Start with what your AI does and whether you build, supply or use it. Then check its risk category, duties and deadlines.
These answers explain the main decisions and link to the legal sources. Use the detailed FAQs for conditions, exceptions and evidence.
The AI Act answer depends on the system or model, its intended use and your role. The questions below cover scope, risk classification, duties and dates, followed by staff literacy, individual rights and support for smaller organisations.
These focused FAQ modules break this artifact into narrower answer sets so teams can move straight to the right source-backed guidance.
Check provider, deployer, importer and distributor roles, when changes create provider duties, and how model and system responsibilities differ.
Find the assessment route for high-risk AI, when a notified body is required, and which declaration, CE-marking and registration records you need.
Check whether software counts as AI, how models differ from systems, when embedded AI is high-risk, and which scope and role evidence to keep.
Understand high-risk AI monitoring under Article 72: the provider plan, deployer feedback, logs, corrective action, incidents and change reviews.
See which industry AI uses fall under Annex III, when Article 6(3) can apply, and what providers must document and register.
See what Article 11 and Annex IV require in high-risk AI technical documentation, from system identity and testing to monitoring and retention.
Check general-purpose model duties, systemic-risk classification, open-source conditions, copyright, training summaries, incidents and application dates.
Check AI interaction notices, technical content marking, biometric notices, deepfake and text disclosures, exceptions, accessibility and deadlines.
Check serious-incident outcomes, reporting roles, 15-, 10- and two-day deadlines, authority recipients, corrective action and the separate model route.
Check who needs an Article 27 fundamental rights impact assessment, what it must cover, and how privacy assessments, notification and registration fit.
Check the EU connection and your role first. You can provide one AI system, use another as a deployer, and build a downstream system with someone else's general-purpose model. Articles 2 and 3 define the scope and roles.
The 2026 amendment changed the high-risk dates. Chapter III Sections 1-3, except Article 6(5), now apply from 2 December 2027 for Annex III systems and 2 August 2028 for Article 6(1) product-linked systems. Other provisions remain on the general date unless separately postponed. The amendment was published on 24 July 2026 and entered into force on 27 July.
Earlier phases introduced prohibitions and AI literacy on 2 February 2025, general-purpose model duties and specified governance and penalty provisions on 2 August 2025, and general application on 2 August 2026. The original 2 August 2027 date for Article 6(1) product-linked high-risk duties was later changed.
Yes, if the provider places an AI system or general-purpose AI model on the Union market, puts an AI system into service in the Union, or is established outside the Union but the AI system output is used in the Union. The answer should record the market, customer, output-use location, and operator role.
A provider develops an AI system or GPAI model, or has one developed, and places it on the market or puts the AI system into service under its own name or trademark. A deployer is the organisation using an AI system under its authority. The same organisation may hold different roles for different systems or lifecycle steps.
Use separate calendar entries: 2 February 2025 for the original bans and literacy duty; 2 August 2025 for general-purpose model duties and specified governance and penalties; 2 August 2026 for general application, most transparency duties and model enforcement powers; 2 December 2026 for the new content-generation ban and the marking transition for qualifying older systems; 2 August 2027 for models marketed before 2 August 2025; 2 December 2027 for Annex III Chapter III Sections 1-3, except Article 6(5); and 2 August 2028 for the equivalent Article 6(1) product-linked provisions. The amendment entered into force on 27 July 2026.
Sources (3)
Supports Article 2 scope, Article 3 operator definitions, Article 4 AI literacy, and Article 113 staged application dates.
It shall apply from 2 August 2026.
Provides Commission overview of the AI Act risk categories, high-risk compliance steps, GPAI rules, and transparency rules.
The AI Act is the first-ever comprehensive legal framework on AI worldwide.
Supports publication and entry into force, revised high-risk dates, the new prohibited-practice application date, and the provider-side Article 50 transition.
The Commission explains four system risk levels: unacceptable, high, limited or transparency, and minimal or no risk. These labels help explain the Act; the specific articles decide the duties. Transparency duties can overlap high-risk duties. General-purpose AI models have separate rules.
Screen the bans in Article 5 first. They cover specified harmful manipulation and exploitation, certain social scoring and criminal-risk prediction based solely on profiling or personality traits, untargeted scraping for facial-recognition databases, and workplace or education emotion recognition except for medical or safety reasons.
Article 5 also prohibits certain sensitive biometric categorisation and generally prohibits law-enforcement real-time remote biometric identification in publicly accessible spaces, with narrow exceptions. The 2026 amendment adds a ban from 2 December 2026 for specified non-consensual intimate material and child sexual abuse material.
Then check the two high-risk routes: covered products or safety components under Article 6(1), and listed uses under Article 6(2) and Annex III. Article 6(3) provides a limited exception for some Annex III systems.
