Why this object hangs off that object

Assess Article 5, Article 6 and Annex III in that order and document purpose, context and any Article 6(3) exception.

Hangs off: Annex III: high-risk AI

Editorially reviewed | high-risk

Name, per high-risk system, who exercises oversight, and ensure that person has the competence, training, authority and support to actually set the output aside.

Hangs off: Article 26: obligations of deployers of high-risk AI systems

Editorially reviewed | high-risk-requirements

Assess origin, representativeness, errors and completeness and examine possible bias with appropriate mitigation.

Hangs off: Article 10: data and data governance

Editorially reviewed | high-risk-requirements

Ensure the system automatically records events relevant to risk identification and post-market monitoring.

Hangs off: Article 12: logging and traceability

Editorially reviewed | high-risk-requirements

Describe capabilities, limitations, accuracy, oversight measures and expected lifetime in comprehensible form.

Hangs off: Article 13: transparency towards deployers

Editorially reviewed | high-risk-requirements

Determine oversight measures per system, appoint competent persons and give them the mandate to intervene or stop.

Hangs off: Article 14: human oversight

Editorially reviewed | high-risk-requirements

Determine for each role, system and context which combination of instruction, guidance, practice or training is appropriate.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

Map roles against the AI systems they use and record per combination what a person must be able to judge: what the system does, where it fails, who it is applied to, and when to intervene or escalate.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

Attach the literacy measure to two fixed moments in existing processes: the rollout of a new AI tool and the onboarding of anyone gaining access to an existing tool.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

Before procurement, build or deployment, check whether the use case falls under a prohibited practice and stop or redesign early rather than after the fact.

Hangs off: Article 5: prohibited practices

Editorially reviewed | prohibited-practices

First determine which paragraph of Article 50 applies, then implement the specific transparency measure.

Hangs off: Article 50: transparency

Editorially reviewed | transparency

Determine per channel whether the text is published to inform the public on matters of public interest, who performs the human review, who holds editorial responsibility, and which standard wording you use when the disclosure is required.

Hangs off: Article 50: transparency

Editorially reviewed | transparency

For each AI system, walk through the distinct Article 50 scenarios (direct interaction, synthetic output, emotion recognition or biometric categorisation, deep fake, published text on matters of public interest) and record per paragraph whether it applies, does not apply or falls under an exception, with the reason.

Hangs off: Article 50: transparency

Editorially reviewed | transparency

Apply to the competent authority, agree a specific sandbox plan, and record which uncertainty about the Regulation you want resolved inside the sandbox.

Hangs off: Article 57: AI regulatory sandboxes

Editorially reviewed | innovation

Draw up a real-world testing plan, submit it to the market surveillance authority, obtain approval, register the test with a Union-wide unique single identification number, and record the division of roles with your deployer.

Hangs off: Article 60: testing in real world conditions outside a sandbox

Editorially reviewed | innovation

Systematically collect and analyse real-world data on the system’s performance and compliance throughout its lifetime.

Hangs off: Article 72: post-market monitoring

Editorially reviewed | post-market

Define what a serious incident is, assign the reporting route to the supervisor and rehearse the process.

Hangs off: Article 73: serious incident reporting

Editorially reviewed | post-market

Select the correct assessment procedure, draw up the EU declaration of conformity, affix the CE marking and register in the EU database.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Editorially reviewed | conformity

Name the categories of natural persons and groups likely to be affected by the use in this specific context, and work out the specific risks of harm per category, using the information the provider supplied under Article 13.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights

Assess process, duration, affected persons, risks, oversight, mitigation and complaint mechanisms and notify results where required.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights, high-risk

Describe the measures taken if a risk materialises, who decides internally, through which route an affected person can complain, within which deadline you respond, and who is authorised to stop the use.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights

Ensure your complaints or objections desk recognises a request for an explanation of an AI-supported decision, that it can be traced per decision which system in which version contributed to it, and that someone is designated to give the explanation.

