Why this object hangs off that object

An employer uses a system that ranks applicants and recommends a candidate to hire. In one setup a recruiter weighs that recommendation in their own assessment; in the other the outcome is applied automatically and a candidate is rejected without anyone looking at it.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

A website automatically publishes AI-generated articles about European policy. There is an editorial charter on paper, but nobody reviews the substance. Before publication only a spell check runs, and a second AI model reviews the text.

Hangs off: Article 50: transparency

Placed against the official source | examples

A news site places an AI-generated summary beneath a journalist's article about a recent town council decision. The editor in chief reads the summary on substance, checks the facts and signs off for publication.

Hangs off: Article 50: transparency

Placed against the official source | examples

A manufacturer markets an AI-powered toy that keeps children engaged by encouraging increasingly risky challenges, such as climbing furniture, exploring high shelves or handling sharp objects, in exchange for digital rewards and virtual praise.

Hangs off: Article 5: prohibited practices

Placed against the official source | examples

An organisation secures the entrances to its buildings with facial recognition and uses that biometric access control to register visitors as well. When the system returns no match, a security officer reviews the camera images and decides personally whether someone may enter. The question is whose measures have to reach that officer: those of the supplier of the model, those of the department that deploys the system, or both.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A police force uses AI to search large volumes of investigation files and surface connections a detective would otherwise miss. The outputs feed into the choice of which suspect is pursued further and end up in documents that enter the criminal process. The question is whether one and the same basic instruction is enough for the analyst operating the model and for the detective who acts on its output.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A newsroom uses generative AI to prepare summaries, headlines and imagery, after which an editor finishes the piece and the desk decides to publish. Part of that work sits with freelancers, and an outside agency produces marketing content with the same tools. The question is whether your AI literacy measures must reach those freelancers and that agency, or only the people on the payroll.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A recruiter deploys an AI chat that puts candidates through a first screening conversation after they respond to a job posting, and adds their answers to their CV. The chat introduces itself with a first name and writes in a casual conversational tone. The question is whether these applicants reasonably realise that they are talking to an AI system.

Hangs off: Article 50: transparency

Placed against the official source | examples

An organisation admits staff through facial recognition at its access control gate and additionally runs a camera in the visitor area that sorts faces into age groups. Both applications run on the same biometric infrastructure and the same images. The question is which of the two requires the people involved to be actively informed.

Hangs off: Article 50: transparency

Placed against the official source | examples

A software company uses an AI assistant for code suggestions and code review, available only to professional developers. The same company also runs a helpdesk chatbot for customers.

Hangs off: Article 50: transparency

Placed against the official source | examples

A bank opens an AI-driven reporting portal where customers can flag suspected fraud around their payment account or loan. The system asks follow-up questions, categorises the report and routes it to fraud detection and, where money laundering signals appear, to the internal reporting team. Because the portal concerns criminal offences, the bank assumes the disclosure duty for direct AI interaction does not apply.

Hangs off: Article 50: transparency

Placed against the official source | examples

A municipality has an AI system write the web pages about a changed scheme for social assistance and allowances, meant to explain to citizens what they are entitled to. A communications officer reads the text for style and spelling and publishes it. The question is whether this public service thereby falls under the exception to the labelling duty.

Hangs off: Article 50: transparency

Placed against the official source | examples

An organisation gives staff an internal AI assistant for HR, legal, procurement, compliance and IT questions. Must that assistant disclose at every turn that it is AI?

Hangs off: Article 50: transparency

Placed against the official source | examples

A hospital deploys an interactive AI system used exclusively by properly trained health professionals to support medical diagnosis and suggest treatments. The question is whether the patient or the clinician must be told it is AI.

Hangs off: Article 50: transparency

Placed against the official source | examples

An authority empowered by law to detect criminal offences wants to deploy an interactive AI system without telling those involved that they are communicating with AI.

