EU AI Act Applicability and Roles

Classify the thing being assessed before assigning roles. An AI system is a machine-based system with some autonomy that infers how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. A general-purpose AI model is an AI model that displays significant generality, can competently perform a wide range of distinct tasks, and can be integrated into downstream systems or applications.

Keep AI systems and GPAI models separate in the record. A customer-facing chatbot, triage workflow, scoring feature, or embedded product function is usually assessed as an AI system. A foundation model or other reusable model released for integration may need a GPAI model analysis even before a downstream application is classified.

The definition requires inference, but it does not require machine learning, continuous learning, or a particular level of complexity. Document the system's objectives, degree of autonomy, inference method, outputs, and capacity to influence an environment; do not decide from a vendor category or technology label alone.

Article 2 applies to several different trigger paths. It covers providers placing AI systems on the market or putting them into service in the Union, providers placing GPAI models on the Union market, deployers established or located in the Union, importers and distributors of AI systems, product manufacturers placing or putting into service an AI system with their product under their own name or trademark, authorised representatives for non-EU providers, and affected persons located in the Union.

A non-EU provider or deployer can still be in scope when the output produced by the AI system is used in the Union. The applicability record should therefore track where the provider, deployer, users, affected persons, product release, and output use are located rather than relying only on company headquarters.

Treat exclusions narrowly and record the facts supporting them. The research-and-development exclusions do not cover real-world testing, and the free and open-source exclusion does not cover systems placed on the market or put into service as high-risk systems or systems within Article 5 or Article 50. A licence label by itself does not establish that an exclusion applies.

For product-linked systems, scope and classification are not the same as the final obligation set. Regulation (EU) 2026/1744 limits direct AI Act application for Article 6(1) systems related to products under Annex I Section B and moves machinery into that sectoral route. Record the exact Annex I instrument and check the amended sector law before copying the standalone high-risk control set into the product file.

The same organisation can hold different roles for different assets. A company can be a deployer when it uses a third-party screening tool, a provider when it releases its own AI system under its name, an importer when it places a third-country-branded AI system on the Union market, and a product manufacturer when an AI system is placed on the market or put into service together with its product under the manufacturer's name or trademark.

Role mapping should follow the legal definitions and the actual supply chain. Contract labels are useful evidence, but they do not replace facts about who develops, brands, imports, distributes, deploys, modifies, or integrates the AI system or model.

Article 25 prevents teams from freezing role assignments at procurement. A distributor, importer, deployer, or other third party becomes the provider of a high-risk AI system if it puts its own name or trademark on a high-risk AI system already placed on the market or put into service, makes a substantial modification while the system remains high-risk, or changes the intended purpose of an AI system, including a general-purpose AI system, so that it becomes high-risk.

For high-risk AI systems that are safety components of products covered by the listed Union harmonisation legislation, the product manufacturer is considered the provider when the high-risk AI system is placed on the market with the product under the manufacturer's name or trademark, or put into service under that name or trademark after the product is placed on the market.

Importers, distributors, and authorised representatives need their own evidence rows. They do not inherit the provider's full legal responsibility, but they cannot rely on a contract label or a CE mark without the checks assigned to their role.

An importer should confirm the provider completed the applicable conformity assessment and technical documentation, and should check the declaration, CE marking, instructions for use, and authorised-representative appointment before placing a high-risk system on the Union market. A distributor should check the CE marking, declaration copy, instructions for use, and importer details before making it available. Both roles must stop supply when they have reason to consider the system non-compliant and follow the separate notification duties when it presents a risk.

A non-EU provider appointing an authorised representative should give the representative a written mandate for the tasks in Article 22 or Article 54. The mandate does not transfer duties that the Act leaves with the provider, such as ensuring the system or model complies before market placement.

A defensible applicability file should show how the team moved from definition and scope to classification. For high-risk screening, Article 6 covers product-linked high-risk systems and Annex III high-risk systems. If a provider treats an Annex III system as not high-risk because it does not pose a significant risk of harm and does not materially influence decision-making, Article 6 requires the assessment to be documented before market placement or putting into service.

Use concrete, versioned evidence: intended-purpose statements, technical documentation, model documentation, supplier contracts, instructions for use, EU market records, output-use locations, Annex III analysis, Article 6 derogation reasoning where used, role-shift review, and an approval history showing who accepted the classification.

Application dates belong in the record but do not decide whether the Regulation covers the actor or asset. Chapters I and II have applied since 2 February 2025 and the GPAI obligations in Chapter V since 2 August 2025. Regulation (EU) 2026/1744 was published on 24 July 2026 and enters into force on 27 July 2026. It keeps 2 August 2026 as the general application date but applies Chapter III Sections 1-3 from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Article 6(1) product-linked systems. Preserve the publication and entry-into-force dates with the classification record so a reviewer can tell which text controlled the decision.