Hangs off: Article 86: right to an explanation of a decision

Editorially reviewed | fundamental-rights

Record per AI system which assessment was carried out, by whom, on what date and against which system version, and agree who receives a question from the authority and within what period.

Hangs off: Article 85: right to lodge a complaint with the market surveillance authority

Editorially reviewed | fundamental-rights

On white-labelling, substantial modification or purpose change, assess whether your organisation becomes the provider, and arrange the representative for non-EU supply.

Hangs off: Articles 22-25: value chain and authorised representative

Editorially reviewed | value-chain

A deployer of the relevant creditworthiness or life and health insurance systems in Annex III point 5(b) or 5(c).

Editorially reviewed | fundamental-rights, high-risk

An organisation using an AI system under its authority, excluding personal non-professional use.

Editorially reviewed | governance

A deployer that is a body governed by public law.

Editorially reviewed | fundamental-rights

A private deployer providing public services.

Editorially reviewed | fundamental-rights

The regulation entered into force on 1 August 2024, after which the obligations followed in phases.

Hangs off: Article 4: AI literacy, Article 5: prohibited practices

Placed against the official source | timeline

Since 2 February 2025 the Article 5 prohibition and the Article 4 AI literacy duty apply.

Hangs off: Article 4: AI literacy, Article 5: prohibited practices

Placed against the official source | ai-literacy, timeline

The Commission draws the line between software that does and does not fall under the regulation.

Hangs off: Annex III: high-risk AI, Article 4: AI literacy

Placed against the official source | scope

Worked examples for each Article 5 prohibition, with the line between permitted and prohibited.

Hangs off: Article 5: prohibited practices

Placed against the official source | prohibited

The Commission explains in consultation when a system falls under Annex I or Annex III.

Hangs off: Annex III: high-risk AI, Articles 43-49: conformity assessment, CE and registration

Placed against the official source | high-risk

A voluntary route to comply with parts of Article 50, in two separately signable sections.

Hangs off: Article 50: transparency

Placed against the official source | transparency

The Commission works out the transparency duties and confirms they apply from 2 August 2026.

Hangs off: Article 50: transparency

Placed against the official source | transparency

The amended application date has been binding law since 27 July 2026.

Hangs off: Annex III: high-risk AI

Placed against the official source | high-risk

Since 27 July 2026 the organisational duty supports the development of AI literacy without guaranteeing an individual level.

Hangs off: Article 4: AI literacy

Placed against the official source | ai-literacy

The FRIA for the relevant Annex III route follows 2 December 2027 and may include or cross-reference relevant DPIA elements.

Hangs off: Article 27: FRIA

Placed against the official source | fundamental-rights, high-risk

The transparency duties apply since 2 August 2026.

Hangs off: Article 50: transparency

Placed against the official source | transparency

Reopen classification when intended purpose, use context or system functionality changes materially.

Hangs off: Annex III: high-risk AI

Editorially reviewed | control, high-risk

Block signature of an AI contract until the supplier has answered in writing which Annex III point the intended purpose falls under, whether it relies on Article 6(3), and whether the system profiles natural persons.

Hangs off: Annex III: high-risk AI

Editorially reviewed | high-risk

Repeat the data quality assessment before every retraining or dataset change.

Hangs off: Article 10: data and data governance

Editorially reviewed | control, high-risk-requirements

Periodically verify that logging works, is complete and is retained according to the regime.

Hangs off: Article 12: logging and traceability

Editorially reviewed | control, high-risk-requirements

At every deployment and update, verify instructions are present, current and internally translated.

Hangs off: Article 13: transparency towards deployers

Editorially reviewed | control, high-risk-requirements

Before go-live, test that intervening, stopping and disregarding output actually works and is assigned.

