the EU market.

• Internal Control: Most high-risk systems can be self-assessed by the provider.
• Third-Party Audit: Systems used for remote biometric identification require a notified body assessment.
• Documentation: Requires a detailed description of the system's design, logic, and risk management procedures.

Strict requirements for the quality and integrity of training, validation, and testing datasets used in high-risk AI systems to prevent bias and ensure accuracy.

• Bias Examination: Datasets must be examined for possible biases that could lead to discriminatory outcomes.
• Relevance: Data must be relevant, representative, and free of errors to the greatest extent possible.
• Provenance: The governance process must account for the origin of the data and the purpose for which it was collected.