No. Some uses are prohibited, some systems are high-risk, and some have specific transparency duties. Many systems fall within the Commission's minimal-or-no-risk label. This does not remove all applicable duties or other laws. General-purpose AI models have a separate framework, and transparency duties can overlap high-risk duties.
Article 6(1) applies when the AI system is intended as a safety component of a product, or is itself a product, covered by listed Union harmonisation legislation and that product or system must undergo third-party conformity assessment before market placement or putting into service.
Sometimes. Article 6(3) requires no significant risk of harm to health, safety, or fundamental rights, including through the absence of material influence on decision-making. The system must also fit at least one listed condition: a narrow procedural task; improvement of a completed human activity; detection of decision patterns or deviations without replacing or influencing a completed human assessment without proper human review; or a preparatory task for an Annex III assessment. An Annex III system that profiles natural persons is always high-risk. The provider must document the assessment before market placement or first service and register the system under Article 49(2).
Sources (4)
Supports the prohibited-practice screening questions, including manipulative practices, social scoring, biometric categories, and real-time remote biometric identification conditions.
The following AI practices shall be prohibited:
Supports Article 6 high-risk classification rules, Annex III high-risk areas, and Article 6(3) non-high-risk documentation.
AI systems referred to in Annex III shall be considered to be high-risk.
Commission FAQ explains high-risk examples, conformity assessment, quality management, and EU database registration at a practical level.
providers of high-risk AI systems have to register the system
Supports the new Article 5 category for specified non-consensual intimate material and child sexual abuse material and its 2 December 2026 application date.
Providers must meet the high-risk system requirements and prepare the pre-release evidence: quality management, technical documentation, controlled logs, conformity assessment, EU declaration, CE marking and applicable registration. They also handle corrective action and cooperation with authorities.
Deployers use the system under their authority. Follow instructions, assign competent human oversight, monitor operation and control relevant input data where it is under your control.
Keep deployer-controlled logs for an appropriate period of at least six months unless another applicable law provides otherwise. Inform affected workers before workplace use. Inform people when an Annex III high-risk system makes or assists decisions about them.
A provider should have the Article 16 compliance package: quality management, technical documentation, logs where under its control, conformity assessment records, EU declaration of conformity, CE marking evidence, Article 49 registration, corrective-action records, and materials needed to demonstrate conformity to competent authorities.
A FRIA is required before first deployment of covered Article 6(2) high-risk systems by bodies governed by public law or private entities providing public services, and by deployers of Annex III point 5(b) creditworthiness or credit-scoring systems and point 5(c) life and health insurance risk-assessment and pricing systems. Annex III point 2 critical-infrastructure systems are excluded. The deployer can cross-reference or include relevant parts of an existing data protection impact assessment (DPIA) where it already meets overlapping obligations, and must assess the remaining fundamental-rights issues.
For covered Annex III high-risk systems, the provider or authorised representative registers itself and the system before market placement or putting into service. Public authorities, Union institutions, bodies, offices, agencies, and persons acting on their behalf must register themselves, select the system, and register their use before putting the system into service or using it.
For high-risk systems, keep the event chronology, affected system, harm, affected persons or groups, provider and deployer notifications, authority notifications, corrective measures, logs, and post-market monitoring evidence. For GPAI models with systemic risk, the Commission template asks for start and end dates, harm, chain of events, model involved, evidence of involvement, response, recommendations, root cause analysis, and post-market monitoring patterns.
Decision (EU) 2026/2274 cited EN 18286:2026 in the Official Journal on 14 October 2026. Conformity with its relevant clauses supports presumption of conformity only for covered requirements, subject to Annex ZA conditions. It does not establish whole-Act compliance, remove required conformity assessment or change application dates. Use the harmonised standards and quality-management guide to check the coverage and connect provider procedures to system evidence.
Sources (5)
Supports Article 16 provider obligations, Article 26 deployer obligations, Article 72 post-market monitoring, and Article 73 serious-incident reporting for high-risk AI systems.
Providers of high-risk AI systems shall:
Supports who must perform a fundamental rights impact assessment, when it is required, and the assessment contents.
Prior to deploying a high-risk AI system
Supports EU database registration duties for providers, authorised representatives, and certain deployers of high-risk AI systems.
Before placing on the market or putting into service
Supports the serious-incident report contents for GPAI models with systemic risk and the Article 55 reporting context.
serious incidents involving general-purpose AI models with systemic risk
Article 1 and the Annex cite EN 18286:2026. Article 2 and recital 6 establish effect from publication on 14 October 2026, limited to requirements covered by the standard.
General-purpose AI (GPAI) model providers follow Chapter V. Article 53 requires model documentation, information for downstream system builders, a copyright policy and a public training-content summary using the AI Office template. Article 55 adds evaluation, risk mitigation, incident and security duties for models with systemic risk.