Hangs off: Article 50: transparency

Placed against the official source | examples

Asimov AI is a micro organisation of at most fifteen people that supplies AI services for legislative work to government institutions and companies. With every new contract it holds one or more induction calls with the team leads and officials who will use the platform, explaining how the platform and the underlying models work and how hallucinations arise in this domain and can be mitigated.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

An employer uses an AI system that scores employee performance and lets that score weigh in promotion and dismissal. After a change to the model it turns out that a group of staff was scored too low for months, and decisions have already been taken on those scores. HR wonders whether this is a serious incident and who would have to report it.

Hangs off: Article 73: serious incident reporting

Placed against the official source | examples

A platform analyses the biometric data in photos users have uploaded to infer their assumed political orientation and serve them targeted political messages. A comparable system infers assumed sexual orientation in order to serve advertisements.

Hangs off: Article 5: prohibited practices

Placed against the official source | examples

An automated border gate uses biometric facial recognition to compare a traveller’s face with the photo in the passport chip. The same camera could technically also compare against a law-enforcement database, and exactly that difference decides whether this biometrics is high-risk.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

Booking.com built a three-part training for its legal and public affairs teams: first basic terminology and the difference between classic machine learning and language models, then how AI works inside the company, then the regulatory landscape and where it meets the law they already practise. The material was also released as a video and podcast series with subtitles and written handouts.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A call centre uses webcams and voice recognition to track employees' emotions, such as anger. The same company also uses voice analysis to detect when a customer becomes irritated.

Hangs off: Article 5: prohibited practices

Placed against the official source | examples

An employer has an external recruitment system score and rank every incoming application, after which recruiters only review the top twenty percent by hand. The vendor puts the system on the market under its own name, and the employer uses it in its own selection process.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

A customer service department runs a database query to find all customers who purchased a specific product last month, and calculates the average from a satisfaction survey in a standard spreadsheet. Every step follows predefined instructions.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

Dedalus Healthcare, which among other things supplies AI that predicts complications for hospital patients, trains its legal staff, data protection officer, compliance function and quality and regulatory affairs department on the technical side. Developers and engineers conversely receive training focused on the legal and compliance aspects of the AI Act. The executive committee received its own session tailored to its role.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A private individual uses a generative AI service to create a deep fake of themselves and their household for their own Christmas card, purely personal and with no business purpose.

Hangs off: Article 50: transparency

Placed against the official source | examples

A car company photographs an existing model and places it in an advertisement against a fully AI-generated background with an invented landscape. The car itself is untouched.

Hangs off: Article 50: transparency

Placed against the official source | examples

An employer wants to deploy emotion recognition. In one scenario the system assists employees with autism and improves accessibility for blind and deaf colleagues. In the other it measures stress levels to flag burnout, boredom or loss of motivation.

Hangs off: Article 5: prohibited practices

Placed against the official source | examples

A manufacturer supplies an AI system that runs as a safety component in a machine on the production line and at the same time drives quality control. At a customer's factory an operator is seriously injured after the machine failed to stop on an anomaly. The question is who reports, to whom, and which clock is already running at that moment.

Hangs off: Article 73: serious incident reporting

Placed against the official source | examples

A hospital uses an older diagnostic support expert system in which physicians encoded knowledge, facts and rules. Based on the symptoms a doctor enters, the system independently draws a conclusion about possible conditions.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

Fastweb operates more than ninety AI systems and formally appoints an AI-SPOC in every department, a trained point of contact for AI questions from that team. These people receive separate instruction on prohibited practices and high-risk systems and are allowed to run their department's AI risk assessment themselves.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A European scale-up fine-tunes an existing general-purpose AI model for its own product, using more compute than one third of the compute used to train the original model.

Hangs off: Article 53: GPAI model providers

Placed against the official source | examples

A tax authority runs a predictive AI tool over all tax returns to flag potential criminal tax offences. This is done solely on the profile built by the system, using personality traits such as dual nationality, place of birth and number of children, together with inferred variables that are hard to verify.

