Why this object hangs off that object

Assess Article 5, Article 6 and Annex III in that order and document purpose, context and any Article 6(3) exception.

Editorially reviewed | high-risk

Determine whether you are the provider of the model, appoint an authorised representative established in the Union by written mandate before placing the model on the market, and write out in that mandate the four tasks in paragraph 3, the access to the Annex XI documentation and the point of contact under paragraph 4.

Hangs off: Article 54: authorised representative of a provider of a GPAI model

Editorially reviewed | gpai, value-chain

Assess origin, representativeness, errors and completeness and examine possible bias with appropriate mitigation.

Editorially reviewed | high-risk-requirements

Document system description, development process, data, oversight measures, performance and risk management before market placement.

Editorially reviewed | high-risk-requirements

Ensure the system automatically records events relevant to risk identification and post-market monitoring.

Editorially reviewed | high-risk-requirements

Describe capabilities, limitations, accuracy, oversight measures and expected lifetime in comprehensible form.

Editorially reviewed | high-risk-requirements

Determine oversight measures per system, appoint competent persons and give them the mandate to intervene or stop.

Editorially reviewed | high-risk-requirements

Determine appropriate accuracy, test robustness against errors and misuse, and take AI-specific security measures.

Editorially reviewed | high-risk-requirements

Describe strategies, procedures and responsibilities for compliance, from design and data to post-market monitoring.

Editorially reviewed | high-risk-requirements

Determine for each role, system and context which combination of instruction, guidance, practice or training is appropriate.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

Before procurement, build or deployment, check whether the use case falls under a prohibited practice and stop or redesign early rather than after the fact.

Hangs off: Article 5: prohibited practices

Editorially reviewed | prohibited-practices

First determine which paragraph of Article 50 applies, then implement the specific transparency measure.

Editorially reviewed | transparency

Evaluate the model including adversarial testing, assess and mitigate systemic risks, report serious incidents and secure the model.

Hangs off: Article 55: GPAI models with systemic risk

Editorially reviewed | gpai-systemic-risk

Systematically collect and analyse real-world data on the system’s performance and compliance throughout its lifetime.

Editorially reviewed | post-market

Define what a serious incident is, assign the reporting route to the supervisor and rehearse the process.

Editorially reviewed | post-market

Identify and analyse known and reasonably foreseeable risks, evaluate them and take measures, repeating the cycle on every change.

Editorially reviewed | high-risk-requirements

Select the correct assessment procedure, draw up the EU declaration of conformity, affix the CE marking and register in the EU database.

Editorially reviewed | conformity

Determine per general-purpose AI model whether you adhere to a code of practice, to which version and which chapter, whether under paragraph 7 the obligations in Article 53 suffice for you, and which elaboration of your own you apply for the issues in paragraph 2 where you do not join.

Hangs off: Article 56: codes of practice for general-purpose AI models

Editorially reviewed | governance, gpai, gpai-systemic-risk

Assess process, duration, affected persons, risks, oversight, mitigation and complaint mechanisms and notify results where required.

Editorially reviewed | fundamental-rights, high-risk

Maintain technical documentation, information for downstream providers, a copyright policy and a public summary of training content.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | gpai

State on every submission which part is confidential business information, trade secret or source code, keep track of what was handed to whom on what date, and on a further request ask about the necessity and the purpose within the meaning of Article 78(2).

Hangs off: Article 78: confidentiality of what you submit to an authority

Editorially reviewed | enforcement, governance

Notify the model as soon as it meets the condition in Article 51(1), point (a), or as soon as it becomes known that it will, with the information necessary to demonstrate that the requirement has been met, and with any substantiation that the model does not present systemic risks after all.

Hangs off: Article 52: notification of a GPAI model with systemic risk

Editorially reviewed | gpai-systemic-risk

If your model has been designated under Article 52(4), you may request reassessment by reasoned request. The request must contain objective, detailed and new reasons that have arisen since the designation decision, and may be made at the earliest six months after that decision; where the designation is maintained, a further six months apply.

