The library
The reference material behind the guide. Free to read, no account needed. Use it to check a definition, place yourself on the risk scale, or work out which duties follow from your role.
Where we are now
The dates that matter
The Digital Omnibus changed when the high-risk rules arrive. The milestones already in force remain in place.
Updated for Regulation (EU) 2026/1744, published on July 24th, 2026-
AI literacy and prohibited practices The first prohibited-practice rules and the AI literacy framework began to apply.
-
Governance and GPAI obligations EU governance provisions and obligations for providers of general-purpose AI models became applicable.
-
Transparency and wider application Article 50 transparency duties and most remaining AI Act provisions apply, subject to the amended transitions.
-
Content marking transition and new prohibited practices The transition point for certain pre-existing generative systems and the new prohibited-practice provisions applies.
-
Stand-alone high-risk systems The high-risk rules for systems classified under Article 6(2) and Annex III apply.
-
High-risk systems in regulated products The high-risk rules for systems classified under Article 6(1) and Annex I apply.
Role matrix
Who owes what
Role decides the weight of your obligations. It follows from what you do with a system, not from who wrote the code.
| Role | You are this if | Principal duties |
|---|---|---|
| Provider | You developed the system, or it goes to market under your name or trade mark. |
|
| Deployer | You use an AI system under your own authority, in a professional capacity. |
|
| Importer | You place on the EU market a system from a provider established outside the Union. |
|
| Distributor | You make a system available on the market without being provider or importer. |
|
A deployer becomes a provider by putting its name on a system, making a substantial modification, or changing the intended purpose. Article 25 sets out when responsibility moves along the chain.
Risk matrix
What each tier triggers
Risk depends on the use, not the technology. The same model can sit in three different tiers in three different products.
| Tier | Typical cases | What it means for you |
|---|---|---|
| Prohibited | Social scoring, untargeted scraping to build facial recognition databases, emotion inference at work or school, certain predictive policing and manipulative techniques. | Do not place on the market, put into service or use. Applicable since February 2025, with further provisions from December 2026. |
| High risk | Safety components of regulated products, and the Annex III uses: employment, education, essential public and private services, credit, law enforcement, migration, administration of justice. | Full obligations: risk management, data governance, documentation, logging, human oversight, accuracy and robustness, conformity assessment. Annex III from December 2027, Annex I from August 2028. |
| Limited risk | Systems that interact with people, generate synthetic audio, image, video or text, or perform emotion recognition and biometric categorisation outside the prohibited cases. | Article 50 transparency: tell people they are dealing with AI, and mark synthetic content in a machine-readable way. Applicable since August 2026. |
| Minimal risk | The large majority of business software: spam filters, recommendation engines, inventory forecasting, most internal productivity tools. | No specific AI Act obligations beyond AI literacy, but GDPR, product liability and sector rules still apply. Voluntary codes of conduct are encouraged. |
Glossary
The vocabulary, in plain language
34 terms, each with the article it comes from, so you can check us against the text.
- AI literacy
- The skills, knowledge and understanding that let staff deploy AI systems soundly and recognise the harm they can cause. Providers and deployers must ensure a sufficient level among the people operating their systems. Article 4
- AI system
- A machine-based system that operates with varying autonomy, may adapt after deployment, and infers from input how to generate outputs such as predictions, content, recommendations or decisions. Article 3(1)
- Annex I
- The list of Union harmonisation legislation. An AI system that is a safety component of a product covered there can be high risk under Article 6(1). Annex I
- Annex III
- The list of stand-alone high-risk use cases: biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and justice. Annex III
- Authorised representative
- A person in the Union mandated in writing by a non-EU provider to carry out its obligations and act as the contact point for authorities. Article 22
- Biometric categorisation
- Assigning people to categories on the basis of biometric data. Prohibited where it infers race, political opinions, trade union membership, religion, sex life or sexual orientation. Articles 5, 50
- CE marking
- The mark indicating that a high-risk AI system has been through conformity assessment and meets the applicable requirements. Article 48
- Codes of practice
- Instruments encouraged by the Commission to help providers of general-purpose AI models demonstrate compliance before harmonised standards exist. Article 56
- Conformity assessment
- The process demonstrating that a high-risk system meets the requirements. Internal control in most Annex III cases, notified body involvement in others. Article 43