Article 50 assigns specific disclosure duties. Providers address direct AI interactions and technical marking of generated content. Deployers address biometric or emotion-recognition notices, deepfake disclosure and certain AI-generated public-interest text. Check each paragraph's exceptions and timing.
Article 53 requires GPAI model providers to maintain model technical documentation, provide downstream information needed by AI-system providers, maintain a policy for EU copyright compliance, publish a summary of training content using the AI Office template, and cooperate with the Commission and competent authorities.
Article 55 adds model evaluation with state-of-the-art protocols and adversarial testing, assessment and mitigation of systemic risks at Union level, serious-incident tracking and reporting without undue delay, and adequate cybersecurity protection for the model and physical infrastructure.
Article 50 requires providers of AI systems intended to interact directly with natural persons to design and develop the system so people are informed they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant, and circumspect person in the circumstances and context of use.
Article 50 requires provider-side machine-readable marking for synthetic audio, image, video, or text outputs where the rule applies. Deployers must disclose deepfakes, and must disclose AI-generated or manipulated public-interest text unless a listed exception applies, such as human review or editorial control with editorial responsibility.
Sources (5)
Supports Article 50 transparency obligations and Articles 53 to 55 GPAI provider obligations.
Providers of general-purpose AI models shall:
Supports the GPAI obligation scope, enforcement staging, Code of Practice context, and EU SEND submission route.
These obligations enter into application on 2 August 2025.
Supports the public summary of training content requirement and the Commission template baseline for GPAI providers.
common minimal baseline
Supports the Article 50 implementation context for marking, labelling, deepfake disclosures, and transparency codes of practice.
marking and labelling of AI-generated content
Supports the 2 December 2026 transition for provider-side synthetic-output marking and detection.
Providers and deployers must support staff AI literacy. People have complaint rights and, for specified decisions, explanation rights. The Act also provides regulatory sandboxes and proportionate support for smaller organisations.
Check the conditions for each provision. Explanation rights apply to specified decisions, sandbox testing has defined limits, and smaller-company support depends on the particular article.
From 27 July 2026, amended Article 4 requires providers and deployers to take measures that support the development of AI literacy for staff and other people operating or using AI systems on their behalf. The measures must reflect technical knowledge, experience, education, training, use context, and affected people, but the organisation does not have to guarantee a specific literacy level for every individual. Evidence can include the audience assessment, role-based material, completion records, operating guidance, and updates when the system or use changes.
Yes. Article 85 allows a natural or legal person that has grounds to consider there has been an infringement to submit a complaint to the relevant market surveillance authority. The appropriate authority depends on the Member State, system, sector, and enforcement allocation. This route sits alongside other administrative or judicial remedies available under Union or national law.
Article 86 covers specified significant decisions, rather than every AI output. The decision must be taken by a deployer using output from an Annex III high-risk system, excluding point 2 critical infrastructure. It must produce legal effects or similarly significantly affect the person in a way they consider adverse to their health, safety or fundamental rights. The person can seek a clear, meaningful explanation of the system's role and the decision's main elements. Other EU-law rights and lawful exceptions or restrictions can affect applicability.
No. A sandbox provides a controlled framework and authority supervision for eligible development, training, testing, or validation. Participants still need safeguards, documentation, and a route to full compliance before placing a covered system on the market, putting it into service, or using it outside the permitted sandbox conditions. Article 5 prohibited practices are not converted into acceptable uses by sandbox participation.
No. The Act includes proportionate support, reduced conformity-assessment fees, priority sandbox access in specified circumstances, simplified technical-documentation or quality-management measures where provided, and penalty rules that account for smaller undertakings. The substantive duty still applies unless the relevant article creates a specific exclusion or simplification.
Member States designate national competent authorities and a single point of contact, while market surveillance and notifying authorities have different functions. The European AI Office supports implementation and has central responsibilities for general-purpose AI models. Sector rules can affect the competent route, so record the Member State, system category, actor, and issue before naming an authority.
Sources (4)
Primary legal source for AI literacy, regulatory sandboxes and real-world testing, national authorities, complaints, and the defined right to an explanation of individual decision-making.
adverse impact on their health, safety or fundamental rights
Article-specific source for the role, knowledge, experience, context, and affected-person factors used to plan sufficient AI literacy.
taking into account their technical knowledge, experience, education and training
Commission source explaining the AI Office's implementation, enforcement, international, and general-purpose AI responsibilities.
European AI Office
Supports amended Article 4: measures must support AI literacy development, with no duty to guarantee a specific level for each individual.
Keep enough evidence for another person to repeat the decision. Identify the system or model, intended purpose, role, EU market or output-use connection, applicable rule and source.
