Why this object hangs off that object

The role carrying the heaviest obligations, and the role organisations most often end up in by accident.

Placed against the official source | definitions

A conformity assessment body notified in accordance with this regulation and other relevant Union harmonisation legislation. Only notified bodies may carry out the external assessments under the AI Act.

Placed against the official source | definitions

The national authority responsible for setting up and carrying out the procedures for assessing, designating and notifying conformity assessment bodies, and for monitoring them.

Placed against the official source | definitions

Not a standalone authority but a function within the European Commission. For general-purpose AI models the AI Office is your supervisor; for ordinary AI systems it is not.

Placed against the official source | definitions

Skills, knowledge and understanding that enable providers, deployers and affected persons to deploy AI systems in an informed way and to become aware of the opportunities, risks and possible harm of AI.

Placed against the official source | definitions

The model is not the system, and that distinction determines which chapter of obligations applies to you.

Placed against the official source | definitions

The gateway definition of the Regulation's system track: if your application falls outside it, the obligations for AI systems do not apply. General-purpose AI models run on a separate track under Article 3(63), with their own obligations in Article 53.

Placed against the official source | definitions

A controlled framework set up by a competent authority in which you may temporarily develop, train, validate and test an innovative AI system under regulatory supervision, following a sandbox plan.

Placed against the official source | definitions

The use set by the provider on which the entire risk classification and assessment rest.

Placed against the official source | definitions

The sensitive data categories from the GDPR and related European rules, imported here because the AI Act attaches both a prohibition and a narrow exception to them.

Placed against the official source | definitions

The AI Act uses its own, broader wording than the GDPR, and that difference decides whether you land in Annex III or Article 5.

Placed against the official source | definitions

A one-to-many comparison against a database, to be distinguished from the one-to-one verification of point 36.

Placed against the official source | definitions

The residual category: any remote identification that is not real-time. Not prohibited, but high-risk, and subject to its own authorisation regime in law enforcement.

Placed against the official source | definitions

Remote identification where capture, comparison and identification happen without significant delay. The legislator explicitly closed the escape route of an artificial delay.

Placed against the official source | definitions

The marking by which a provider indicates that an AI system conforms to the requirements of Chapter III, Section 2 and to other applicable Union harmonisation legislation providing for its affixing.

Placed against the official source | definitions

The process of demonstrating that a high-risk AI system meets the requirements of Chapter III, Section 2. It is the evidence step for high-risk systems, not for all AI.

Placed against the official source | definitions

A body that performs third-party conformity assessment activities, including testing, certification and inspection.

Placed against the official source | definitions

Far broader than fake videos of famous people: objects, places, entities and events are covered too.

Placed against the official source | definitions

Any link in the supply chain that makes an AI system available on the Union market and is neither provider nor importer.

Placed against the official source | definitions

A provider of an AI system, including a general-purpose AI system, which integrates an AI model, regardless of whether that model is provided by themselves and vertically integrated or obtained from another entity on a contractual basis.

Placed against the official source | definitions

Prohibited in the workplace and in education since 2 February 2025; elsewhere an information duty under Article 50 applies since 2 August 2026.

Placed against the official source | definitions

Four categories of consequence, one of which is an infringement of fundamental rights protection. No physical harm is needed before a notification duty arises.

Placed against the official source | definitions

The information the provider supplies to inform the deployer about, in particular, the intended purpose and proper use of an AI system. It is the hinge between the provider's obligations and the deployer's.

Placed against the official source | definitions

The role that virtually every organisation buying and using AI ends up in.

Placed against the official source | definitions

A European standard published in the Official Journal which, if you apply it, produces a presumption of conformity. This is the fastest route to demonstrability, but the AI Act standards are not finished yet.

Placed against the official source | definitions

A subject's freely given, specific, unambiguous and voluntary expression of willingness to take part in a particular real-world test, after having been informed of all aspects relevant to that decision.

Placed against the official source | definitions

The European point of contact for a provider from outside the Union, valid only on the basis of a written mandate.

Placed against the official source | definitions

Technical specifications the Commission can adopt itself when harmonised standards are missing or fall short. The fallback that prevents the AI Act from stalling because standardisation is delayed.

Placed against the official source | definitions

Operational data around detection and prosecution whose disclosure could harm criminal proceedings. The concept on which the law enforcement exceptions to transparency rest.

Placed against the official source | definitions

Whoever places on the Union market a system bearing the name or trademark of a party established in a third country.

Placed against the official source | definitions

The first moment a system or model is made available on the Union market, and therefore the trigger for many obligations.

Placed against the official source | definitions

The concept that brings internally built systems which are never sold within the scope of the Regulation.

Placed against the official source | definitions

The data entering the system or acquired by it, on the basis of which it produces its output. This is the data definition that touches the deployer, not just the provider.

Placed against the official source | definitions

Critical infrastructure as defined in Article 2, point (4), of Directive (EU) 2022/2557, the CER Directive. The AI Act gives no definition of its own here but aligns with that framework.