Hangs off: Article 14: human oversight

Editorially reviewed | control, high-risk-requirements

Periodically reconcile the list of accounts and licences with access to AI systems against the participation and instruction register, and clear the gap list with an owner and a deadline.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

Check when systems, roles or risks change whether the selected measures remain appropriate.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy, control

Repeat the screening for every new system, procurement and material change of purpose or context; an earlier clearance does not cover a new use.

Hangs off: Article 5: prohibited practices

Editorially reviewed | control, prohibited-practices

Each quarter, sample the systems carrying an Article 50 scenario and verify in the production environment that the disclosure still appears and the marking is still present in the actual output, recording finding, owner and remediation deadline.

Hangs off: Article 50: transparency

Editorially reviewed | transparency

Before release, test that the applicable disclosure, marking or label is timely, clear and technically effective.

Hangs off: Article 50: transparency

Editorially reviewed | control, transparency

The market surveillance authority may inspect unannounced. On a serious incident you report, take immediate mitigation or suspend, and you must have a procedure in place in advance for prompt recall of the system.

Hangs off: Article 60: testing in real world conditions outside a sandbox

Editorially reviewed | innovation

Ensure real-world signals (deviations, complaints, incidents) demonstrably lead to analysis and, where needed, measures.

Hangs off: Article 72: post-market monitoring

Editorially reviewed | control, post-market

Periodically test whether an incident can be reported within the legal deadlines, including the deployer-to-provider chain.

Hangs off: Article 73: serious incident reporting

Editorially reviewed | control, post-market

Rerun the conformity route whenever the system is substantially modified.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Editorially reviewed | conformity, control

A fixed rule that suspends use and notifies in the correct order as soon as you have reason to consider the system presents a risk or as soon as you identify a serious incident.

Hangs off: Article 26: obligations of deployers of high-risk AI systems

Editorially reviewed | high-risk-requirements

The control that ensures an incoming request reaches an identifiable person within a set period and is answered, instead of sitting in a general inbox.

Hangs off: Article 85: right to lodge a complaint with the market surveillance authority, Article 86: right to an explanation of a decision

Editorially reviewed | fundamental-rights

Periodically and on every change in process, duration of use, affected groups, risks or oversight measures, check whether the recorded elements still hold, and update the information as soon as they do not.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights

Block deployment until applicability, assessment, mitigation and notification have been completed.

Hangs off: Article 27: FRIA

Editorially reviewed | control, fundamental-rights

Repeat the role assessment on every rebranding, modification or new use of an existing system.

Hangs off: Articles 22-25: value chain and authorised representative

Editorially reviewed | control, value-chain

The national authority responsible for setting up and carrying out the procedures for assessing, designating and notifying conformity assessment bodies, and for monitoring them.

Placed against the official source | definitions

Not a standalone authority but a function within the European Commission. For general-purpose AI models the AI Office is your supervisor; for ordinary AI systems it is not.

Placed against the official source | definitions

Skills, knowledge and understanding that enable providers, deployers and affected persons to deploy AI systems in an informed way and to become aware of the opportunities, risks and possible harm of AI.

Placed against the official source | definitions

The model is not the system, and that distinction determines which chapter of obligations applies to you.

Placed against the official source | definitions

The gateway definition of the Regulation's system track: if your application falls outside it, the obligations for AI systems do not apply. General-purpose AI models run on a separate track under Article 3(63), with their own obligations in Article 53.

Placed against the official source | definitions

The use set by the provider on which the entire risk classification and assessment rest.

Placed against the official source | definitions

The sensitive data categories from the GDPR and related European rules, imported here because the AI Act attaches both a prohibition and a narrow exception to them.

Placed against the official source | definitions

The AI Act uses its own, broader wording than the GDPR, and that difference decides whether you land in Annex III or Article 5.

Placed against the official source | definitions

A one-to-many comparison against a database, to be distinguished from the one-to-one verification of point 36.

Placed against the official source | definitions

The residual category: any remote identification that is not real-time. Not prohibited, but high-risk, and subject to its own authorisation regime in law enforcement.