Hangs off: Article 5: prohibited practices

Placed against the official source | examples

A tax authority uses an AI system to detect childcare benefit fraud by profiling beneficiaries and assigning them to categories such as deliberate intent or gross negligence, using criteria such as low income, dual nationality and social behaviour. Based on the risk score, files are inspected, benefits are stopped and repayment is demanded.

Hangs off: Article 5: prohibited practices

Placed against the official source | examples

A municipality wants to deploy an AI system that sorts applications for social assistance benefits and indicates which files merit extra scrutiny before a case worker decides. The application is already listed in the public algorithm register. The question is what has to be in place before the first citizen passes through this system.

Hangs off: Article 27: FRIA

Placed against the official source | examples

A police service deploys an AI system that estimates the recidivism risk of a suspect, as an aid to the judgements later made by the prosecution service and the court. The model is subsequently retrained on newer investigative data and use is extended to a second region. The question is whether the assessment made for first use remains adequate.

Hangs off: Article 27: FRIA

Placed against the official source | examples

A university of applied sciences has an AI system rank applications for a vocational programme, using the exam results of earlier students to calibrate that ranking. A data protection impact assessment already exists for this processing. The question the school asks is whether that also covers the fundamental rights side of admission.

Hangs off: Article 27: FRIA

Placed against the official source | examples

A health insurer uses AI for risk assessment and pricing of health and life insurance. The question is whether this falls under point 5(c) of Annex III, and with that whether the Article 27 FRIA duty comes into play.

Hangs off: Article 27: FRIA

Placed against the official source | examples

A meteorological institute runs physics based weather models and uses machine learning to approximate complex atmospheric processes such as cloud microphysics and turbulence. The estimated values are then fed into the established physics model, which produces the actual forecast.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

An asset manager builds a simple baseline model that predicts future prices by always taking the historical average, in order to test whether a more advanced model genuinely adds value. A weather service does the same by predicting tomorrow's temperature using last week's average.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

Generali offers all staff basic courses on what AI is and how the group uses it, intermediate modules for people who use AI systems daily, and advanced sessions with external experts for those who build or maintain them. On top of that it runs internal role academies for data scientists, actuaries and accountants, set up with universities and research institutes.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

An advertiser uses AI to tailor ads to user preferences. The question is whether that touches the manipulation prohibition.

Hangs off: Article 5: prohibited practices

Placed against the official source | examples

A software company runs an automated image scraper across the internet to detect images containing human faces on social media, stores them with source URL, geolocation and sometimes names, and converts the facial features into mathematical representations against which an uploaded photo can be matched.

Hangs off: Article 5: prohibited practices

Placed against the official source | examples

Gjensidige Forsikring gives all employees a mandatory e-learning as a baseline and builds role-based depth on top: analysts get model risk and data governance, claims handlers get training on the systems they operate themselves. Where relevant, AI literacy is checked during recruitment and training on AI systems is part of onboarding.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A webshop runs an AI chatbot for questions about orders, delivery and returns. The bot writes fluent prose, carries a staff profile picture, and nowhere does it say that no human is reading along.

Hangs off: Article 50: transparency

Placed against the official source | examples

An educational institution uses AI for application file handling: indexing, searching, text and speech processing, translation of documents submitted with applications, and extracting, transforming and organising the collected data into a usable format.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

An AI system determines which areas of agricultural land are sprayed with chemicals. The intended purpose given to it by the provider is optimising the use of chemicals.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Placed against the official source | examples

An AI system is integrated into a drone or robot and used for agronomic purposes such as yield forecasting or irrigation optimisation.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Placed against the official source | examples

An AI system checks a decision, plan or construction made by a human and then provides a substantially different solution.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

An accounting firm deploys an AI system that detects money laundering, in order to comply with its own obligations under EU anti-money laundering legislation.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

Equipment for potentially explosive atmospheres contains an AI system intended to monitor gas concentrations and command shutdown when thresholds are exceeded.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Placed against the official source | examples

