The Regulation, in its own words

What counts as an AI system

Article 3(1) defines it, and the definition is broader than "machine learning" and narrower than "software". A system is in scope when it is machine-based, designed to operate with varying levels of autonomy, may exhibit adaptiveness after deployment, and infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. Read the elements together: a deterministic rules engine someone wrote by hand does not infer, and a model that only a researcher ever runs is not placed on the market.

• — Machine-based, and designed to operate with varying levels of autonomy.
• — May exhibit adaptiveness after deployment: it can keep changing once it runs.
• — Infers, from input, how to generate outputs. This is the element that does most of the work.
• — Outputs are predictions, content, recommendations or decisions.
• — Those outputs can influence physical or virtual environments.

Worth knowing The Commission has published guidelines on this definition. They are its interpretation, they are not binding, and a court is not bound by them. Where they matter here, they are labeled.

The model and the system are different objects

A general-purpose AI model is the trained artifact: Article 3(63) describes a model that displays significant generality and can competently perform a wide range of distinct tasks. A general-purpose AI system, in Article 3(66), is a system based on such a model that can serve a variety of purposes. The distinction decides who owes what: Chapter V binds whoever provides the model, while the system you assemble on top is classified like any other system, by what it is used for.

Who the Regulation binds

Article 2(1) lists the parties in scope. Two of its rows catch teams that assume the Regulation is somebody else’s problem: a deployer established in the Union is bound even when the system came from a vendor, and a provider or deployer in a third country is bound when the output produced by the system is used in the Union.

Where the Regulation does not reach

The exclusions are narrower than they are usually quoted. Each one is a carve-out for an activity, not for a kind of company, and two of them stop the moment a system reaches the market.

• — Military, defence or national security purposes, regardless of the type of entity carrying out those activities (Art. 2(3)).
• — Systems and models developed and put into service for the sole purpose of scientific research and development (Art. 2(6)).
• — Research, testing or development activity prior to placing on the market or putting into service. Testing in real-world conditions is not covered by that exclusion (Art. 2(8)).
• — Deployers who are natural persons using a system in a purely personal non-professional activity (Art. 2(10)).
• — Systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk systems or as systems falling under Article 5 or Article 50 (Art. 2(12)).

This Regulation does not replace data protection law

Article 2(7) keeps Union law on the protection of personal data, privacy and the confidentiality of communications fully applicable to personal data processed in connection with the rights and obligations laid down here. The two regimes meet in specific places rather than merging: a deployer uses the Article 13 information to carry out its GDPR data protection impact assessment, and a fundamental rights impact assessment may cross-reference that assessment where it already covers the same ground.

The roles, and what puts you in one

The Regulation does not ask what kind of company you are. It asks what you did with a particular system. Every duty in the Act hangs off one of these roles, and the two that matter for most engineering teams are provider and deployer.

One system at a time, one role at a time

The role attaches to a system, not to a company. Article 3(3) makes you a provider of the system you place on the market; Article 3(4) makes you a deployer of the system you use under your own authority. The same team is routinely both: provider of the product it sells, deployer of the vendor tools it runs internally. Answer the question once per system, and answer it in the role you hold for that system, or the obligations you read will belong to somebody else.

When your role moves

Article 25 turns a distributor, importer, deployer or any other third party into the provider of a high-risk system, with the provider obligations of Article 16, in three circumstances. The change is not theoretical for a platform team: putting your brand on a bought system, or changing what a system is for, is a normal Tuesday.

• — You put your name or trademark on a high-risk system already on the market (Art. 25(1)(a)).
• — You make a substantial modification to a high-risk system already on the market, and it stays high-risk (Art. 25(1)(b)).
• — You modify the intended purpose of a system that was not high-risk, including a general-purpose AI system, so that it becomes high-risk (Art. 25(1)(c)).

Worth knowing When that happens, the initial provider stops being the provider of that system, and must cooperate: technical documentation, known limitations and failure modes, and targeted technical access for testing and validation (Art. 25(2)).

How the Act sorts what you run

The pyramid every explainer draws is a teaching aid, not the structure of the Regulation. What the text actually does is create separate regimes that can stack on the same system: a high-risk system that talks to people owes the Chapter III requirements and the Article 50 disclosure, and a system that is none of these still owes Article 4.

