The EU AI Act — the complete guide with examples

Develops an AI system or model (or has it developed) and places it on the market or puts it into service under its own name or trademark — paid or free.

Uses an AI system under its authority in a professional activity. Most companies are deployers.

An EU company that places on the EU market an AI system bearing the name of a provider established outside the EU.

Makes an AI system available on the EU market without being the provider or importer (reseller).

Places a product (machine, toy, medical device …) on the market with an AI system as its safety component, under its own name.

A person in the EU mandated by a non-EU provider to carry out its AI Act obligations.

Subliminal, manipulative or deceptive techniques that distort behaviour and cause or are likely to cause significant harm.

Exploiting vulnerabilities due to age, disability or a specific social or economic situation in a way that causes significant harm.

Evaluating people over time based on social behaviour or personal traits, leading to unjustified or disproportionate detrimental treatment in unrelated contexts.

Assessing the risk that a person will commit a crime based solely on profiling or personality traits.

Creating or expanding facial recognition databases by untargeted scraping of images from the internet or CCTV.

Inferring emotions of people at the workplace or in education, except for medical or safety reasons.

Categorising people by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life or sexual orientation.

Real-time remote biometric identification in publicly accessible spaces for law enforcement, except in narrowly defined cases with prior authorisation.

AI that generates realistic intimate or sexually explicit images of identifiable people without their explicit consent (“nudify” apps). Added by the 2026 Omnibus.

AI that generates or manipulates child sexual abuse material. Added by the 2026 Omnibus.

Remote biometric identification (not simple verification like unlocking a phone), biometric categorisation, emotion recognition where not prohibited.

Safety components in the management of digital infrastructure, road traffic and the supply of water, gas, heating and electricity.

Admission, evaluating learning outcomes, deciding the appropriate level of education, detecting cheating in tests.

Recruitment and selection (targeted job ads, filtering applications, evaluating candidates), decisions on promotion, termination, task allocation based on behaviour or traits, monitoring and evaluating performance.

Eligibility for public benefits, creditworthiness and credit scores (not fraud detection), risk assessment and pricing in life and health insurance, triage of emergency calls.

Risk assessments of victims or offenders, polygraph-like tools, evaluating evidence, profiling in investigations.

Risk assessments of travellers, examining asylum and visa applications, detecting and identifying people at borders.

Assisting courts in researching and interpreting facts and law; AI intended to influence the outcome of elections or voting behaviour.

• Use the system according to the provider’s instructions for use.
• Assign human oversight to people with the necessary competence, training and authority.
• Make sure the input data you control is relevant and sufficiently representative.
• Monitor operation; if there is a risk or a serious incident, inform the provider and the authority and suspend use.
• Keep automatically generated logs for at least six months.
• Before using high-risk AI at the workplace, inform workers’ representatives and the affected workers.
• Inform people that a high-risk AI system is used to make or assist decisions about them.
• Use the provider’s information to carry out your data protection impact assessment (GDPR Art. 35).
• Public bodies, private providers of public services, banks (credit scoring) and insurers (life and health pricing): carry out a fundamental rights impact assessment (Art. 27) — it can build on your DPIA.
• People affected by a decision based on high-risk AI have a right to a clear explanation of the AI’s role (Art. 86).

• Risk management system throughout the life cycle (Art. 9).
• Data governance: relevant, representative, as error-free as possible training, validation and test data; bias checks (Art. 10).
• Technical documentation (Art. 11) and automatic logging (Art. 12).
• Instructions for use and transparency towards deployers (Art. 13).
• Design for effective human oversight (Art. 14).
• Accuracy, robustness and cybersecurity (Art. 15) — presumed for cybersecurity if the Cyber Resilience Act requirements are met.
• Quality management system (Art. 17), proportionate for SMEs and small mid-caps.
• Conformity assessment, EU declaration of conformity and CE marking (Art. 43, 47, 48).
• Registration in the EU database before placing on the market (Art. 49).
• Post-market monitoring and reporting of serious incidents (Art. 72, 73).

Providers must design chatbots and voice assistants so that people are told they are interacting with AI, unless it is obvious from the context.

Providers of generative AI must mark synthetic audio, images, video and text in a machine-readable, detectable way (e.g. watermarks, metadata). Systems on the market before 2 Aug 2026 have until 2 Dec 2026.

Deployers must inform the people exposed (where these systems are not prohibited).

Deployers must disclose that image, audio or video content resembling real people, objects, places or events has been generated or manipulated. For evidently artistic, satirical or fictional works a disclosure that does not spoil the work is enough.

Deployers publishing AI-generated or manipulated text to inform the public on matters of public interest must disclose it — unless a person reviewed it and someone holds editorial responsibility.

Commission guidelines with many examples for Art. 5.

Helps decide whether software is an “AI system” at all (simple rule-based software usually is not).

Transparency, copyright and safety chapters for model providers.

Who is a GPAI provider, when fine-tuning makes you one.

Mandatory template for GPAI providers.

Practical guide for Art. 50: watermarks, metadata, labels for deepfakes.

Commission FAQ, regularly updated, with examples from companies.

European standards for high-risk AI (risk management, data, logging, quality) — expected around the end of 2026; they give a presumption of conformity.

A voluntary, certifiable international standard for governing AI in an organisation — useful structure for policies and records.

Template clauses for public buyers — also useful for private contracts with AI suppliers.

The Commission’s official help desk with timeline, FAQs and a compliance checker.