The AI Act in 10 minutes

1. What it is

The AI Act is Regulation (EU) 2024/1689. It is a product safety law, not a privacy law. It controls how companies build, sell and use AI in the EU.

The basic idea is simple: the higher the risk, the more rules you must follow. The law applies to every company that offers or uses AI in the EU. A company outside the EU must also follow it if the output of its AI is used in the EU (Article 2). The law does not apply to:

• Military, defence and national security use
• Scientific research and development only
• Personal, non-professional use
• Most free and open-source AI, unless it is high-risk, prohibited, or has transparency duties under Article 50

2. How the text is built

The law has three kinds of text, and its definitions in Article 3. The articles refer to each other many times, which is why a graph is a good way to store it.

3. The four risk levels

Each AI system gets one main risk level.

Prohibited

You must not use these systems (Article 5). Examples: social scoring, manipulation that causes harm, emotion recognition at work or in schools (with medical and safety exceptions), untargeted scraping of facial images, and most real-time remote biometric identification in public places by the police.

High-risk

Allowed, but strict rules apply. There are two ways to be high-risk:

• Annex I route (Article 6(1)): the AI is a safety component of a product that already needs third-party conformity assessment under EU product law, for example a medical device, lift or toy.
• Annex III route (Article 6(2)): the AI is used in one of eight areas.

The eight areas: biometrics; critical infrastructure; education and vocational training; employment and HR (recruitment, screening, promotion, dismissal, task allocation, monitoring); essential private and public services (credit scoring, life and health insurance pricing, public benefits, emergency dispatch); law enforcement; migration, asylum and border control; administration of justice and democratic processes.

The exception in Article 6(3)

An Annex III system is not high-risk if it does not pose a significant risk because it only does a narrow procedural task, improves the result of work a human already did, detects decision patterns without replacing or influencing the human decision, or does a preparatory task. This never applies if the system profiles natural persons. If you use the exception, document the assessment before placing the system on the market and still register it in the EU database (Article 49(2)).

Transparency

A system that interacts with people must say that it is a machine, unless obvious. AI-generated audio, image, video and text must be marked in a machine-readable way. Deepfakes must be labelled. People exposed to emotion recognition or biometric categorisation must be told (Article 50).

Minimal risk

No special rules beyond voluntary codes of conduct (Article 95).

4. General-purpose AI models

Chapter V puts separate rules on the companies that make large general-purpose models. All providers of such models (Article 53) must keep technical documentation, give information to companies that build on the model, have a copyright policy, and publish a summary of the training data.

Models trained with more than 10^25 FLOPs are presumed to have systemic risk (Article 55). Their providers must also run model evaluations and adversarial testing, assess and mitigate systemic risks, report serious incidents to the AI Office, and protect the model with adequate cybersecurity.

Most companies use these models and do not make them. A company that puts a general-purpose model into an HR tool is the provider of an AI system, not the provider of a general-purpose model.

5. The roles

Obligations depend on your role for each AI system. One company can have different roles for different systems.

• Provider: develops the AI system, or has it developed, and places it on the market or puts it into service under its own name.
• Deployer: uses an AI system under its authority, in a professional context.
• Importer: established in the EU, places on the EU market a system from a provider outside the EU.
• Distributor: makes a system available on the market, other than the provider or importer.
• Authorised representative: the EU-based representative of a non-EU provider of a high-risk system (Article 22).
• Product manufacturer: puts a high-risk AI system on the market together with its product under its own name (Article 25(3)).

Watch out: Article 25

A deployer, distributor or importer becomes the provider of a high-risk system if it puts its own name or trademark on the system, makes a substantial modification, or changes the intended purpose so that the system becomes high-risk. All provider obligations then transfer to that company.

6. What each role must do (high-risk)

Provider (Articles 9 to 21, 43 to 49, 72 and 73)

Operate a risk management system; meet data quality criteria; write technical documentation before market placement; make the system log events; design for transparency and human oversight; make it accurate, robust and cyber-secure; run a quality management system; keep documentation for 10 years; take corrective action; cooperate with authorities; do a conformity assessment, draw up the EU declaration of conformity, affix the CE marking and register in the EU database; monitor the system after sale and report serious incidents.

Deployer (Article 26)

Use the system according to the instructions for use; assign human oversight to competent people; make sure input data under your control is relevant and representative; monitor operation and report risks and serious incidents; keep the logs the system generates for at least six months; inform workers' representatives and affected workers before use at work; register the use if you are a public authority; tell people when a high-risk system makes or supports decisions about them.

Some deployers must also do a fundamental rights impact assessment (Article 27): public bodies, private companies that provide public services, and deployers of credit scoring and life or health insurance pricing systems.

Every provider and deployer must take measures to support AI literacy among the people who work with AI systems on their behalf (Article 4). Since the 2026 amendment this is about supporting it, not guaranteeing a level.

7. The timeline

The Digital Omnibus on AI, Regulation (EU) 2026/1744, changed the dates. It entered into force on 27 July 2026. The tool shows which version of the text and which obligations apply on a given date.

Dates marked "to be verified" must be checked against the Official Journal before they are relied on.

8. Penalties (Article 99)

For SMEs and start-ups the lower of the two amounts applies. Providers of general-purpose models can be fined up to EUR 15 million or 3% by the Commission (Article 101).

9. The decision order

The law answers one question in a fixed order. The tool follows the same order and shows the path it took.

1. Is it an AI system? (Article 3(1))
2. Is it in scope? Check the exclusions in Article 2.
3. What is your role: provider, deployer, importer, distributor, authorised representative or product manufacturer? Apply the Article 25 role shift.
4. Is it prohibited? (Article 5)
5. Is it high-risk? Annex I, then Annex III, then the Article 6(3) exception.
6. Does it need transparency measures? (Article 50)
7. Is it, or does it contain, a general-purpose AI model, and are you its provider? (Articles 53 and 55)
8. Which obligations apply, and from which date? Role, risk level and date together decide.