Why this object hangs off that object

Name which of the four Article 6(3) conditions you invoke, with facts, and separately justify why the system poses no significant risk of harm to health, safety or fundamental rights and does not materially influence the outcome of decision making.

Hangs off: Annex III: high-risk AI

Editorially reviewed | high-risk

Assess Article 5, Article 6 and Annex III in that order and document purpose, context and any Article 6(3) exception.

Hangs off: Annex III: high-risk AI

Editorially reviewed | high-risk

Establish as the first question whether the system performs profiling of natural persons; if yes, the Article 6(3) route falls away and the system remains high-risk, regardless of the four conditions.

Hangs off: Annex III: high-risk AI

Editorially reviewed | high-risk

Name, per high-risk system, who exercises oversight, and ensure that person has the competence, training, authority and support to actually set the output aside.

Hangs off: Article 26: obligations of deployers of high-risk AI systems

Editorially reviewed | high-risk-requirements

Assess origin, representativeness, errors and completeness and examine possible bias with appropriate mitigation.

Hangs off: Article 10: data and data governance

Editorially reviewed | high-risk-requirements

Document system description, development process, data, oversight measures, performance and risk management before market placement.

Hangs off: Article 11: technical documentation

Editorially reviewed | high-risk-requirements

Ensure the system automatically records events relevant to risk identification and post-market monitoring.

Hangs off: Article 12: logging and traceability

Editorially reviewed | high-risk-requirements

Describe capabilities, limitations, accuracy, oversight measures and expected lifetime in comprehensible form.

Hangs off: Article 13: transparency towards deployers

Editorially reviewed | high-risk-requirements

Determine oversight measures per system, appoint competent persons and give them the mandate to intervene or stop.

Hangs off: Article 14: human oversight

Editorially reviewed | high-risk-requirements

Determine appropriate accuracy, test robustness against errors and misuse, and take AI-specific security measures.

Hangs off: Article 15: accuracy, robustness and cybersecurity

Editorially reviewed | high-risk-requirements

Describe strategies, procedures and responsibilities for compliance, from design and data to post-market monitoring.

Hangs off: Article 17: quality management system

Editorially reviewed | high-risk-requirements

Determine for each role, system and context which combination of instruction, guidance, practice or training is appropriate.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

Map roles against the AI systems they use and record per combination what a person must be able to judge: what the system does, where it fails, who it is applied to, and when to intervene or escalate.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

Attach the literacy measure to two fixed moments in existing processes: the rollout of a new AI tool and the onboarding of anyone gaining access to an existing tool.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

Before procurement, build or deployment, check whether the use case falls under a prohibited practice and stop or redesign early rather than after the fact.

Hangs off: Article 5: prohibited practices

Editorially reviewed | prohibited-practices

First determine which paragraph of Article 50 applies, then implement the specific transparency measure.

Hangs off: Article 50: transparency

Editorially reviewed | transparency

Determine per channel whether the text is published to inform the public on matters of public interest, who performs the human review, who holds editorial responsibility, and which standard wording you use when the disclosure is required.

Hangs off: Article 50: transparency

Editorially reviewed | transparency

For each AI system, walk through the distinct Article 50 scenarios (direct interaction, synthetic output, emotion recognition or biometric categorisation, deep fake, published text on matters of public interest) and record per paragraph whether it applies, does not apply or falls under an exception, with the reason.

Hangs off: Article 50: transparency

Editorially reviewed | transparency

Evaluate the model including adversarial testing, assess and mitigate systemic risks, report serious incidents and secure the model.

Hangs off: Article 55: GPAI models with systemic risk

Editorially reviewed | gpai-systemic-risk

Apply to the competent authority, agree a specific sandbox plan, and record which uncertainty about the Regulation you want resolved inside the sandbox.

Hangs off: Article 57: AI regulatory sandboxes

Editorially reviewed | innovation

Draw up a real-world testing plan, submit it to the market surveillance authority, obtain approval, register the test with a Union-wide unique single identification number, and record the division of roles with your deployer.

Hangs off: Article 60: testing in real world conditions outside a sandbox

Editorially reviewed | innovation

Systematically collect and analyse real-world data on the system’s performance and compliance throughout its lifetime.

Hangs off: Article 72: post-market monitoring

Editorially reviewed | post-market

Define what a serious incident is, assign the reporting route to the supervisor and rehearse the process.