Worth knowing Regime and risk are different axes, which is why this site facets them separately: Chapter IV is named for an obligation type and Chapter V for a subject type, neither for a level of risk.

The Annex III filter, and the trapdoor in it

A system whose use case is listed in Annex III is high-risk by default. Article 6(3) lets it out only where it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision making, and only where one of four conditions holds. The derogation is not self-service: a provider who relies on it documents the assessment before the system is placed on the market, and registers the system.

• — The system performs a narrow procedural task.
• — It improves the result of a previously completed human activity.
• — It detects decision-making patterns or deviations from them, and is not meant to replace or influence the previously completed human assessment without proper human review.
• — It performs a preparatory task to an assessment relevant to an Annex III use case.

Worth knowing A system that performs profiling of natural persons is always high-risk. The filter never opens for it.

The product route, and what the amendment clarified

Article 6(1) makes a system high-risk when it is a safety component of a product, or is itself a product, covered by the Annex I harmonisation legislation, and that product must undergo third-party conformity assessment. The amended text draws the line more sharply than the original did: systems used solely for non-safety aspects of user assistance, performance optimisation, service efficiency, automation, convenience or quality control do not qualify as safety components, while systems whose failure or malfunctioning would endanger health and safety do.

The disclosure duties stack on whatever else applies

Article 50 is not a tier below high-risk. It is a separate set of duties that lands on providers and deployers of ordinary systems, and on high-risk ones too. Which of them you owe depends on your role, not on a risk score.

The tier nobody talks about: everything else

Most systems a product company runs are in none of the tiers above. They still carry one duty. Article 4 makes providers and deployers take measures to support the AI literacy of their staff and of other people operating or using the systems on their behalf, in proportion to their technical knowledge and the context of use. It does not require guaranteeing any specific level of literacy in any individual, and it is the first obligation in this Regulation that became applicable.

Open models and general-purpose models, by what you actually do

Chapter V binds the provider of a model, and the word provider does a lot of work. Find the row that matches what your team does with the weights, not the row that matches the logo on the model card.

Worth knowing The one-third-of-compute figure is an indicative criterion from the Commission’s guidelines, not a threshold in the Regulation. It is interpretation, it is not binding, and it may move.

When you become a provider

Two different doors lead to the same place, and a team that self-hosts open weights can walk through either without noticing. At the model level, modifying a general-purpose AI model can make you the provider of the modified model, with the Chapter V duties for it. At the system level, Article 25 makes you the provider of a high-risk system if you put your name on it, substantially modify it, or change its intended purpose so that it becomes high-risk. Neither door asks whether you paid for the model.

• — Model level: your modification carries the Chapter V duties for what you changed. The Commission’s indicative criterion is more than a third of the original training compute.
• — System level: Article 25(1) moves the provider obligations of Article 16 onto you.
• — The exemption for free and open-source models never covers a model with systemic risk, and Article 2(12) never covers a system placed on the market as high-risk or under Article 5 or Article 50.

Worth knowing The compute criterion comes from Commission guidelines and is not binding. The Article 25 and Article 53(2) rules are in the Regulation itself.

What the ceilings actually are

Article 99 sets maximums, not tariffs. Each row is a ceiling on what a Member State authority may impose, and for an undertaking the rule is the higher of the fixed amount and the percentage of total worldwide annual turnover for the preceding financial year. The numbers in circulation are often the ones from the 2021 proposal, which were different.

If you are an SME or an SMC, the rule inverts

This is the paragraph that matters most to a company of five to fifty engineers, and the one most often quoted wrongly. For SMEs, including start-ups, each fine referred to in Article 99 is up to the percentage or the amount of paragraphs 3, 4 and 5, whichever is lower. For small mid-cap enterprises the same lower-of-the-two rule applies, but only to the fines in paragraphs 4 and 5. Article 99(1) also tells Member States to take the interests of SMEs, start-ups and SMCs, and their economic viability, into account when imposing penalties.

Worth knowing Sources that state "the higher of" as a universal rule are describing paragraphs 3 to 5 without their exception.

Who fines, and since when

The Regulation does not fine anyone by itself. Article 99(1) makes Member States lay down the rules on penalties and other enforcement measures, effective, proportionate and dissuasive, and notify them to the Commission. So the authority that can fine your company is national, and the national regime is where the detail lives. The chapter that carries these rules has been applicable since the date Article 113(b) sets, with Article 101 excepted from that block.