A chatbot answers a case handler's factual questions relating to the evaluation of a natural person's application for healthcare benefits, for instance the applicant's age. The case handler can grant or deny the benefits based on those answers.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

A provider develops a system assessing the creditworthiness of companies by evaluating their company data, balance sheets and financial statements. In a variant, the owner of a legal entity is assessed to back a company loan.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

A provider develops an AI system that assesses the creditworthiness of companies using company data, balance sheets and financial statements. The situation where the owner of a legal entity is assessed as backing for a company loan is also addressed.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

A provider develops an AI system that establishes the credit score of the owner of a small business or of a company that is not a legal entity. The system uses only business or company data.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

An AI system is used by customs authorities to assess the risk that goods entering the EU do not comply with legislation applicable at the border, based on information about the economic operators concerned, such as container number, description of goods, routing, transport and payment method.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

The system analyses the candidate's CV together with the job description supplied by the candidate and recommends changes to increase the likelihood of being selected for an interview. Those recommendations are shared exclusively with the candidate.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

An AI system detects and flags incompletely filled-in forms so that they can be returned to the applicant to be completed correctly.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

An AI system optimises combustion efficiency in a household gas appliance. The intended purpose is energy efficiency.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Placed against the official source | examples

A system audits completed hiring decisions by analysing anonymised recruitment data, including CV scores, interview notes and hiring outcomes, using statistical modelling to detect potential bias or inconsistencies. It plays no role in ongoing recruitment and does not assess identified or identifiable recruiters or applicants.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

The system coordinates appointments with applicants by combining calendars and stated availability, proposes time slots based on logistical constraints such as time zones and maximum daily meetings, sends reminders, and processes accessibility needs such as sign language interpretation, extended interview duration or alternative communication formats.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

An AI system is used in assessing data relevant to a decision, for example on public benefits, and provides the human operator with references to the relevant legal provisions, information on jurisdiction and possibly existing internal guidelines relevant to the decision-making process.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

An AI system in a lift manages door closing timing and obstacle detection. The intended purpose given to it by the provider is efficient lift operation, not safety.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Placed against the official source | examples

An AI-based computer vision system detects human presence in a robot cell and triggers a safe stop or speed reduction. The intended purpose given to it by the provider is to prevent injury.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Placed against the official source | examples

An AI system analyses previously completed eligibility checks by public administrators to detect decision-making patterns or deviations, for quality assurance and reporting. It does not propose outcomes on live cases and does not evaluate the performance of staff members, for example in the annual appraisal.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

An AI system in pressure equipment is intended to predict runaway pressure and actuate protective measures, for instance by triggering a shutdown linked to safety accessories.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Placed against the official source | examples

A consultancy firm uses an AI writing assistant to refine managers' promotion reports after evaluations are fully completed. Managers have already recorded the recommendation, justification and ratings; the system improves clarity of language, ensures consistency with corporate style and flags potentially biased wording, after which the manager is required to double-check the revised text.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

Three kinds of auxiliary systems: systems that flag errors or contradictions in finalised human work as a quality-assurance function, systems that map conclusions to evidentiary records to strengthen the traceability of a decision without substituting human judgment, and systems that convert human-validated content for interoperability or accessibility purposes.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

An AI system in a train is intended to monitor speed limits and to prevent collisions and derailments.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Placed against the official source | examples

A system identifies deviations from previous recruitment decision-making patterns before recruitment is completed, to detect inconsistencies with corporate recruitment policy, while evaluating the personal characteristics of the recruiters conducting the interviews.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

The system aggregates official records, employment history, social network history and, where legally permissible, financial data, plus open-source information, and returns composite risk scores or categories such as low, medium and high risk with alerts such as unexplained employment gaps. In high-volume hiring, candidates flagged as high risk are deprioritised before a caseworker reviews the file.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