Hangs off: Article 73: serious incident reporting

Editorially reviewed | post-market

Identify and analyse known and reasonably foreseeable risks, evaluate them and take measures, repeating the cycle on every change.

Hangs off: Article 9: risk management system

Editorially reviewed | high-risk-requirements

Translate the twelve points (a) to (l) into twelve named owners with a start date, so that no point falls between product management, quality and legal.

Hangs off: Article 16: the twelve duties of a provider of a high-risk AI system

Editorially reviewed | high-risk-requirements

Select the correct assessment procedure, draw up the EU declaration of conformity, affix the CE marking and register in the EU database.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Editorially reviewed | conformity

Name the categories of natural persons and groups likely to be affected by the use in this specific context, and work out the specific risks of harm per category, using the information the provider supplied under Article 13.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights

Assess process, duration, affected persons, risks, oversight, mitigation and complaint mechanisms and notify results where required.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights, high-risk

Describe the measures taken if a risk materialises, who decides internally, through which route an affected person can complain, within which deadline you respond, and who is authorised to stop the use.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights

Maintain technical documentation, information for downstream providers, a copyright policy and a public summary of training content.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | gpai

Build one package for providers integrating your model, covering the intended tasks and integration options, acceptable use policies, release date and distribution methods, interaction with external hardware or software, software versions, architecture and parameter count, modality and format of inputs and outputs including maximum size, licence, required technical means, and information on the training, testing and validation data used.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | gpai

Record which techniques you use to identify a reservation of rights within the meaning of Article 4(3) of Directive (EU) 2019/790 when collecting training data, how often you recheck, and how you then comply with that reservation.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | gpai

Ensure your complaints or objections desk recognises a request for an explanation of an AI-supported decision, that it can be traced per decision which system in which version contributed to it, and that someone is designated to give the explanation.

Hangs off: Article 86: right to an explanation of a decision

Editorially reviewed | fundamental-rights

Record per AI system which assessment was carried out, by whom, on what date and against which system version, and agree who receives a question from the authority and within what period.

Hangs off: Article 85: right to lodge a complaint with the market surveillance authority

Editorially reviewed | fundamental-rights

Verify the CE marking, the presence of the EU declaration of conformity and the instructions for use, and whether the provider and importer complied with Article 16, points (b) and (c), and Article 23(3).

Hangs off: Article 24: obligations of distributors

Editorially reviewed | value-chain

Check and record: the conformity assessment has been carried out, the technical documentation exists, the CE marking plus declaration and instructions for use are present, and an authorised representative has been appointed.

Hangs off: Article 23: obligations of importers

Editorially reviewed | value-chain

On white-labelling, substantial modification or purpose change, assess whether your organisation becomes the provider, and arrange the representative for non-EU supply.

Hangs off: Articles 22-25: value chain and authorised representative

Editorially reviewed | value-chain

The Commission office that supervises providers of general-purpose AI models. AI Office enforcement is active since 2 August 2026.

Editorially reviewed | enforcement, governance, gpai

The authorised representative is the party located in the Union that, on the basis of a written mandate, performs and carries out the obligations and procedures of the Regulation on behalf of a provider established outside the EU. The definition in Article 3(5) already applies today, so the role can be determined now. The appointment duty itself starts on 2 December 2027 for the standalone Annex III route and on 2 August 2028 for the embedded Annex I route. From those dates, a third-country provider may not place a high-risk AI system on the Union market without an appointed representative.

Editorially reviewed | value-chain

A deployer of the relevant creditworthiness or life and health insurance systems in Annex III point 5(b) or 5(c).

Editorially reviewed | fundamental-rights, high-risk

An organisation using an AI system under its authority, excluding personal non-professional use.

Editorially reviewed | governance

You are a distributor if you make an AI system available on the Union market without being the provider or the importer. This catches resellers, systems integrators and managed service providers that pass on someone else's AI.

Editorially reviewed | value-chain

A party that places a general-purpose AI model on the Union market.

Editorially reviewed | gpai

You are an importer as soon as you, from within the EU, first place an AI system on the Union market that bears the name or trade mark of a party established outside the EU. What counts is not your purchasing role but whose brand is on the system and who first brings it to market.