Hangs off: Article 52: notification of a GPAI model with systemic risk

Editorially reviewed | gpai-systemic-risk

On white-labelling, substantial modification or purpose change, assess whether your organisation becomes the provider, and arrange the representative for non-EU supply.

Editorially reviewed | value-chain

At the moment of choice and periodically thereafter, verify whether the body appears in the Commission public list, for which activities and system types it is notified, whether its designation has been restricted or suspended, and whether the independence of Article 31(4) and (5) holds; also ask which tasks are subcontracted and give your agreement under Article 33(3) in writing.

Hangs off: Articles 28 to 39: notifying authorities and notified bodies

Editorially reviewed | conformity, governance

The Commission office that supervises providers of general-purpose AI models. AI Office enforcement is active since 2 August 2026.

Editorially reviewed | enforcement, governance, gpai

A deployer of the relevant creditworthiness or life and health insurance systems in Annex III point 5(b) or 5(c).

Editorially reviewed | fundamental-rights, high-risk

An organisation using an AI system under its authority, excluding personal non-professional use.

Editorially reviewed | governance

A party that places a general-purpose AI model on the Union market.

Editorially reviewed | gpai

The national authority that supervises compliance with the Regulation and receives serious incident and risk notifications. Which body fills this role per Member State is not recorded in the graph.

Editorially reviewed | enforcement, governance

A party that develops or has an AI system developed and places it on the market under its own name.

Editorially reviewed | governance

A deployer that is a body governed by public law.

Editorially reviewed | fundamental-rights

A private deployer providing public services.

Editorially reviewed | fundamental-rights

The regulation entered into force on 1 August 2024, after which the obligations followed in phases.

Hangs off: Article 4: AI literacy, Article 5: prohibited practices

Placed against the official source | timeline

Since 2 February 2025 the Article 5 prohibition and the Article 4 AI literacy duty apply.

Hangs off: Article 4: AI literacy, Article 5: prohibited practices

Placed against the official source | ai-literacy, timeline

The voluntary code of practice gives GPAI model providers a route to demonstrate compliance.

Hangs off: Article 53: GPAI model providers

Placed against the official source | gpai

The Commission explains when someone becomes the provider of a GPAI model, including through fine-tuning.

Hangs off: Article 53: GPAI model providers, Article 55: GPAI models with systemic risk

Placed against the official source | gpai

The Commission draws the line between software that does and does not fall under the regulation.

Hangs off: Article 4: AI literacy

Placed against the official source | scope

Worked examples for each Article 5 prohibition, with the line between permitted and prohibited.

Hangs off: Article 5: prohibited practices

Placed against the official source | prohibited

Since 2 August 2025 the obligations for providers of general-purpose AI models apply.

Hangs off: Article 53: GPAI model providers, Article 55: GPAI models with systemic risk

Placed against the official source | gpai, timeline

Models placed on the market before 2 August 2025 have until 2 August 2027.

Hangs off: Article 53: GPAI model providers, Article 55: GPAI models with systemic risk

Placed against the official source | gpai, timeline

Reopen classification when intended purpose, use context or system functionality changes materially.

Editorially reviewed | control, high-risk

Repeat the data quality assessment before every retraining or dataset change.

Editorially reviewed | control, high-risk-requirements

Update the file before every release and retain earlier versions traceably.

Editorially reviewed | control, high-risk-requirements

Periodically verify that logging works, is complete and is retained according to the regime.

Editorially reviewed | control, high-risk-requirements

At every deployment and update, verify instructions are present, current and internally translated.

Editorially reviewed | control, high-risk-requirements

Before go-live, test that intervening, stopping and disregarding output actually works and is assigned.

Editorially reviewed | control, high-risk-requirements

Monitor whether the system stays within declared levels in production and escalate on deviation.

Editorially reviewed | control, high-risk-requirements

Periodically audit whether practice follows the described system and record deviations and improvements.