Placed against the official source | definitions

The national supervisor that enforces the AI Act on the market, with the powers from the general market surveillance regulation. This is the party that comes knocking and requests your documentation.

Placed against the official source | definitions

An umbrella term for two very different roles: the notifying authority and the market surveillance authority. For EU institutions the European Data Protection Supervisor takes their place.

Placed against the official source | definitions

Everything that is not personal data. The category exists to make clear that the AI Act applies even when no personal data is involved.

Placed against the official source | definitions

Any physical place, publicly or privately owned, accessible to an undetermined number of people. Access conditions and capacity limits are irrelevant.

Placed against the official source | definitions

The umbrella term for all six roles in the chain, and not the person operating the controls.

Placed against the official source | definitions

The AI Act deliberately creates no separate concept here and refers to the GDPR. Your GDPR records and your AI Act file must therefore cover the same data.

Placed against the official source | definitions

The document in which you set out in advance how you will test an AI system outside the lab: objective, methodology, scope, who takes part, for how long and how you monitor it. Without this plan, testing in real-world conditions is not permitted.

Placed against the official source | definitions

The ability of an AI system to achieve its intended purpose. Performance is therefore measured against the intended purpose, not against a standalone technical score.

Placed against the official source | definitions

For the purpose of real-world testing, a subject is a natural person who participates in such a test. The term comes from the testing regime, not from data protection law.

Placed against the official source | definitions

Taken from the GDPR, but decisive in the AI Act: an Annex III system that profiles always remains high-risk.

Placed against the official source | definitions

The activity, not the authority. Work carried out on behalf of a law enforcement authority is covered as well, including where a private party performs it.

Placed against the official source | definitions

Not just the police and prosecution service. Also any other body entrusted under national law with public authority for detection, prosecution or public security.

Placed against the official source | definitions

Use outside the intended purpose that the provider could have seen coming, and must therefore anticipate.

Placed against the official source | definitions

Risk is the combination of the probability of harm occurring and the severity of that harm. It is the unit of measurement underpinning the entire regulation, from prohibited practices to the Article 9 risk management system.

Placed against the official source | definitions

A change to an AI system after it has been placed on the market or put into service that the provider did not foresee in the initial conformity assessment, and that affects compliance with Chapter III, Section 2 or changes the intended purpose.

Placed against the official source | definitions

An AI system that assigns people to categories on the basis of their biometric data. The carve-out for functions ancillary to another commercial service is narrow and is routinely read far too broadly in practice.

Placed against the official source | definitions

An AI system that identifies people without their active involvement, typically at a distance, by comparing them against a reference database. The decisive words are "active involvement".

Placed against the official source | definitions

The set of activities through which a provider keeps following how its AI system behaves in practice after launch, so it can intervene in time. Conformity is a starting point, not an end point.

Placed against the official source | definitions

A concept that applies exclusively to GPAI models, and that is unrelated to the high-risk classification of AI systems.

Placed against the official source | definitions

A measure aimed at returning an AI system to the provider, taking it out of service, or disabling its use, where that system has already been made available to deployers. A recall reaches systems already in use.

Placed against the official source | definitions

Data for an independent evaluation confirming expected performance, which must take place beforehand: before the system is placed on the market or put into service.

Placed against the official source | definitions

Temporarily testing an AI system for its intended purpose outside the lab, in order to gather reliable data and assess conformity. It does not count as placing on the market or putting into service, provided you meet all conditions of Article 57 or 60.

Placed against the official source | definitions

The agreement between you and the supervisory authority about what you will do in an AI regulatory sandbox: objectives, conditions, timeframe, methodology and requirements. It is a two-sided document, not an internal plan.

Placed against the official source | definitions

Data used to fit the learnable parameters of an AI system. Narrowly defined, and precisely for that reason decisive for who carries which data governance obligation.

Placed against the official source | definitions

A measure aimed at preventing an AI system that is in the supply chain from being made available on the market. It stops distribution, not use by existing customers.

Placed against the official source | definitions

Data with which you evaluate and tune the trained system, including its non-learnable parameters, to prevent underfitting and overfitting. Meant for tuning, not for producing the final score.

Placed against the official source | definitions

The form validation data may take: a separate data set or part of the training data set, as a fixed or variable split. The law leaves the method open, but not the explainability.

Placed against the official source | definitions

One of the two routes into the high-risk classification of Article 6(1), and often overlooked outside manufacturing.

Placed against the official source | definitions

An act or omission contrary to Union law protecting the interests of individuals that harms the collective interests of persons in at least two other Member States, or that, with common features, occurs concurrently and is committed by the same operator in at least three Member States.

Placed against the official source | definitions

Any mathematical operation or assignment involving floating-point numbers. This is the unit of computation with which the Regulation measures the scale of training of a general-purpose AI model.

Placed against the official source | definitions