Placed against the official source | definitions

Remote identification where capture, comparison and identification happen without significant delay. The legislator explicitly closed the escape route of an artificial delay.

Placed against the official source | definitions

Far broader than fake videos of famous people: objects, places, entities and events are covered too.

Placed against the official source | definitions

A provider of an AI system, including a general-purpose AI system, which integrates an AI model, regardless of whether that model is provided by themselves and vertically integrated or obtained from another entity on a contractual basis.

Placed against the official source | definitions

Prohibited in the workplace and in education since 2 February 2025; elsewhere an information duty under Article 50 applies since 2 August 2026.

Placed against the official source | definitions

Four categories of consequence, one of which is an infringement of fundamental rights protection. No physical harm is needed before a notification duty arises.

Placed against the official source | definitions

The information the provider supplies to inform the deployer about, in particular, the intended purpose and proper use of an AI system. It is the hinge between the provider's obligations and the deployer's.

Placed against the official source | definitions

The role that virtually every organisation buying and using AI ends up in.

Placed against the official source | definitions

The concept that brings internally built systems which are never sold within the scope of the Regulation.

Placed against the official source | definitions

The data entering the system or acquired by it, on the basis of which it produces its output. This is the data definition that touches the deployer, not just the provider.

Placed against the official source | definitions

Critical infrastructure as defined in Article 2, point (4), of Directive (EU) 2022/2557, the CER Directive. The AI Act gives no definition of its own here but aligns with that framework.

Placed against the official source | definitions

The national supervisor that enforces the AI Act on the market, with the powers from the general market surveillance regulation. This is the party that comes knocking and requests your documentation.

Placed against the official source | definitions

An umbrella term for two very different roles: the notifying authority and the market surveillance authority. For EU institutions the European Data Protection Supervisor takes their place.

Placed against the official source | definitions

Everything that is not personal data. The category exists to make clear that the AI Act applies even when no personal data is involved.

Placed against the official source | definitions

Any physical place, publicly or privately owned, accessible to an undetermined number of people. Access conditions and capacity limits are irrelevant.

Placed against the official source | definitions

The umbrella term for all six roles in the chain, and not the person operating the controls.

Placed against the official source | definitions

The AI Act deliberately creates no separate concept here and refers to the GDPR. Your GDPR records and your AI Act file must therefore cover the same data.

Placed against the official source | definitions

The ability of an AI system to achieve its intended purpose. Performance is therefore measured against the intended purpose, not against a standalone technical score.

Placed against the official source | definitions

Taken from the GDPR, but decisive in the AI Act: an Annex III system that profiles always remains high-risk.

Placed against the official source | definitions

The activity, not the authority. Work carried out on behalf of a law enforcement authority is covered as well, including where a private party performs it.

Placed against the official source | definitions

Not just the police and prosecution service. Also any other body entrusted under national law with public authority for detection, prosecution or public security.

Placed against the official source | definitions

Use outside the intended purpose that the provider could have seen coming, and must therefore anticipate.

Placed against the official source | definitions

Risk is the combination of the probability of harm occurring and the severity of that harm. It is the unit of measurement underpinning the entire regulation, from prohibited practices to the Article 9 risk management system.

Placed against the official source | definitions

A change to an AI system after it has been placed on the market or put into service that the provider did not foresee in the initial conformity assessment, and that affects compliance with Chapter III, Section 2 or changes the intended purpose.

Placed against the official source | definitions

An AI system that assigns people to categories on the basis of their biometric data. The carve-out for functions ancillary to another commercial service is narrow and is routinely read far too broadly in practice.

Placed against the official source | definitions

An AI system that identifies people without their active involvement, typically at a distance, by comparing them against a reference database. The decisive words are "active involvement".

Placed against the official source | definitions

A concept that applies exclusively to GPAI models, and that is unrelated to the high-risk classification of AI systems.