Editorially reviewed | control, high-risk-requirements

Check when systems, roles or risks change whether the selected measures remain appropriate.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy, control

Repeat the screening for every new system, procurement and material change of purpose or context; an earlier clearance does not cover a new use.

Hangs off: Article 5: prohibited practices

Editorially reviewed | control, prohibited-practices

Before release, test that the applicable disclosure, marking or label is timely, clear and technically effective.

Editorially reviewed | control, transparency

Monitor cumulative training compute and notify the Commission when the threshold is reached.

Hangs off: Article 55: GPAI models with systemic risk

Editorially reviewed | control, gpai-systemic-risk

The control that periodically rechecks a reliance on a code of practice: does the version you rely on still stand, has the code been reviewed or adapted under paragraph 8, has the Commission published its assessment of adequacy under paragraph 6 as replaced by Regulation (EU) 2026/1744, and has the Commission laid down common rules under paragraph 9.

Hangs off: Article 56: codes of practice for general-purpose AI models

Editorially reviewed | control, governance, gpai, gpai-systemic-risk

Ensure real-world signals (deviations, complaints, incidents) demonstrably lead to analysis and, where needed, measures.

Editorially reviewed | control, post-market

Periodically test whether an incident can be reported within the legal deadlines, including the deployer-to-provider chain.

Editorially reviewed | control, post-market

The control that sends a submission touching source code, training methodology or trade secrets through a fixed review: is the request reasoned, what purpose was stated, which part is strictly necessary, and who inside the organisation signs off on it.

Hangs off: Article 78: confidentiality of what you submit to an authority

Editorially reviewed | control, enforcement, governance

Reopen the risk management process on changes in purpose, data, model or use context and before every release.

Editorially reviewed | control, high-risk-requirements

Rerun the conformity route whenever the system is substantially modified.

Editorially reviewed | conformity, control

Block deployment until applicability, assessment, mitigation and notification have been completed.

Editorially reviewed | control, fundamental-rights

Update documentation and downstream information when the model, capabilities or risks change.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | control, gpai

The control that ensures the representative can actually reach the documentation, that the verification under paragraph 3(a) is repeated at a fixed moment, and that there is an agreed route for the termination under paragraph 5 with the immediate notification to the AI Office. Without such a moment a mandate stays on paper while nobody tests it.

Hangs off: Article 54: authorised representative of a provider of a GPAI model

Editorially reviewed | control, gpai

The control that absorbs the loss of a notified body: a fixed periodic check of the public list, a contractual reporting duty mirroring the ten days of Article 36(5), a named alternative body for your type of system, and a handover procedure that stays within the nine months of Article 36(3) and (9).

Hangs off: Articles 28 to 39: notifying authorities and notified bodies

Editorially reviewed | conformity, control, governance

The control that ensures the signal from the training pipeline reaches an identifiable owner and that the notification goes out within two weeks. Its trigger point is the allocation of compute and not the end of the run, because recital 111 also counts pre-training, synthetic data and fine-tuning and recital 112 assumes the provider knows the outcome before then. It sits alongside the monitoring of compute itself: that measures the threshold, this guards the clock that starts afterwards.

Hangs off: Article 52: notification of a GPAI model with systemic risk

Editorially reviewed | gpai-systemic-risk

Repeat the role assessment on every rebranding, modification or new use of an existing system.

Editorially reviewed | control, value-chain

Traceable rationale covering intended purpose, Annex III category, Article 6(3) assessment and registration decision.

Editorially reviewed | evidence, high-risk

Record per dataset of origin, choices, assumptions, bias examination and mitigations.

Editorially reviewed | evidence, high-risk-requirements

Technical documentation kept current per system version, ready for a supervisor’s request.

Editorially reviewed | evidence, high-risk-requirements

Log files with a retention period appropriate to the purpose and at least six months for deployers (Articles 19 and 26).

Editorially reviewed | evidence, high-risk-requirements

The received instructions for use plus their internal translation into work instructions per role.

Editorially reviewed | evidence, high-risk-requirements

Record of oversight measures, appointed persons, their training and the moments of intervention.

