Question 1

What is the EU AI Act?

Accepted Answer

The EU AI Act is a comprehensive regulatory framework that governs the development, deployment, and use of artificial intelligence systems in the European Union. It aims to ensure AI is safe, transparent, and respects fundamental rights.

Question 2

Who does the EU AI Act apply to?

Accepted Answer

The Act applies to providers and deployers of AI systems placed on the EU market or used in the EU, regardless of where they are established. It also covers providers and deployers outside the EU when the output produced by their AI system is used in the EU.

Question 3

When does the EU AI Act come into force?

Accepted Answer

The EU AI Act entered into force on 1 August 2024. Prohibited practices are banned after 6 months, general-purpose AI model obligations apply after 12 months, and the full regulation applies 36 months after entry into force.

Question 4

How do I know if my AI system is high-risk?

Accepted Answer

High-risk AI systems are defined in Annex III of the Act and include systems used in critical infrastructure, education, employment, essential services, law enforcement, migration, and administration of justice. Whether a system is high-risk also depends on its intended purpose and the context in which it is used.

Question 5

What's the difference between "provider" and "deployer"?

Accepted Answer

A "provider" develops or has developed an AI system and places it on the market or puts it into service under its own name. A "deployer" uses an AI system under its authority in a professional capacity. Each role has a distinct set of obligations under the Act.

Question 6

What is the conformity assessment procedure for high-risk AI?

Accepted Answer

High-risk AI systems must undergo a conformity assessment before being placed on the market or put into service. The procedure may involve internal control or, where required, assessment by a notified body. It must be repeated whenever the system is substantially modified.

Question 7

Do we have to register our AI system in the EU database?

Accepted Answer

Providers of high-risk AI systems (with limited exceptions) must register their systems in the EU database maintained by the European Commission before placing them on the market. Deployers of certain high-risk systems may also have registration or notification duties.

Question 8

What documentation must we keep for a high-risk system?

Accepted Answer

Providers must maintain technical documentation describing the system's characteristics, design, intended purpose, and risk-management measures. The documentation must be kept up to date and made available to authorities on request, typically for at least 10 years.

Question 9

Does Article 50 (transparency) apply to all chatbots?

Accepted Answer

Article 50 transparency obligations apply to AI systems that interact directly with people, generate synthetic content, or are used for emotion recognition or biometric categorization. Purely internal B2B tools with no direct user interaction may not fall under Article 50, but other obligations may still apply.

Question 10

Does the EU AI Act apply to internal-only AI tools?

Accepted Answer

Yes, in many cases. If an internal-only AI tool is used to make or support decisions affecting employment, access to services, or other Annex III contexts, it can still be high-risk. The "internal-only" status does not exempt a system from the regulation by itself.

Question 11

Are foundation models like GPT-4 covered?

Accepted Answer

Yes. General-purpose AI (GPAI) models, including large foundation models, have specific obligations under the Act (Articles 51–55). Models classified as posing "systemic risk" face additional requirements around evaluations, incident reporting, cybersecurity, and energy efficiency.

Question 12

What are the penalties for non-compliance?

Accepted Answer

Penalties can reach up to €35 million or 7% of global annual turnover for prohibited AI practices. Violations involving high-risk systems can result in fines up to €15 million or 3% of global turnover, whichever is higher. Member States set the exact enforcement framework.

Question 13

Where do I find enforcement authorities in my Member State?

Accepted Answer

Each Member State designates national competent authorities for the AI Act. The European AI Office coordinates cross-border enforcement for general-purpose AI models. The European Commission's AI Act page lists national contact points as Member States publish them.

Question 14

Are there exemptions for SMEs or startups?

Accepted Answer

The Act contains some proportionate measures for SMEs, including simplified conformity assessment procedures, reduced fees, and prioritised guidance. However, the substantive obligations (transparency, high-risk requirements, prohibited practices) still apply regardless of company size.

Question 15

What happens if our AI system classification changes?