An AI system is used in the recruitment of employees. It identifies deviations from previous recruitment decision-making patterns to detect potential inconsistencies with corporate recruitment policies, and in doing so also evaluates the personal characteristics of the recruiters conducting the job interviews. The system runs before recruitment is completed.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

Municipalities or regional authorities automatically assign pupils to public schools based on structured data such as home address, school catchment boundaries and available capacity, also factoring in sibling attendance and parental status to keep families together or minimise commuting distance.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

A system evaluates written or oral responses given by job applicants in an online assessment, assigns a numerical score based on linguistic and substantive criteria, and generates a ranking used to determine who is invited to the interview stage.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

A smart thermostat covered by the radio equipment rules learns household routines and optimises temperature settings. The intended purpose is greater comfort and lower energy use.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Placed against the official source | examples

An AI system sorts incoming applications for admission to a school or university by the grade or educational level applied for, placing them into predefined categories such as primary, secondary or specific grades, based on information supplied in the application.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

An AI system in a connected toy makes music recommendations to the child playing with it.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Placed against the official source | examples

A toy manufacturer whose product contains an AI system as a safety component applies harmonised standards and thereby opts for a conformity assessment procedure without third-party involvement.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Placed against the official source | examples

An AI system for lane assistance in a vehicle. The intended purpose given to it by the provider is enhancement of the user experience.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Placed against the official source | examples

A system in migration and border management scans each submitted visa file, converts scanned documents into text for indexing, automatically files items into fixed, predefined folders such as identity documents, travel itinerary, supporting evidence and translations, and detects exact duplicate attachments and marks them as duplicates.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

An AI system in the migration and border management context scans each submitted visa file, converts scanned documents into text for indexing, automatically files items into fixed predefined folders such as identity documents, travel itinerary, supporting evidence and translations, and detects exact duplicate attachments and marks them as duplicates.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

INECO, a large Spanish engineering firm working for public authorities on rail, airports and digitalisation, ran over twenty AI trainings with more than four hundred participants in 2024 and set up an AI Master Classroom on the intranet with short modules, audio and subtitles. After making staff aware of data leakage risk, the organisation limited the use of public language models and moved to a secured chatbot solution.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

An organisation makes an internal AI assistant available for HR, procurement, IT and compliance questions. It sits behind the company login only, and staff have been trained in using AI.

Hangs off: Article 50: transparency

Placed against the official source | examples

A financial services provider uses a predictive AI model to target advertising for predatory financial products at people living in low-income postcodes who are in dire financial straits.

Hangs off: Article 5: prohibited practices

Placed against the official source | examples

A lender uses a model that gives individual applicants a score on which the acceptance decision rests. The same institution also runs a separate model that flags suspicious transactions for fraud investigation.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

A lender assesses creditworthiness on the basis of income, expenses and other financial and economic circumstances. An insurer raises the premium of a driver whose telematics data show persistent speeding.

Hangs off: Article 5: prohibited practices

Placed against the official source | examples

A bank fine-tunes an existing general-purpose AI model on its own product documentation and customer questions, using a fraction of the original compute, and builds a customer chatbot around it that it offers under its own name.

Hangs off: Article 53: GPAI model providers

Placed against the official source | examples

A police force uses an AI system that scores the likelihood of crime in different areas of a city, based on past crime rates per area, street maps and supporting information, to decide where to deploy more patrols.

Hangs off: Article 5: prohibited practices

Placed against the official source | examples

A university of applied sciences uses a purchased AI system that ranks student admissions and also raises flags during digital assessment. The logs sit in the supplier environment, which hands them over on request. The teaching organisation wonders whether that settles the matter or whether the school retains a duty of its own.

Hangs off: Article 12: logging and traceability

Placed against the official source | examples

A manufacturer supplies an AI system that runs as a safety component inside the machinery of a production line and also drives quality control. The factory operating the line keeps only the alerts visible in the local controller; the rest of the recording flows to the supplier environment. The question is who has to keep which logs when it later has to be reconstructed why the line was halted.