Placed against the official source | definitions

A measure aimed at returning an AI system to the provider, taking it out of service, or disabling its use, where that system has already been made available to deployers. A recall reaches systems already in use.

Placed against the official source | definitions

Temporarily testing an AI system for its intended purpose outside the lab, in order to gather reliable data and assess conformity. It does not count as placing on the market or putting into service, provided you meet all conditions of Article 57 or 60.

Placed against the official source | definitions

The agreement between you and the supervisory authority about what you will do in an AI regulatory sandbox: objectives, conditions, timeframe, methodology and requirements. It is a two-sided document, not an internal plan.

Placed against the official source | definitions

One of the two routes into the high-risk classification of Article 6(1), and often overlooked outside manufacturing.

Placed against the official source | definitions

An act or omission contrary to Union law protecting the interests of individuals that harms the collective interests of persons in at least two other Member States, or that, with common features, occurs concurrently and is committed by the same operator in at least three Member States.

Placed against the official source | definitions

Any mathematical operation or assignment involving floating-point numbers. This is the unit of computation with which the Regulation measures the scale of training of a general-purpose AI model.

Placed against the official source | definitions

Traceable rationale covering intended purpose, Annex III category, Article 6(3) assessment and registration decision.

Hangs off: Annex III: high-risk AI

Editorially reviewed | evidence, high-risk

Record per dataset of origin, choices, assumptions, bias examination and mitigations.

Hangs off: Article 10: data and data governance

Editorially reviewed | evidence, high-risk-requirements

Log files with a retention period appropriate to the purpose and at least six months for deployers (Articles 19 and 26).

Hangs off: Article 12: logging and traceability

Editorially reviewed | evidence, high-risk-requirements

The received instructions for use plus their internal translation into work instructions per role.

Hangs off: Article 13: transparency towards deployers

Editorially reviewed | evidence, high-risk-requirements

Record of oversight measures, appointed persons, their training and the moments of intervention.

Hangs off: Article 14: human oversight

Editorially reviewed | evidence, high-risk-requirements

Versioned record of roles, context, measures, participation or instruction and review moments.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy, evidence

Internal register showing who received which instruction, working session, training or guidance, for which system, on which date and on what basis, including new joiners, contractors and external staff.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

The recorded matrix of roles against AI systems, with the context of use, affected persons, risk and selected measure per combination, dated and with an owner per row.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

A record per system that the Article 5 screening was performed, with outcome and reasoning. The conclusion "no prohibited practice" is evidence too.

Hangs off: Article 5: prohibited practices

Editorially reviewed | evidence, prohibited-practices

Dated record per interface and channel showing that the disclosure appears at the latest at first interaction or exposure, is clear and distinguishable, and passed the accessibility check, with screenshot, version number and tester identity.

Hangs off: Article 50: transparency

Editorially reviewed | transparency

Record of scenario, actor, disclosure or marking, technical implementation, test and owner.

Hangs off: Article 50: transparency

Editorially reviewed | evidence, transparency

Written statement from the supplier describing which marking is applied to the output, in which machine-readable format, how robust and interoperable the solution is, and whether the marking survives editing or export.

Hangs off: Article 50: transparency

Editorially reviewed | transparency

For every test subject you record freely given informed consent, covering five prescribed information elements, dated, documented, with a copy provided to the subject.

Hangs off: Article 60: testing in real world conditions outside a sandbox

Editorially reviewed | innovation

The plan as part of the technical documentation plus the periodic analyses and follow-up actions.

Hangs off: Article 72: post-market monitoring

Editorially reviewed | evidence, post-market

Record of incidents, analyses, reports to supervisors and corrective measures.

Hangs off: Article 73: serious incident reporting

Editorially reviewed | evidence, post-market

The assessment, EU declaration of conformity, CE marking and registration proof, per system version.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Editorially reviewed | conformity, evidence

The dossier that shows you retain the logs, that you informed workers and their representatives in time, and that the people about whom decisions are made are aware of it.