Editorially reviewed | value-chain

The national authority that supervises compliance with the Regulation and receives serious incident and risk notifications. Which body fills this role per Member State is not recorded in the graph.

Editorially reviewed | enforcement, governance

A party that develops or has an AI system developed and places it on the market under its own name.

Editorially reviewed | governance

A deployer that is a body governed by public law.

Editorially reviewed | fundamental-rights

A private deployer providing public services.

Editorially reviewed | fundamental-rights

The regulation entered into force on 1 August 2024, after which the obligations followed in phases.

Hangs off: Article 4: AI literacy, Article 5: prohibited practices

Placed against the official source | timeline

Since 2 February 2025 the Article 5 prohibition and the Article 4 AI literacy duty apply.

Hangs off: Article 4: AI literacy, Article 5: prohibited practices

Placed against the official source | ai-literacy, timeline

The voluntary code of practice gives GPAI model providers a route to demonstrate compliance.

Hangs off: Article 53: GPAI model providers

Placed against the official source | gpai

The Commission explains when someone becomes the provider of a GPAI model, including through fine-tuning.

Hangs off: Article 53: GPAI model providers, Article 55: GPAI models with systemic risk

Placed against the official source | gpai

The Commission draws the line between software that does and does not fall under the regulation.

Hangs off: Annex III: high-risk AI, Article 4: AI literacy

Placed against the official source | scope

Worked examples for each Article 5 prohibition, with the line between permitted and prohibited.

Hangs off: Article 5: prohibited practices

Placed against the official source | prohibited

Since 2 August 2025 the obligations for providers of general-purpose AI models apply.

Hangs off: Article 53: GPAI model providers, Article 55: GPAI models with systemic risk

Placed against the official source | gpai, timeline

The Commission explains in consultation when a system falls under Annex I or Annex III.

Hangs off: Annex III: high-risk AI, Articles 43-49: conformity assessment, CE and registration

Placed against the official source | high-risk

A voluntary route to comply with parts of Article 50, in two separately signable sections.

Hangs off: Article 50: transparency

Placed against the official source | transparency

EN 18286:2026 on the quality management system is the first completed standard under the standardisation request.

Hangs off: Article 17: quality management system

Placed against the official source | standards

The Commission works out the transparency duties and confirms they apply from 2 August 2026.

Hangs off: Article 50: transparency

Placed against the official source | transparency

The amended application date has been binding law since 27 July 2026.

Hangs off: Annex III: high-risk AI

Placed against the official source | high-risk

Since 27 July 2026 the organisational duty supports the development of AI literacy without guaranteeing an individual level.

Hangs off: Article 4: AI literacy

Placed against the official source | ai-literacy

The FRIA for the relevant Annex III route follows 2 December 2027 and may include or cross-reference relevant DPIA elements.

Hangs off: Article 27: FRIA

Placed against the official source | fundamental-rights, high-risk

The transparency duties apply since 2 August 2026.

Hangs off: Article 50: transparency

Placed against the official source | transparency

Since 2 August 2026 the Commission can request GPAI information, conduct evaluations and require measures.

Hangs off: Article 53: GPAI model providers

Placed against the official source | enforcement, gpai

Systems placed on the market before 2 August 2026 must comply with Article 50(2) by 2 December 2026.

Hangs off: Article 50: transparency

Placed against the official source | timeline, transparency

The Digital Omnibus prohibits AI for child sexual abuse material and non-consensual intimate imagery.

Hangs off: Article 5: prohibited practices

Placed against the official source | prohibited, timeline

Models placed on the market before 2 August 2025 have until 2 August 2027.

Hangs off: Article 53: GPAI model providers, Article 55: GPAI models with systemic risk

Placed against the official source | gpai, timeline

AI as a safety component of products under Annex I follows on 2 August 2028.

Hangs off: Annex III: high-risk AI, Articles 43-49: conformity assessment, CE and registration

Placed against the official source | high-risk, timeline

Reopen classification when intended purpose, use context or system functionality changes materially.

Hangs off: Annex III: high-risk AI

Editorially reviewed | control, high-risk

Block signature of an AI contract until the supplier has answered in writing which Annex III point the intended purpose falls under, whether it relies on Article 6(3), and whether the system profiles natural persons.

Hangs off: Annex III: high-risk AI

Editorially reviewed | high-risk

Repeat the data quality assessment before every retraining or dataset change.