Accepted Answer

If a previously low-risk system later meets an Annex III criterion or is repurposed, the provider must apply the high-risk obligations before continuing to place or use it. Substantial modifications also trigger re-assessment under the conformity assessment procedure.

Question 16

Is my AI system "high-risk" if it assists rather than decides?

Accepted Answer

Possibly. The Act covers AI systems that assist in decision-making, not only those that automate it. If your system materially influences a decision in an Annex III area (e.g. recruitment, credit, education), it can still be high-risk. The relevant question is impact, not autonomy.

Question 17

Can we use AI for HR screening without notifying candidates?

Accepted Answer

No. Article 13 requires transparency to affected individuals. Candidates must be informed that an AI system is being used, in a clear and intelligible manner, before the system is applied to them. Some Member States may impose additional worker-information obligations.

Question 18

Is AI for content moderation on social platforms "high-risk"?

Accepted Answer

It can be. Content-moderation systems that detect and remove illegal content, prioritise responses, or filter content based on user profiling may intersect with Annex III (law enforcement, migration, or essential services), depending on the deployment. Each system should be assessed individually.

Question 19

Do employees have a right to know when AI is used in workplace monitoring?

Accepted Answer

Yes. Workers and their representatives must be informed before AI systems are used to monitor or evaluate their performance. Member State labour law and the AI Act's transparency obligations apply together; the more protective rule typically governs.

Question 20

Does the AI Act apply to companies outside the EU?

Accepted Answer

Yes, in certain cases. If the output produced by your AI system is used in the EU, or if you place your system on the EU market, the Act can apply to you regardless of where you are established. Many non-EU providers designate an EU-based authorised representative to satisfy provider obligations.

Question 21

How long does the conformity assessment take in practice?

Accepted Answer

Timelines vary by system complexity, the assessment route chosen, and the availability of notified bodies. Internal-control procedures can take weeks; notified-body assessments often take several months. Plan compliance timelines at least 6–12 months before market placement.

Question 22

What is "post-market monitoring" and when does it apply?

Accepted Answer

Post-market monitoring is the ongoing obligation providers have to observe a high-risk system's performance in real-world use, report serious incidents, and take corrective action when needed. It applies throughout the system's lifecycle, not only at launch.

Question 23

What's the relationship between the AI Act and GDPR?

Accepted Answer

The AI Act is lex specialis for AI-specific risks and complements GDPR, which governs personal data processing more broadly. Both apply in parallel where they overlap. The European Data Protection Board and the AI Office coordinate guidance on the intersection.

Question 24

What is the role of notified bodies in the conformity assessment?

Accepted Answer

Notified bodies are independent third-party organisations designated by Member States to carry out conformity assessments for certain high-risk AI systems. They audit technical documentation, test systems against requirements, and issue certificates that allow providers to apply CE marking.

Understand the EU AI Act

Prohibited

High Risk

Limited Risk

Minimal Risk

Frequently asked questions

What the EU AI Act is (5)

Compliance obligations (6)

Penalties & enforcement (4)

Sector-specific questions (5)

Operational questions (4)

Industry compliance guides

Human Resources & Recruitment

Healthcare & Medical Technology

Financial Services & Banking

Legal Services & Law Firms

Retail & E-commerce

Education & EdTech

Article-by-article explainers

Prohibited artificial intelligence practices

Classification rules for high-risk AI systems

Risk management system

Data and data governance

Technical documentation

Record-keeping

Transparency and provision of information to deployers

Human oversight

Accuracy, robustness and cybersecurity

Obligations of deployers of high-risk AI systems

Fundamental rights impact assessment (FRIA)

Transparency obligations for providers and deployers of certain AI systems

AI literacy

Compliance with the requirements

Obligations of providers of high-risk AI systems

Quality management system

Documentation keeping

Conformity assessment

CE marking

Registration

Classification of general-purpose AI models with systemic risk

Obligations for providers of general-purpose AI models

Post-market monitoring by providers

Reporting of serious incidents

Penalties

Entry into force and application

Ready to check your specific use case?