Hangs off: Article 26: obligations of deployers of high-risk AI systems

Editorially reviewed | high-risk-requirements

Per request: who made it, about which decision, which system and which version contributed to it, what explanation was given and when. This is also the file that shows you did not silently ignore the right.

Hangs off: Article 85: right to lodge a complaint with the market surveillance authority, Article 86: right to an explanation of a decision

Editorially reviewed | fundamental-rights

The sent notification through which you report the assessment results to the market surveillance authority, with the completed template attached, plus date of dispatch and acknowledgement of receipt.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights

An overview indicating per Article 27(1) element whether it is already covered in the data protection impact assessment and where, so it is visible which elements exist only in the FRIA.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights

Dated impact assessment, measures, residual risks and, where required, notification to the market surveillance authority.

Hangs off: Article 27: FRIA

Editorially reviewed | evidence, fundamental-rights

Record per system of role, contractual arrangements on information and cooperation, and the appointment of a representative where required.

Hangs off: Articles 22-25: value chain and authorised representative

Editorially reviewed | evidence, value-chain

An employer uses a system that ranks applicants and recommends a candidate to hire. In one setup a recruiter weighs that recommendation in their own assessment; in the other the outcome is applied automatically and a candidate is rejected without anyone looking at it.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

A website automatically publishes AI-generated articles about European policy. There is an editorial charter on paper, but nobody reviews the substance. Before publication only a spell check runs, and a second AI model reviews the text.

Hangs off: Article 50: transparency

Placed against the official source | examples

A news site places an AI-generated summary beneath a journalist's article about a recent town council decision. The editor in chief reads the summary on substance, checks the facts and signs off for publication.

Hangs off: Article 50: transparency

Placed against the official source | examples

An organisation secures the entrances to its buildings with facial recognition and uses that biometric access control to register visitors as well. When the system returns no match, a security officer reviews the camera images and decides personally whether someone may enter. The question is whose measures have to reach that officer: those of the supplier of the model, those of the department that deploys the system, or both.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A police force uses AI to search large volumes of investigation files and surface connections a detective would otherwise miss. The outputs feed into the choice of which suspect is pursued further and end up in documents that enter the criminal process. The question is whether one and the same basic instruction is enough for the analyst operating the model and for the detective who acts on its output.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A newsroom uses generative AI to prepare summaries, headlines and imagery, after which an editor finishes the piece and the desk decides to publish. Part of that work sits with freelancers, and an outside agency produces marketing content with the same tools. The question is whether your AI literacy measures must reach those freelancers and that agency, or only the people on the payroll.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A recruiter deploys an AI chat that puts candidates through a first screening conversation after they respond to a job posting, and adds their answers to their CV. The chat introduces itself with a first name and writes in a casual conversational tone. The question is whether these applicants reasonably realise that they are talking to an AI system.

Hangs off: Article 50: transparency

Placed against the official source | examples

An organisation admits staff through facial recognition at its access control gate and additionally runs a camera in the visitor area that sorts faces into age groups. Both applications run on the same biometric infrastructure and the same images. The question is which of the two requires the people involved to be actively informed.

Hangs off: Article 50: transparency

Placed against the official source | examples

A software company uses an AI assistant for code suggestions and code review, available only to professional developers. The same company also runs a helpdesk chatbot for customers.

Hangs off: Article 50: transparency

Placed against the official source | examples

A bank opens an AI-driven reporting portal where customers can flag suspected fraud around their payment account or loan. The system asks follow-up questions, categorises the report and routes it to fraud detection and, where money laundering signals appear, to the internal reporting team. Because the portal concerns criminal offences, the bank assumes the disclosure duty for direct AI interaction does not apply.

Hangs off: Article 50: transparency

Placed against the official source | examples

A municipality has an AI system write the web pages about a changed scheme for social assistance and allowances, meant to explain to citizens what they are entitled to. A communications officer reads the text for style and spelling and publishes it. The question is whether this public service thereby falls under the exception to the labelling duty.

