eu-ai-act

Classification follows a sequence: confirm the Art. 3(1) AI system definition, screen against the 9 prohibited practices in Art. 5, then determine the risk tier under Art. 6. Annex III-listed systems are high-risk unless a narrow Art. 6(3) exception applies, but any profiling of natural persons overrides those exceptions.

Article 26 imposes ten duties including following provider instructions, assigning competent human oversight, controlling input data, monitoring and suspending on risk, retaining logs for at least 6 months, notifying workers before deployment, and informing individuals subject to Annex III decisions. Pre-deployment duties must be satisfied before go-live.

Under the Digital Omnibus adopted June 29, 2026, Annex III standalone high-risk systems must comply by December 2, 2027, and Annex I embedded product safety components by August 2, 2028. GPAI obligations have been in force since August 2, 2025, and Art. 50 transparency applies from August 2, 2026.

Yes, GPAI models trained with at least 10^23 FLOPs face Art. 53 obligations including technical documentation, a copyright policy, and a public training summary. Models at or above 10^25 FLOPs are presumed to have systemic risk and face additional Art. 55 duties such as red-teaming and incident reporting to the AI Office.

A FRIA is required for public-law bodies and private entities providing public services deploying Annex III systems, plus any deployer of credit-scoring systems under point 5(b) or life and health insurance pricing under point 5(c). Results must be notified to the market surveillance authority before the system goes live.

Article 99 sets fines up to 35 million euros or 7 percent of global turnover for prohibited practices, 15 million euros or 3 percent for provider and deployer violations, and 7.5 million euros or 1 percent for misleading information to authorities. For SMEs and startups, the lower of the fixed amount or percentage applies.