Editorially reviewed | evidence, high-risk-requirements

Declared accuracy levels, test results, and measures against data poisoning and adversarial attacks among others.

Editorially reviewed | evidence, high-risk-requirements

The documented quality system with procedures, role assignment and references to the underlying files.

Editorially reviewed | evidence, high-risk-requirements

Versioned record of roles, context, measures, participation or instruction and review moments.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy, evidence

A record per system that the Article 5 screening was performed, with outcome and reasoning. The conclusion "no prohibited practice" is evidence too.

Hangs off: Article 5: prohibited practices

Editorially reviewed | evidence, prohibited-practices

Record of scenario, actor, disclosure or marking, technical implementation, test and owner.

Editorially reviewed | evidence, transparency

Evaluation results, risk assessments, mitigations, incident reports and security measures per model version.

Hangs off: Article 55: GPAI models with systemic risk

Editorially reviewed | evidence, gpai-systemic-risk

Per model: the decision whether or not to adhere to a code of practice, the version and chapter it relates to, the date and the authorised signatory, whether adherence was limited under paragraph 7 to the obligations in Article 53, and, where the decision is negative, the elaboration of your own for the issues in paragraph 2.

Hangs off: Article 56: codes of practice for general-purpose AI models

Editorially reviewed | evidence, governance, gpai, gpai-systemic-risk

The plan as part of the technical documentation plus the periodic analyses and follow-up actions.

Editorially reviewed | evidence, post-market

Record of incidents, analyses, reports to supervisors and corrective measures.

Editorially reviewed | evidence, post-market

Per submission: which system, which document, which version, to which recipient, on what date, which part was marked confidential, and which purpose the recipient stated.

Hangs off: Article 78: confidentiality of what you submit to an authority

Editorially reviewed | enforcement, evidence, governance

Versioned record of risk analyses, chosen measures, residual risks and test results per system version.

Editorially reviewed | evidence, high-risk-requirements

The assessment, EU declaration of conformity, CE marking and registration proof, per system version.

Editorially reviewed | conformity, evidence

Dated impact assessment, measures, residual risks and, where required, notification to the market surveillance authority.

Editorially reviewed | evidence, fundamental-rights

Current technical documentation, downstream information, copyright policy and public training summary.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | evidence, gpai

The written mandate itself, in an official language of the institutions of the Union, together with the copy of the Annex XI technical documentation, the contact details of the provider, and the record of the verification under paragraph 3(a). The provider grants the mandate and supplies the documentation; the ten year retention after the placing on the market rests under paragraph 3(b) with the representative, which keeps the file at the disposal of the AI Office and national competent authorities.

Hangs off: Article 54: authorised representative of a provider of a GPAI model

Editorially reviewed | evidence, gpai

Per body: identification number, Member State of establishment, the conformity assessment activities and system types for which it is notified, the date of each check against the public list, the outcome of the independence test, the subcontracted tasks with your written agreement, and every notice of a change to its designation.

Hangs off: Articles 28 to 39: notifying authorities and notified bodies

Editorially reviewed | conformity, evidence, governance

Per model version: the measured and planned training compute with the scope of recital 111, so including pre-training, synthetic data generation and fine-tuning, the moment the threshold was reached or foreseen, the notification sent with its supporting information, any arguments under paragraph 2, any reassessment request under paragraph 5, and the response or designation decision of the Commission.

Hangs off: Article 52: notification of a GPAI model with systemic risk

Editorially reviewed | gpai-systemic-risk

Record per system of role, contractual arrangements on information and cooperation, and the appointment of a representative where required.