Hangs off: Article 10: data and data governance

Editorially reviewed | control, high-risk-requirements

Update the file before every release and retain earlier versions traceably.

Hangs off: Article 11: technical documentation

Editorially reviewed | control, high-risk-requirements

Periodically verify that logging works, is complete and is retained according to the regime.

Hangs off: Article 12: logging and traceability

Editorially reviewed | control, high-risk-requirements

At every deployment and update, verify instructions are present, current and internally translated.

Hangs off: Article 13: transparency towards deployers

Editorially reviewed | control, high-risk-requirements

Before go-live, test that intervening, stopping and disregarding output actually works and is assigned.

Hangs off: Article 14: human oversight

Editorially reviewed | control, high-risk-requirements

Monitor whether the system stays within declared levels in production and escalate on deviation.

Hangs off: Article 15: accuracy, robustness and cybersecurity

Editorially reviewed | control, high-risk-requirements

A hard block in your release or delivery process: no delivery without a completed conformity assessment, a signed EU declaration of conformity, an affixed CE marking and a completed registration.

Hangs off: Article 16: the twelve duties of a provider of a high-risk AI system

Editorially reviewed | high-risk-requirements

Periodically audit whether practice follows the described system and record deviations and improvements.

Hangs off: Article 17: quality management system

Editorially reviewed | control, high-risk-requirements

Periodically reconcile the list of accounts and licences with access to AI systems against the participation and instruction register, and clear the gap list with an owner and a deadline.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

Check when systems, roles or risks change whether the selected measures remain appropriate.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy, control

Repeat the screening for every new system, procurement and material change of purpose or context; an earlier clearance does not cover a new use.

Hangs off: Article 5: prohibited practices

Editorially reviewed | control, prohibited-practices

Each quarter, sample the systems carrying an Article 50 scenario and verify in the production environment that the disclosure still appears and the marking is still present in the actual output, recording finding, owner and remediation deadline.

Hangs off: Article 50: transparency

Editorially reviewed | transparency

Before release, test that the applicable disclosure, marking or label is timely, clear and technically effective.

Hangs off: Article 50: transparency

Editorially reviewed | control, transparency

Monitor cumulative training compute and notify the Commission when the threshold is reached.

Hangs off: Article 55: GPAI models with systemic risk

Editorially reviewed | control, gpai-systemic-risk

The authority retains its supervisory and corrective powers and can suspend your testing or participation. If you stay within the plan and follow the guidance in good faith, authorities impose no administrative fines for infringements of this Regulation.

Hangs off: Article 57: AI regulatory sandboxes

Editorially reviewed | innovation

The market surveillance authority may inspect unannounced. On a serious incident you report, take immediate mitigation or suspend, and you must have a procedure in place in advance for prompt recall of the system.

Hangs off: Article 60: testing in real world conditions outside a sandbox

Editorially reviewed | innovation

Ensure real-world signals (deviations, complaints, incidents) demonstrably lead to analysis and, where needed, measures.

Hangs off: Article 72: post-market monitoring

Editorially reviewed | control, post-market

Periodically test whether an incident can be reported within the legal deadlines, including the deployer-to-provider chain.

Hangs off: Article 73: serious incident reporting

Editorially reviewed | control, post-market

Reopen the risk management process on changes in purpose, data, model or use context and before every release.

Hangs off: Article 9: risk management system

Editorially reviewed | control, high-risk-requirements

Rerun the conformity route whenever the system is substantially modified.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Editorially reviewed | conformity, control

A fixed rule that suspends use and notifies in the correct order as soon as you have reason to consider the system presents a risk or as soon as you identify a serious incident.

Hangs off: Article 26: obligations of deployers of high-risk AI systems

Editorially reviewed | high-risk-requirements

A pre-arranged capability to bring an already supplied system into conformity, withdraw it or recall it, and to immediately notify the provider or importer and the competent authorities.

Hangs off: Article 24: obligations of distributors

Editorially reviewed | value-chain

The control that ensures an incoming request reaches an identifiable person within a set period and is answered, instead of sitting in a general inbox.