Supplier claims, model cards and policy summaries can support the facts. Map those facts to the relevant legal provisions: scope, roles, bans, high-risk classification, model duties, transparency, impact assessment, registration and incidents.
Avoid unsupported deadlines, penalty figures, thresholds, exemptions, or authority routes. If the source does not support the answer, mark the issue as unresolved instead of filling the gap from memory or vendor marketing.
Keep the AI system or model name, intended purpose, operator role, risk classification, source citation, decision owner, affected launch or deployment, required artifact, approval history, and reassessment trigger for product, model, supplier, market, or legal changes.
Sources (2)
Primary source for the scope, role, prohibited-practice, high-risk, transparency, GPAI, governance, registration, and incident records referenced in the evidence checklist.
harmonised rules for the placing on the market
Commission FAQ used to cross-check practical explanations of high-risk compliance steps, transparency obligations, and GPAI duties.
What are the obligations
Sorena can help check your scope, role and risk classification, then identify the records, notices and reviews you need.
"laying down harmonised rules on artificial intelligence"
"It shall apply from 2 August 2026."
"AI systems referred to in Annex III shall be considered to be high-risk."
"Providers of high-risk AI systems shall:"
"Providers of general-purpose AI models shall:"
"harmonised rules for the placing on the market"
"Navigating the AI Act"
"providers of high-risk AI systems have to register the system"
"What are the obligations"
"Fundamental rights impact assessment for high-risk AI systems"
"Prior to deploying a high-risk AI system"
"AI literacy"
"taking into account their technical knowledge, experience, education and training"
"Registration"
"Before placing on the market or putting into service"
"Prohibited AI practices"
"The following AI practices shall be prohibited:"
"The AI Act is the first-ever comprehensive legal framework on AI worldwide."
"marking and labelling of AI-generated content"
"European AI Office"
"general-purpose AI models"
"These obligations enter into application on 2 August 2025."
"serious incidents involving general-purpose AI models"
"serious incidents involving general-purpose AI models with systemic risk"
"Public Summary of Training Content"
"common minimal baseline"
"adverse impact on their health, safety or fundamental rights"
Find the AI Act deadline for your system or model. Check high-risk dates, transparency duties, older-model transitions and the evidence to prepare.
Check who needs an Article 27 fundamental rights impact assessment, what it must contain and how DPIA reuse, notification and registration work.
Collect model documentation, integration information, copyright records and training summaries. Add testing, incident and security records for systemic risk.
Set up high-risk AI monitoring, identify serious incidents and check reporting deadlines, recipients, deployer escalation and corrective action.
Check the AI Act fine tiers, smaller-organisation caps, GPAI provider fines and the facts authorities consider when deciding a penalty.
Check serious-incident harm, preserve evidence and choose the reporting deadline and recipient for high-risk AI systems and systemic-risk GPAI models.
See which AI Act rules apply now and what comes next. Check high-risk dates, older-model transitions and the difference between legal and standards dates.
Compare AI Act legal duties with ISO/IEC 42001 management-system requirements. See which records can be reused and what certification does and does not cover.
Compare AI Act legal duties with the voluntary NIST AI RMF. Map risk records to specific requirements and identify legal steps that need separate evidence.
Use five checks to establish AI Act scope, exclusions, your role, risk categories and evidence for the decision.
Choose between provider-run internal control, notified-body assessment and a product-law procedure before release.
Classify an AI tool or model before purchase or release. Check EU scope, prohibited uses, high-risk rules, transparency and GPAI duties.
Check each AI tool, decide which duties apply, and give every action an owner and evidence link.
Some high-risk systems use a provider-run assessment. Others need an authorised independent assessor or a product-law assessment.
Check whether the AI Act applies to your system or model, identify your provider or deployer role, and keep evidence for the decision.
Check GPAI provider duties for documentation, integrator information, copyright and training summaries, plus extra requirements for systemic-risk models.
High-risk providers must meet system requirements before supply. Deployers must use and monitor the system under the provider's instructions.
Check the system's risk controls, data, documentation, logs, instructions, human oversight and testing before release.
Find high-risk AI examples in recruitment, banking, education, healthcare, public services and products. Check Article 6 conditions and exceptions.
Build a compliance plan for each AI tool: your role, the duties that apply, the evidence needed and the person responsible.
Use EN 18286:2026 to organise provider quality-management procedures and keep evidence that they work for each high-risk system.
Build the technical file and provider records for a high-risk AI system, with owners and evidence links for each field.
Check Article 50 chatbot notices, synthetic-output marking, biometric notices, deepfake disclosures and public-interest text exceptions.
Check Article 5 prohibited AI practices, the narrow exceptions, evidence to retain and the new content prohibitions from 2 December 2026.