Editorially reviewed | evidence, value-chain

An organisation secures the entrances to its buildings with facial recognition and uses that biometric access control to register visitors as well. When the system returns no match, a security officer reviews the camera images and decides personally whether someone may enter. The question is whose measures have to reach that officer: those of the supplier of the model, those of the department that deploys the system, or both.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A police force uses AI to search large volumes of investigation files and surface connections a detective would otherwise miss. The outputs feed into the choice of which suspect is pursued further and end up in documents that enter the criminal process. The question is whether one and the same basic instruction is enough for the analyst operating the model and for the detective who acts on its output.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A newsroom uses generative AI to prepare summaries, headlines and imagery, after which an editor finishes the piece and the desk decides to publish. Part of that work sits with freelancers, and an outside agency produces marketing content with the same tools. The question is whether your AI literacy measures must reach those freelancers and that agency, or only the people on the payroll.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A recruiter deploys an AI chat that puts candidates through a first screening conversation after they respond to a job posting, and adds their answers to their CV. The chat introduces itself with a first name and writes in a casual conversational tone. The question is whether these applicants reasonably realise that they are talking to an AI system.

Placed against the official source | examples

An employer uses an AI system that scores employee performance and lets that score weigh in promotion and dismissal. After a change to the model it turns out that a group of staff was scored too low for months, and decisions have already been taken on those scores. HR wonders whether this is a serious incident and who would have to report it.

Placed against the official source | examples

A manufacturer supplies an AI system that runs as a safety component in a machine on the production line and at the same time drives quality control. At a customer's factory an operator is seriously injured after the machine failed to stop on an anomaly. The question is who reports, to whom, and which clock is already running at that moment.

Placed against the official source | examples

A municipality wants to deploy an AI system that sorts applications for social assistance benefits and indicates which files merit extra scrutiny before a case worker decides. The application is already listed in the public algorithm register. The question is what has to be in place before the first citizen passes through this system.

Placed against the official source | examples

A police service deploys an AI system that estimates the recidivism risk of a suspect, as an aid to the judgements later made by the prosecution service and the court. The model is subsequently retrained on newer investigative data and use is extended to a second region. The question is whether the assessment made for first use remains adequate.

Placed against the official source | examples

A university of applied sciences has an AI system rank applications for a vocational programme, using the exam results of earlier students to calibrate that ranking. A data protection impact assessment already exists for this processing. The question the school asks is whether that also covers the fundamental rights side of admission.

Placed against the official source | examples

A university of applied sciences uses a purchased AI system that ranks student admissions and also raises flags during digital assessment. The logs sit in the supplier environment, which hands them over on request. The teaching organisation wonders whether that settles the matter or whether the school retains a duty of its own.

Placed against the official source | examples

A manufacturer supplies an AI system that runs as a safety component inside the machinery of a production line and also drives quality control. The factory operating the line keeps only the alerts visible in the local controller; the rest of the recording flows to the supplier environment. The question is who has to keep which logs when it later has to be reconstructed why the line was halted.

Placed against the official source | examples

An employer deploys an AI system that handles task allocation among staff and summarises their performance for the performance review. HR wants to know what record of those outcomes has to be retained when an employee objects months later to a promotion decision.

Placed against the official source | examples

A police service fine-tunes an open general-purpose model on its own files from ongoing criminal investigations, so that detectives can see links between suspects and cases sooner. The fine-tuned model stays inside the service and is not made available to anyone else. The question is whether the service thereby becomes a provider of a general-purpose AI model itself, and so falls under Article 53.

Hangs off: Article 53: GPAI model providers

Placed against the official source | examples

A provider supplies a system that summarises employee performance data and supports HR in promotion decisions. After a year in use, departments turn out to apply it differently than intended, and managers factor the outputs into the performance review. The question is what the provider is supposed to know about that.

Placed against the official source | examples

A vendor offers proctoring software that flags possible cheating during exams. Several universities of applied sciences use the system, each with its own assessment formats and its own student populations. The vendor wants to know which real-world data it must keep collecting after roll-out, and from whom.

Placed against the official source | examples

A manufacturer supplies an AI safety component that halts machinery on a production line as soon as someone comes too close to the robot. The component already falls under product legislation for machinery, and the manufacturer runs quality control and incident follow-up for it. The question is what Article 72 adds on top of that.

Placed against the official source | examples

A university of applied sciences uses proctoring software during an online exam and finds that a group of students is systematically and wrongly flagged as suspicious, after which grades were withdrawn. Teaching staff and the examination board want to know whether this pattern is a serious incident and, if so, who has to report it and within what time.

