Framework
EU AI Act
The Union law on artificial intelligence: risk tiers, roles, and the obligations that follow from them. Each page sets out what a provision requires, who it binds, when it applies, and what evidence discharges it.
§ 1 — Orientation
How the Act is put together
The Act does not regulate artificial intelligence in general. It regulates particular uses of it, sorted into tiers, and almost everything that follows turns on which tier a system lands in and which role you occupy in relation to it. A system that is prohibited under Article 5 cannot be placed on the market at all. A system that is high-risk — because it appears in Annex III, or because it is a safety component of a product already regulated under Annex I — carries the obligations set out in Articles 8 to 17 for its provider and Article 26 for its deployer. Everything else carries transparency duties at most.
The role question is the one organisations get wrong most often, and it is not a matter of self-description. A company that buys a model, puts its own name on it and sells it on is a provider, not a deployer, and inherits the provider obligations wholesale under Article 25(1). So does one that substantially modifies a high-risk system. Reading these pages, the first question to settle is not what the article requires but whether it requires it of you.
The obligations below are the ones that generate assurance work: something has to be built, evidenced, and capable of being shown to someone who did not build it. For each, these pages state the provision, who it binds, when it applies, and the artefacts an assessor asks for — which is the part the Regulation itself never sets out, because it specifies outcomes and leaves the evidence to practice.
§ 2 — By who it binds
Obligations by role
On the provider
Whoever develops the system, or places it on the market under their own name — including a deployer that rebrands or substantially modifies one.
- Article 5Prohibited AI practices
Article 5 lists the uses of AI the Union will not permit at all: manipulation causing significant harm, exploitation of vulnerability, social scoring, untargeted facial scraping, emotion…
- Article 6Classification rules for high-risk AI systems
Article 6 decides whether the high-risk regime applies to you at all.
- Article 9Risk management system
Article 9 requires a risk management system that runs continuously across the whole lifecycle of a high-risk AI system, not a document produced once before launch.
- Article 10Data and data governance
Article 10 governs the training, validation and testing data behind a high-risk system: documented governance practices, examination for bias, and datasets that are relevant, sufficiently…
- Article 11Technical documentation
Article 11 requires the technical documentation of a high-risk system to exist before the system is placed on the market, and to be kept up to date afterwards, containing at a minimum the…
- Article 12Record-keeping
Article 12 requires a high-risk system to technically allow automatic logging of events across its lifetime, at a level of traceability appropriate to its purpose.
- Article 13Transparency and provision of information to deployers
Article 13 makes the provider explain the system to whoever will operate it.
- Article 14Human oversight
Article 14 requires high-risk systems to be designed so they can be effectively overseen by people.
- Article 15Accuracy, robustness and cybersecurity
Article 15 requires an appropriate level of accuracy, robustness and cybersecurity, held consistently across the lifecycle.
- Article 50Transparency obligations for providers and deployers of certain AI systems
Article 50 requires people to be told when they are dealing with AI: that they are interacting with a system, that content was artificially generated, that emotion recognition is running.
- Article 72Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems
Article 72 requires a provider to establish, document and run a system that actively collects and analyses field data across a high-risk system’s lifetime — for one specific purpose: eval…
- Article 73Reporting of serious incidents
Article 73 puts a provider on three clocks.
On the deployer
Whoever uses the system under their own authority, in the course of their activity.
- Article 5Prohibited AI practices
Article 5 lists the uses of AI the Union will not permit at all: manipulation causing significant harm, exploitation of vulnerability, social scoring, untargeted facial scraping, emotion…
- Article 6Classification rules for high-risk AI systems
Article 6 decides whether the high-risk regime applies to you at all.
- Article 26Obligations of deployers of high-risk AI systems
Article 26 is the deployer’s article.
- Article 27Fundamental rights impact assessment for high-risk AI systems
Article 27 obliges certain deployers to assess the impact on fundamental rights before putting a high-risk system into use, and to notify the market surveillance authority of the result.
- Article 50Transparency obligations for providers and deployers of certain AI systems
Article 50 requires people to be told when they are dealing with AI: that they are interacting with a system, that content was artificially generated, that emotion recognition is running.
§ 3 — By when it applies
Obligations by date
The date each obligation first bites, earliest first. Where a provision applies on more than one date, the earliest is shown.
2 Feb 2025
2 Aug 2026
Article 50 — Transparency obligations for providers and deployers of certain AI systems
2 Aug 2026
2 Aug 2026
2 Dec 2027
2 Dec 2027
2 Dec 2027
2 Dec 2027
2 Dec 2027
2 Dec 2027
Article 13 — Transparency and provision of information to deployers
2 Dec 2027
2 Dec 2027
2 Dec 2027
Article 26 — Obligations of deployers of high-risk AI systems
2 Dec 2027
Article 27 — Fundamental rights impact assessment for high-risk AI systems
§ 4 — Guides
Guides to this framework
Written about the instrument as a whole rather than provision by provision. Where an obligation page answers what one article requires, these answer what the thing is for and how it is adopted.
The EU AI Act's conformity assessment, explained for non-lawyers
What conformity assessment involves, who actually does it, and why the high-risk deadline moved to December 2027 — while the live obligations did not move.
§ 5 — Elsewhere
The same ground, cut differently
Certification
Assessed on the same standard of evidence
Every Council credential is examined on applied judgement against a published anchor, set out the way the obligations on this page are. The Certified Applied AI Associate, the Council’s flagship, is open to any adult today, its fee waived by a coupon code from the AI-Readiness Check, and the register lists what is open for enrolment.