Hangs off: Article 85: right to lodge a complaint with the market surveillance authority, Article 86: right to an explanation of a decision

Editorially reviewed | fundamental-rights

Periodically and on every change in process, duration of use, affected groups, risks or oversight measures, check whether the recorded elements still hold, and update the information as soon as they do not.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights

Block deployment until applicability, assessment, mitigation and notification have been completed.

Hangs off: Article 27: FRIA

Editorially reviewed | control, fundamental-rights

Establish every six months whether you demonstrate compliance through a code of practice, through a published harmonised standard, or through alternative adequate means, and whether the underlying file matches that choice.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | gpai

Update documentation and downstream information when the model, capabilities or risks change.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | control, gpai

As soon as you have sufficient reason to consider a system non-conforming or falsified, it does not go to market, and where there is a risk you notify the provider, the authorised representative and the market surveillance authorities.

Hangs off: Article 23: obligations of importers

Editorially reviewed | value-chain

Repeat the role assessment on every rebranding, modification or new use of an existing system.

Hangs off: Articles 22-25: value chain and authorised representative

Editorially reviewed | control, value-chain

The role carrying the heaviest obligations, and the role organisations most often end up in by accident.

Placed against the official source | definitions

A conformity assessment body notified in accordance with this regulation and other relevant Union harmonisation legislation. Only notified bodies may carry out the external assessments under the AI Act.

Placed against the official source | definitions

The national authority responsible for setting up and carrying out the procedures for assessing, designating and notifying conformity assessment bodies, and for monitoring them.

Placed against the official source | definitions

Not a standalone authority but a function within the European Commission. For general-purpose AI models the AI Office is your supervisor; for ordinary AI systems it is not.

Placed against the official source | definitions

Skills, knowledge and understanding that enable providers, deployers and affected persons to deploy AI systems in an informed way and to become aware of the opportunities, risks and possible harm of AI.

Placed against the official source | definitions

The model is not the system, and that distinction determines which chapter of obligations applies to you.

Placed against the official source | definitions

The gateway definition of the Regulation's system track: if your application falls outside it, the obligations for AI systems do not apply. General-purpose AI models run on a separate track under Article 3(63), with their own obligations in Article 53.

Placed against the official source | definitions

A controlled framework set up by a competent authority in which you may temporarily develop, train, validate and test an innovative AI system under regulatory supervision, following a sandbox plan.

Placed against the official source | definitions

The use set by the provider on which the entire risk classification and assessment rest.

Placed against the official source | definitions

The sensitive data categories from the GDPR and related European rules, imported here because the AI Act attaches both a prohibition and a narrow exception to them.

Placed against the official source | definitions

The AI Act uses its own, broader wording than the GDPR, and that difference decides whether you land in Annex III or Article 5.

Placed against the official source | definitions

A one-to-many comparison against a database, to be distinguished from the one-to-one verification of point 36.

Placed against the official source | definitions

The residual category: any remote identification that is not real-time. Not prohibited, but high-risk, and subject to its own authorisation regime in law enforcement.

Placed against the official source | definitions

Remote identification where capture, comparison and identification happen without significant delay. The legislator explicitly closed the escape route of an artificial delay.

Placed against the official source | definitions

The marking by which a provider indicates that an AI system conforms to the requirements of Chapter III, Section 2 and to other applicable Union harmonisation legislation providing for its affixing.

Placed against the official source | definitions

The process of demonstrating that a high-risk AI system meets the requirements of Chapter III, Section 2. It is the evidence step for high-risk systems, not for all AI.

Placed against the official source | definitions

A body that performs third-party conformity assessment activities, including testing, certification and inspection.

Placed against the official source | definitions

Far broader than fake videos of famous people: objects, places, entities and events are covered too.

Placed against the official source | definitions

Any link in the supply chain that makes an AI system available on the Union market and is neither provider nor importer.

Placed against the official source | definitions

A provider of an AI system, including a general-purpose AI system, which integrates an AI model, regardless of whether that model is provided by themselves and vertically integrated or obtained from another entity on a contractual basis.

Placed against the official source | definitions

Prohibited in the workplace and in education since 2 February 2025; elsewhere an information duty under Article 50 applies since 2 August 2026.

Placed against the official source | definitions

Four categories of consequence, one of which is an infringement of fundamental rights protection. No physical harm is needed before a notification duty arises.

Placed against the official source | definitions

The information the provider supplies to inform the deployer about, in particular, the intended purpose and proper use of an AI system. It is the hinge between the provider's obligations and the deployer's.