Placed against the official source | examples

A higher education institution procures an AI system that organises student applications and enrolment and produces an admission recommendation for each candidate in its vocational programmes. The supplier says it handles the conformity assessment itself and affixes the CE marking. What is left unresolved is whether the institution still has a step of its own to take before the system goes into use in its teaching.

Placed against the official source | examples

A non-food retail chain lets customers pay later in its webshop and decides at checkout whether a consumer qualifies. The team builds that assessment system in house, on top of a pre-trained model supplied by a vendor. The question is what has to be on record before the feature goes live, and who has to put it there.

Placed against the official source | examples

Section 4 of Chapter III governs who may carry out your conformity assessment and on what conditions that power continues to exist. Each Member State designates a notifying authority that assesses, designates, notifies and monitors conformity assessment bodies. A notified body is established under the national law of a Member State, has legal personality, and is independent of the provider, of any other operator with an economic interest and of the provider competitors; consultancy services in particular are ruled out. Subcontracting to a subcontractor or a subsidiary is allowed only with the agreement of the provider, and the body then retains full responsibility. In its work it avoids unnecessary burdens for providers and minimises administrative burdens and compliance costs for micro- and small enterprises, without giving up the required degree of rigour. Article 36 distinguishes the cases. Where it ceases its activities, the certificates remain valid under paragraph 3 for at most nine months, provided another notified body assumes responsibility in writing. Where its designation is suspended, restricted or withdrawn, it informs the providers concerned within ten days under paragraph 5; paragraph 8 sets continuity conditions there without that general nine-month limit, and paragraph 9 gives certificates a nine-month validity on withdrawal, with a conditional extension in periods of three months up to twelve months at most. A body from a third country can carry out these activities only where the Union has concluded an agreement with that country.

Placed against the official source | conformity, governance

Original duty to take measures for a sufficient level of AI literacy.

Placed against the official source | ai-literacy

The prohibition of AI practices carrying unacceptable risk, such as manipulation, social scoring and certain biometric applications.

Placed against the official source | prohibited-practices

The provider of a general-purpose AI model that meets the condition in Article 51(1), point (a), notifies the Commission without delay and in any event within two weeks, with the information needed to demonstrate that the requirement has been met. With that notification the provider may present substantiated arguments that the model exceptionally does not present systemic risks after all.

Placed against the official source | gpai-systemic-risk

Documentation, information, copyright and transparency duties for providers of general-purpose AI models.

Placed against the official source | gpai

A provider established in a third country appoints, by written mandate, an authorised representative established in the Union before placing a general-purpose AI model on the Union market. The representative performs the tasks the mandate assigns to it and provides a copy of that mandate to the AI Office upon request. The mandate empowers it at least to verify the documentation, keep a copy available for ten years, provide information and cooperate, and appoints it as the point of contact in addition to or instead of the provider.

Hangs off: Article 53: GPAI model providers, Article 55: GPAI models with systemic risk

Placed against the official source | gpai, value-chain

Additional duties for the most capable general-purpose AI models, on top of Article 53.

Placed against the official source | gpai-systemic-risk

The AI Office encourages and facilitates the drawing up of codes of practice at Union level, and the AI Office and the Board see to it that those codes cover at least the obligations in Articles 53 and 55. Providers of general-purpose AI models and national competent authorities may be invited to participate in the drawing up; civil society organisations, industry, academia and other stakeholders may support the process. Until 27 July 2026 the Commission could approve a code of practice by implementing act and give it general validity within the Union; Article 1, point (21), of Regulation (EU) 2026/1744 replaced paragraph 6 and removed that power. Since then the Commission assesses whether the codes cover the obligations of Articles 53 and 55 and publishes that assessment. The codes were to be ready by 2 May 2025 at the latest; if no code existed by 2 August 2025, or if the AI Office deems one inadequate, the Commission may lay down common rules by implementing acts for the implementation of Articles 53 and 55. For you this is therefore not a separate duty but a route: a code is a voluntary instrument with which you can demonstrate compliance.