Hangs off: Article 12: logging and traceability

Placed against the official source | examples

An employer deploys an AI system that handles task allocation among staff and summarises their performance for the performance review. HR wants to know what record of those outcomes has to be retained when an employee objects months later to a promotion decision.

Hangs off: Article 12: logging and traceability

Placed against the official source | examples

An insurer deploys a trained model that ranks claims by complexity. After deployment the model learns nothing new; the supplier retrains only periodically in a controlled release, so its behaviour is entirely stable between releases.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A downstream actor modifies an existing systemic-risk model so substantially that the change exceeds the threshold, and publishes the result as its own model.

Hangs off: Article 53: GPAI model providers

Placed against the official source | examples

In 2024 Mural ran a mandatory AI training for all staff with a 93 percent completion rate, and additionally organised a live interactive session for the AI team specifically on prohibited practices and high-risk categories. For that team the legal function built a visual mind map on a digital whiteboard, with templates and direct references to the provisions.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A car manufacturer builds a generative AI system into the navigation unit that composes spoken and written route instructions. The output stays inside the vehicle and technical measures prevent it from being exported or shared.

Hangs off: Article 50: transparency

Placed against the official source | examples

An education institution uses eye tracking software during online exams to follow students' gaze point and eye movement, to detect whether unauthorised material is being used.

Hangs off: Article 5: prohibited practices

Placed against the official source | examples

Three providers call their model open source. The first licence allows non-commercial research only. The second requires a separate commercial licence once monthly active users pass a threshold. The third gives the model away for free but hosts it exclusively on its own platform where visitors are served paid advertisements.

Hangs off: Article 53: GPAI model providers

Placed against the official source | examples

A research group publishes a general-purpose AI model under a free and open-source licence and makes the weights, architecture and usage information publicly available. The model carries no systemic risk.

Hangs off: Article 53: GPAI model providers

Placed against the official source | examples

A grid operator uses a machine learning model to approximate parameters inside a classical optimisation calculation built on linear and logistic regression. The model changes nothing about the decision rules themselves, it only makes a long established calculation method faster and cheaper.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A police service fine-tunes an open general-purpose model on its own files from ongoing criminal investigations, so that detectives can see links between suspects and cases sooner. The fine-tuned model stays inside the service and is not made available to anyone else. The question is whether the service thereby becomes a provider of a general-purpose AI model itself, and so falls under Article 53.

Hangs off: Article 53: GPAI model providers

Placed against the official source | examples

A provider supplies a system that summarises employee performance data and supports HR in promotion decisions. After a year in use, departments turn out to apply it differently than intended, and managers factor the outputs into the performance review. The question is what the provider is supposed to know about that.

Hangs off: Article 72: post-market monitoring

Placed against the official source | examples

A vendor offers proctoring software that flags possible cheating during exams. Several universities of applied sciences use the system, each with its own assessment formats and its own student populations. The vendor wants to know which real-world data it must keep collecting after roll-out, and from whom.

Hangs off: Article 72: post-market monitoring

Placed against the official source | examples

A manufacturer supplies an AI safety component that halts machinery on a production line as soon as someone comes too close to the robot. The component already falls under product legislation for machinery, and the manufacturer runs quality control and incident follow-up for it. The question is what Article 72 adds on top of that.

Hangs off: Article 72: post-market monitoring

Placed against the official source | examples

A university of applied sciences uses software during online exams that flags possible cheating from webcam images and mouse movement. A flag triggers an automatic notification to the exam board.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

A university of applied sciences uses proctoring software during an online exam and finds that a group of students is systematically and wrongly flagged as suspicious, after which grades were withdrawn. Teaching staff and the examination board want to know whether this pattern is a serious incident and, if so, who has to report it and within what time.