Hangs off: Article 50: transparency

Placed against the official source | examples

An organisation gives staff an internal AI assistant for HR, legal, procurement, compliance and IT questions. Must that assistant disclose at every turn that it is AI?

Hangs off: Article 50: transparency

Placed against the official source | examples

A hospital deploys an interactive AI system used exclusively by properly trained health professionals to support medical diagnosis and suggest treatments. The question is whether the patient or the clinician must be told it is AI.

Hangs off: Article 50: transparency

Placed against the official source | examples

An authority empowered by law to detect criminal offences wants to deploy an interactive AI system without telling those involved that they are communicating with AI.

Hangs off: Article 50: transparency

Placed against the official source | examples

Asimov AI is a micro organisation of at most fifteen people that supplies AI services for legislative work to government institutions and companies. With every new contract it holds one or more induction calls with the team leads and officials who will use the platform, explaining how the platform and the underlying models work and how hallucinations arise in this domain and can be mitigated.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

An employer uses an AI system that scores employee performance and lets that score weigh in promotion and dismissal. After a change to the model it turns out that a group of staff was scored too low for months, and decisions have already been taken on those scores. HR wonders whether this is a serious incident and who would have to report it.

Hangs off: Article 73: serious incident reporting

Placed against the official source | examples

An automated border gate uses biometric facial recognition to compare a traveller’s face with the photo in the passport chip. The same camera could technically also compare against a law-enforcement database, and exactly that difference decides whether this biometrics is high-risk.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

Booking.com built a three-part training for its legal and public affairs teams: first basic terminology and the difference between classic machine learning and language models, then how AI works inside the company, then the regulatory landscape and where it meets the law they already practise. The material was also released as a video and podcast series with subtitles and written handouts.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A call centre uses webcams and voice recognition to track employees' emotions, such as anger. The same company also uses voice analysis to detect when a customer becomes irritated.

Hangs off: Article 5: prohibited practices

Placed against the official source | examples

An employer has an external recruitment system score and rank every incoming application, after which recruiters only review the top twenty percent by hand. The vendor puts the system on the market under its own name, and the employer uses it in its own selection process.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

A customer service department runs a database query to find all customers who purchased a specific product last month, and calculates the average from a satisfaction survey in a standard spreadsheet. Every step follows predefined instructions.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

Dedalus Healthcare, which among other things supplies AI that predicts complications for hospital patients, trains its legal staff, data protection officer, compliance function and quality and regulatory affairs department on the technical side. Developers and engineers conversely receive training focused on the legal and compliance aspects of the AI Act. The executive committee received its own session tailored to its role.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A private individual uses a generative AI service to create a deep fake of themselves and their household for their own Christmas card, purely personal and with no business purpose.

Hangs off: Article 50: transparency

Placed against the official source | examples

A car company photographs an existing model and places it in an advertisement against a fully AI-generated background with an invented landscape. The car itself is untouched.

Hangs off: Article 50: transparency

Placed against the official source | examples

An employer wants to deploy emotion recognition. In one scenario the system assists employees with autism and improves accessibility for blind and deaf colleagues. In the other it measures stress levels to flag burnout, boredom or loss of motivation.

Hangs off: Article 5: prohibited practices

Placed against the official source | examples

A manufacturer supplies an AI system that runs as a safety component in a machine on the production line and at the same time drives quality control. At a customer's factory an operator is seriously injured after the machine failed to stop on an anomaly. The question is who reports, to whom, and which clock is already running at that moment.

Hangs off: Article 73: serious incident reporting

Placed against the official source | examples

A hospital uses an older diagnostic support expert system in which physicians encoded knowledge, facts and rules. Based on the symptoms a doctor enters, the system independently draws a conclusion about possible conditions.

Hangs off: Article 4: AI literacy

Placed against the official source | examples