Placed against the official source | governance, gpai, gpai-systemic-risk

The Commission, the market surveillance authorities, the notified bodies and everyone involved in the application of the Regulation respect the confidentiality of what they obtain in carrying out their tasks, and in doing so expressly protect the intellectual property rights, the confidential business information and the trade secrets of a natural or legal person, including source code. They may request only data that is strictly necessary, must secure it, and must delete it as soon as it is no longer needed. For you this is therefore not a duty but a protection, with a limit: the exception in Article 5 of Directive (EU) 2016/943 remains, and the provision leaves the exchange of information and the dissemination of warnings between authorities untouched.

Placed against the official source | enforcement, governance

Public classifier for the high-risk use cases in Annex III.

Editorially reviewed | high-risk, template

The full legal text in the public AI Act Explorer.

Editorially reviewed | high-risk-requirements, template

The full legal text in the public AI Act Explorer.

Editorially reviewed | high-risk-requirements, template

The full legal text in the public AI Act Explorer.

Editorially reviewed | high-risk-requirements, template

The full legal text in the public AI Act Explorer.

Editorially reviewed | high-risk-requirements, template

The full legal text in the public AI Act Explorer.

Editorially reviewed | high-risk-requirements, template

The full legal text in the public AI Act Explorer.

Editorially reviewed | high-risk-requirements, template

The full legal text in the public AI Act Explorer.

Editorially reviewed | high-risk-requirements, template

The full legal text in the public AI Act Explorer.

Editorially reviewed | high-risk-requirements, template

The full legal text in the public AI Act Explorer.

Editorially reviewed | template, value-chain

The full legal text in the public AI Act Explorer.

Editorially reviewed | template, value-chain

The full legal text in the public AI Act Explorer.

Editorially reviewed | high-risk-requirements, template

The full legal text of Chapter III, Section 4, in the public AI Act Explorer.

Hangs off: Articles 28 to 39: notifying authorities and notified bodies

Editorially reviewed | conformity, governance, template

Public route for structuring measures by role and context.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy, template

The full legal text of the prohibited practices with all categories and exceptions, in the public AI Act Explorer.

Hangs off: Article 5: prohibited practices

Editorially reviewed | prohibited-practices, template

Public decision route for the distinct transparency obligations.

Editorially reviewed | template, transparency

The full legal text in the public AI Act Explorer.

Hangs off: Article 52: notification of a GPAI model with systemic risk

Editorially reviewed | gpai-systemic-risk

The full legal text in the public AI Act Explorer.

Hangs off: Article 54: authorised representative of a provider of a GPAI model

Editorially reviewed | gpai, template

The full legal text in the public AI Act Explorer.

Hangs off: Article 55: GPAI models with systemic risk

Editorially reviewed | gpai-systemic-risk, template

The full legal text in the public AI Act Explorer.

Hangs off: Article 56: codes of practice for general-purpose AI models

Editorially reviewed | governance, gpai, gpai-systemic-risk, template

The full legal text in the public AI Act Explorer.

Editorially reviewed | innovation, template

The full legal text in the public AI Act Explorer.

Editorially reviewed | innovation, template

The full legal text in the public AI Act Explorer.

Editorially reviewed | post-market, template

The full legal text in the public AI Act Explorer.

Editorially reviewed | post-market, template

The full legal text in the public AI Act Explorer.

Hangs off: Article 78: confidentiality of what you submit to an authority

Editorially reviewed | enforcement, governance, template

The full legal text in the public AI Act Explorer.

Editorially reviewed | high-risk-requirements, template

The full legal text in the public AI Act Explorer.

Editorially reviewed | conformity, template

Public generator for structuring a fundamental rights impact assessment.

Editorially reviewed | fundamental-rights, template

Public guide to GPAI model obligations and exceptions.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | gpai, template

The full legal text in the public AI Act Explorer.

Editorially reviewed | template, value-chain