- Deep fake
- AI-generated or manipulated image, audio or video that resembles real people, objects or events and would falsely appear authentic. Must be disclosed. Article 50(4)
- Deployer
- Anyone using an AI system under their own authority in a professional capacity. Not a personal, non-professional user. Article 3(4)
- Digital Omnibus
- Regulation (EU) 2026/1744, published July 24th, 2026, which amended the AI Act transitions and moved the high-risk application dates. Regulation 2026/1744
- Distributor
- Anyone in the supply chain, other than provider or importer, who makes an AI system available on the Union market. Article 3(7)
- Emotion recognition system
- A system that identifies or infers emotions or intentions from biometric data. Prohibited in workplaces and education outside medical and safety uses. Articles 3(39), 5, 50
- Fundamental rights impact assessment
- The assessment certain deployers of Annex III systems must run before first use, covering affected people, risks and oversight measures. Article 27
- General-purpose AI model
- A model trained at scale on broad data, showing significant generality, capable of competently performing a wide range of tasks, and integrable into downstream systems. Article 3(63)
- High-risk AI system
- A system that is either a safety component of a regulated product or falls within an Annex III use case, and is not exempt under the filter in Article 6(3). Article 6
- Human oversight
- Measures letting a competent person understand a system, monitor its operation, interpret its output, decide not to use it, and intervene or stop it. Article 14
- Importer
- A person established in the Union who places on the market an AI system bearing the name or trade mark of a person established outside it. Article 3(6)
- Instructions for use
- The information a provider supplies with a high-risk system: capabilities, limitations, accuracy, oversight measures and expected lifetime. Article 13
- Intended purpose
- The use for which a provider intends a system, as described in its documentation and instructions. Changing it can make a deployer the provider. Article 3(12)
- Logging
- Automatic recording of events over a system's lifetime, so that its functioning can be traced and post-market monitoring is possible. Articles 12, 19
- Market surveillance authority
- The national authority responsible for enforcing the Regulation, with powers to require information, test systems and order corrective action. Article 74
- Notified body
- A conformity assessment body designated by a member state to carry out third-party assessment where the Regulation requires it. Article 31
- Post-market monitoring
- The provider's systematic collection and review of experience with a system in use, feeding back into its risk management. Article 72
- Prohibited practice
- A use banned outright: manipulation causing significant harm, exploitation of vulnerability, social scoring, and the specified biometric and predictive uses. Article 5
- Provider
- Anyone who develops an AI system or model, or has one developed, and places it on the market or puts it into service under their own name or trade mark. Article 3(3)
- Real-time remote biometric identification
- Biometric identification of people at a distance without their active involvement, and without significant delay. Prohibited for law enforcement outside narrow exceptions. Articles 3(42), 5
- Regulatory sandbox
- A controlled framework set up by a national authority allowing development, training and testing of innovative AI systems under supervision. Article 57
- Serious incident
- An incident or malfunction leading, directly or indirectly, to death, serious harm to health, serious disruption of critical infrastructure, breach of fundamental rights, or serious damage to property or environment. Articles 3(49), 73
- Substantial modification
- A change to a high-risk system after it is on the market that is not foreseen in the provider's initial assessment and affects compliance or intended purpose. Article 3(23)
- Synthetic content marking
- The duty on providers of generative systems to mark outputs in a machine-readable format detectable as artificially generated or manipulated. Article 50(2)
- Systemic risk
- Risk specific to the high-impact capabilities of general-purpose models, with significant effect on the Union market through reach or foreseeable negative effects. Article 3(65)
- Transparency obligation
- The Article 50 duties: tell people they are interacting with AI, disclose deep fakes and emotion recognition, and mark synthetic output. Article 50
No term matches that search.
Official sources
Go to the text itself
Everything above restates the Regulation. When a decision matters, read the source.
Regulation (EU) 2024/1689
The AI Act itself, on EUR-Lex, with all annexes.
Regulation (EU) 2026/1744
The Digital Omnibus, which amended the transitions on July 24th, 2026.
European Commission overview
The Commission's own explanation of the framework and its timeline.
This library is educational information, not legal advice. Dates and duties are stated as we understand them following the Digital Omnibus. Verify against the consolidated text before acting.
Know the words, still unsure of your position?
The assessment turns these definitions into an answer about your own systems.