Hangs off: Article 73: serious incident reporting

Placed against the official source | examples

Police install a van with mobile cameras and live facial recognition at the main entrance of a stadium during a European Championship match. The watchlist covers people suspected of offences ranging from serious crime to fraud and burglary, plus people of possible intelligence interest and vulnerable persons with mental health issues. There is no information linking a specific person to this event.

Hangs off: Article 5: prohibited practices

Placed against the official source | examples

A police force uses a model that estimates, per suspect, the likelihood of committing another offence, based on the case file and previously established behaviour. That outcome feeds into the prioritisation of ongoing investigations.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

A satellite operator allocates power and bandwidth across transponders using a machine learning model that predicts network traffic, because classical optimisation struggles with demand that varies sharply by region and by moment. Performance is comparable to established methods in the field.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A satirical outlet publishes an AI-manipulated image of an existing politician, placed in a scene that humorously criticises a policy decision. Style and context make it immediately clear that this is satire.

Hangs off: Article 50: transparency

Placed against the official source | examples

A software company releases a chess program that assesses board positions using a minimax algorithm with heuristic evaluation functions. The program has never learned from game data; it applies pre-programmed rules and search strategies to find a strong move.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A software company supplies a SaaS platform that monitors network traffic at an operator of critical digital infrastructure and reports anomalous patterns to that customer's security team. Its developers see that use at such an operator may fall under point 2 of Annex III and wonder whether their own product therefore becomes a high-risk AI system.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

Smals, which supplies IT to Belgian public administrations, describes the knowledge each role needs: all staff know capabilities, limits and internal guidelines, AI ambassadors spot and prioritise use cases, AI experts know governance and technique, and legal staff and the data protection officer get separate deep dives. Before every new AI project there is also a session for all stakeholders on the capabilities, limits, risks and governance of that specific system.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

An organisation adopts an email filter that was trained during its building phase on a set of messages humans labelled as spam or not spam. Once in use, the filter independently assesses new incoming email and classifies it based on the patterns it learned.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A publisher uses the same AI tool for two things: correcting spelling and cleaning up formatting in submitted pieces, and producing summaries and rewrites of those same pieces.

Hangs off: Article 50: transparency

Placed against the official source | examples

A service desk shows customers an expected resolution time calculated as the mean from historical tickets. A retail chain uses a trivial predictor to estimate how many units of a product it will sell each day, as a starting point for purchasing planning.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A company has a realistic synthetic avatar of its own CEO deliver a new year message thanking employees for last year's results. The video goes to the intranet and to the company's social media channels.

Hangs off: Article 50: transparency

Placed against the official source | examples

A higher education institution procures an AI system that organises student applications and enrolment and produces an admission recommendation for each candidate in its vocational programmes. The supplier says it handles the conformity assessment itself and affixes the CE marking. What is left unresolved is whether the institution still has a step of its own to take before the system goes into use in its teaching.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Placed against the official source | examples

A hospital uses AI to prioritise incoming patients at the emergency department. The question is not whether the system is high-risk but by which route: as a medical device under product legislation, or directly under Annex III.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

A grid operator uses an AI model that automatically balances load and disconnects parts of the electricity network to prevent outages. The same organisation also runs a chatbot that helps customers with billing questions.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples

A commercial team uses reporting software that applies statistical methods to calculate total sales, average sales per region and trends over time, and displays them in charts. The dashboard makes no suggestion about how to improve sales or which products to promote.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A non-food retail chain lets customers pay later in its webshop and decides at checkout whether a consumer qualifies. The team builds that assessment system in house, on top of a pre-trained model supplied by a vendor. The question is what has to be on record before the feature goes live, and who has to put it there.

Hangs off: Article 11: technical documentation

Placed against the official source | examples

A provider markets an AI chatbot meant to help users maintain a healthy lifestyle, with tailored advice on exercise and mental rest. In practice the chatbot exploits individual vulnerabilities and pushes people into dangerous habits, such as excessive sport without rest or water.

Hangs off: Article 5: prohibited practices

Placed against the official source | examples