EU AI Act Does it apply to you?

An AI system infers how to produce predictions, content, recommendations or decisions from its inputs. It operates with some autonomy, may adapt after deployment, and can influence a physical or digital environment.

A general-purpose AI (GPAI) model can perform many distinct tasks and can be integrated into other systems. A reusable model and the chatbot, scoring tool or product built with it need separate assessments.

Check the inference capability rather than the vendor label. The definition does not require machine learning, continuous learning or a particular level of complexity.

Article 2 covers providers supplying AI systems or GPAI models to the EU market, providers putting systems into service in the EU, and deployers established or located in the EU. It also covers specified supply-chain roles and affected people in the EU.

A provider or deployer outside the EU can be covered when the system produces outputs used in the EU. Record where the system is supplied and operated, who it affects and where its outputs are used.

Check each exclusion against the actual activity. The pre-market research and development exclusion does not cover real-world testing. The free and open-source system exclusion does not cover high-risk systems or systems falling under Article 5 or Article 50.

For regulated products, identify the exact law in Annex I. The 2026 amendment limits direct AI Act duties for Section B products and moves machinery to that section. Check the sector law before assigning the full standalone high-risk requirements.

Your role follows your activity. You may use a supplier's tool as a deployer, release your own tool as a provider, and import another tool from outside the EU.

Contracts help establish the facts. Check who develops, brands, supplies, modifies and operates each system or model before accepting a role label.

Under Article 25, you can take on high-risk provider duties if you rebrand an existing high-risk system, substantially modify it while it remains high-risk, or change a system's intended purpose so it becomes high-risk. This can affect importers, distributors, deployers and other third parties.

A manufacturer can also be the provider of a high-risk safety component in an Annex I Section A product. This applies when it supplies the system with its product under its own name or trademark, or later puts the system into service under that name or trademark.

Before accepting the new role, request technical documentation, known limitations, failure modes and testing access from the original provider. Amended Article 25(2) requires cooperation unless the original provider clearly prohibited changing its system into a high-risk system.

Importers and distributors have their own checks for high-risk systems. A CE mark alone does not establish that they have completed those checks.

Before EU market placement, importers check the provider's conformity assessment and technical documentation, declaration, CE marking, instructions and representative appointment. Before making a system available, distributors check the marking, declaration copy, instructions and importer details.

Both must stop supply if they have reason to believe a system is non-compliant. Risk concerns also trigger their separate notification duties.

A non-EU provider's authorised representative needs a written mandate under Article 22 or 54. The provider retains the duties that the law assigns to it, including ensuring compliance before market placement.

Keep the facts, legal basis, reviewer and approval together. For high-risk candidates, record either the product-law route or the Annex III use case.

For the Article 6(3) Annex III exception, establish no significant risk of harm and at least one listed task condition: a narrow procedural task, improvement of completed human work, properly reviewed detection of decision patterns, or preparation for an Annex III assessment. The exception cannot cover an Annex III system that profiles people. Document the assessment before market placement or first use and keep the Article 49(2) registration record.

Record the date for each duty. The original prohibitions have applied since 2 February 2025; GPAI duties since 2 August 2025. The new content prohibitions apply from 2 December 2026.

The 2026 amendment was published on 24 July and entered into force on 27 July 2026. It retains 2 August 2026 as the general application date. Chapter III Sections 1-3, except Article 6(5), apply from 2 December 2027 for Annex III systems and 2 August 2028 for Article 6(1) product-linked systems.