Placed against the official source | definitions

The role that virtually every organisation buying and using AI ends up in.

Placed against the official source | definitions

A European standard published in the Official Journal which, if you apply it, produces a presumption of conformity. This is the fastest route to demonstrability, but the AI Act standards are not finished yet.

Placed against the official source | definitions

A subject's freely given, specific, unambiguous and voluntary expression of willingness to take part in a particular real-world test, after having been informed of all aspects relevant to that decision.

Placed against the official source | definitions

The European point of contact for a provider from outside the Union, valid only on the basis of a written mandate.

Placed against the official source | definitions

Technical specifications the Commission can adopt itself when harmonised standards are missing or fall short. The fallback that prevents the AI Act from stalling because standardisation is delayed.

Placed against the official source | definitions

Operational data around detection and prosecution whose disclosure could harm criminal proceedings. The concept on which the law enforcement exceptions to transparency rest.

Placed against the official source | definitions

Whoever places on the Union market a system bearing the name or trademark of a party established in a third country.

Placed against the official source | definitions

The first moment a system or model is made available on the Union market, and therefore the trigger for many obligations.

Placed against the official source | definitions

The concept that brings internally built systems which are never sold within the scope of the Regulation.

Placed against the official source | definitions

The data entering the system or acquired by it, on the basis of which it produces its output. This is the data definition that touches the deployer, not just the provider.

Placed against the official source | definitions

Critical infrastructure as defined in Article 2, point (4), of Directive (EU) 2022/2557, the CER Directive. The AI Act gives no definition of its own here but aligns with that framework.

Placed against the official source | definitions

The national supervisor that enforces the AI Act on the market, with the powers from the general market surveillance regulation. This is the party that comes knocking and requests your documentation.

Placed against the official source | definitions

An umbrella term for two very different roles: the notifying authority and the market surveillance authority. For EU institutions the European Data Protection Supervisor takes their place.

Placed against the official source | definitions

Everything that is not personal data. The category exists to make clear that the AI Act applies even when no personal data is involved.

Placed against the official source | definitions

Any physical place, publicly or privately owned, accessible to an undetermined number of people. Access conditions and capacity limits are irrelevant.

Placed against the official source | definitions

The umbrella term for all six roles in the chain, and not the person operating the controls.

Placed against the official source | definitions

The AI Act deliberately creates no separate concept here and refers to the GDPR. Your GDPR records and your AI Act file must therefore cover the same data.

Placed against the official source | definitions

The document in which you set out in advance how you will test an AI system outside the lab: objective, methodology, scope, who takes part, for how long and how you monitor it. Without this plan, testing in real-world conditions is not permitted.

Placed against the official source | definitions

The ability of an AI system to achieve its intended purpose. Performance is therefore measured against the intended purpose, not against a standalone technical score.

Placed against the official source | definitions

For the purpose of real-world testing, a subject is a natural person who participates in such a test. The term comes from the testing regime, not from data protection law.

Placed against the official source | definitions

Taken from the GDPR, but decisive in the AI Act: an Annex III system that profiles always remains high-risk.

Placed against the official source | definitions

The activity, not the authority. Work carried out on behalf of a law enforcement authority is covered as well, including where a private party performs it.

Placed against the official source | definitions

Not just the police and prosecution service. Also any other body entrusted under national law with public authority for detection, prosecution or public security.

Placed against the official source | definitions

Use outside the intended purpose that the provider could have seen coming, and must therefore anticipate.

Placed against the official source | definitions

Risk is the combination of the probability of harm occurring and the severity of that harm. It is the unit of measurement underpinning the entire regulation, from prohibited practices to the Article 9 risk management system.

Placed against the official source | definitions

A change to an AI system after it has been placed on the market or put into service that the provider did not foresee in the initial conformity assessment, and that affects compliance with Chapter III, Section 2 or changes the intended purpose.

Placed against the official source | definitions

An AI system that assigns people to categories on the basis of their biometric data. The carve-out for functions ancillary to another commercial service is narrow and is routinely read far too broadly in practice.

Placed against the official source | definitions

An AI system that identifies people without their active involvement, typically at a distance, by comparing them against a reference database. The decisive words are "active involvement".

Placed against the official source | definitions