--- authoritative: false representation: annotated-page publisher: AstroKube methodology: https://ai-act.astrokube.com/about/ source_verified_on: '2026-09-15' site_content_updated_on: '2026-09-15' title: 'AI Act glossary: the terms that decide what applies | AstroKube' description: Provider, deployer, substantial modification, placing on the market. Key terms from the EU AI Act, each explained with citations to the relevant provisions. language: en source: https://ai-act.astrokube.com/glossary/ --- 1. [Start](https://ai-act.astrokube.com/) 2. Glossary ARTICLE 3, DEFINITIONS # The words that decide what applies to you The AI Act turns ordinary words into terms of art. Whether you are a provider or a deployer, whether a change counts as a substantial modification, whether a system was placed on the market: each of these is defined in the Regulation, and each one changes what you owe. Every definition here cites the provision it comes from. ### affected persons [EU Art. 2(1)(g)](https://ai-act.astrokube.com/law/art-2/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") The people a system is used on, rather than the people who run it. The Act does not define the term in Article 3; it brings affected persons located in the Union into scope in Article 2(1)(g), requires deployers of Annex III systems to tell people they are subject to one in Article 26(11), and gives a right to an explanation of individual decision-making in Article 86. ### free and open-source licence [EU Art. 2(12)](https://ai-act.astrokube.com/law/art-2/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") The licence that carries the Act's narrowest and most misread exemption. Article 2(12) puts AI systems released under free and open-source licences outside the Regulation, unless they are placed on the market or put into service as high-risk systems or as systems falling under Article 5 or Article 50. For general-purpose AI models, Article 53(2) lifts two specific obligations instead, and never for models with systemic risk. ### provider [EU Art. 3(3)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") The party that develops an AI system or model, or has one developed, and places it on the market or puts it into service under its own name or trademark. Paid or free makes no difference. Putting your brand on someone else's system makes you one. ### deployer [EU Art. 3(4)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") The party using an AI system under its own authority. Personal, non-professional use is excluded. Using a system does not make you a deployer only: Article 25 can turn you into a provider. ### authorised representative [EU Art. 3(5)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") A person or body in the Union holding a written mandate from a provider to carry out that provider's obligations under the Regulation on its behalf. Required of providers established outside the Union. ### importer [EU Art. 3(6)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") A party in the Union that places on the market an AI system bearing the name or trademark of someone established outside the Union. ### distributor [EU Art. 3(7)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") A party in the supply chain other than the provider or the importer that makes an AI system available on the Union market. ### operator [EU Art. 3(8)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") The collective term for a provider, product manufacturer, deployer, authorised representative, importer or distributor. ### placing on the market [EU Art. 3(9)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") The first time an AI system or general-purpose model is made available on the Union market. Many duties attach to this moment, so it matters when it happened. ### making available on the market [EU Art. 3(10)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") Supplying an AI system or general-purpose model for distribution or use on the Union market in the course of a commercial activity, paid or free. ### putting into service [EU Art. 3(11)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") Supplying an AI system for first use directly to the deployer, or using it yourself in the Union for its intended purpose. Internal systems you never sell are still put into service. ### intended purpose [EU Art. 3(12)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") The use the provider intends for a system, including the context and conditions of use, as set out in the instructions for use, the sales and promotional material, and the technical documentation. What you wrote down, not what you meant. ### reasonably foreseeable misuse [EU Art. 3(13)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") Use of a system in a way that is not its intended purpose but may result from reasonably foreseeable human behaviour or interaction with other systems. It is the reason a risk management file cannot stop at the happy path: the Act asks about the uses you can foresee, not only the ones you designed for. ### safety component [EU Art. 3(14)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") A component of a product or of an AI system that fulfils a safety function, or whose failure endangers health, safety or property. It is one half of the Article 6(1) route into the high-risk tier. Systems used solely for user assistance, performance optimization, service efficiency, automation, convenience or quality control do not qualify; systems whose failure would endanger health and safety do. ### SMC [EU Art. 3(14b)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") A small mid-cap enterprise as defined in Recommendation (EU) 2025/1099. Article 99(6a) gives it the lower-of-the-two cap as well, but only for the fines in Article 99(4) and (5), not for the prohibited-practice fines in Article 99(3). ### SME [EU Art. 3(14a)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") A micro, small or medium-sized enterprise as defined in the Annex to Recommendation 2003/361/EC. The definition matters for penalties: under Article 99(6) each fine for an SME, including a start-up, is capped at the lower of the percentage and the fixed amount, which is the reverse of the rule for everyone else. ### conformity assessment [EU Art. 3(20)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") The process of demonstrating that a high-risk system meets the requirements of Chapter III, Section 2. Depending on the case it runs on internal control or through a notified body. ### notified body [EU Art. 3(22)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") A conformity assessment body notified under the Regulation. Where third-party assessment applies, this is who performs it. Not us, and not your auditor. ### substantial modification [EU Art. 3(23)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") A change made after a system is on the market that the original conformity assessment did not foresee, and that either affects compliance with the high-risk requirements or changes the intended purpose it was assessed for. This is the test that decides whether fine-tuning or repurposing makes you a provider. ### CE marking [EU Art. 3(24)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") The marking by which a provider indicates that a system conforms to the Chapter III, Section 2 requirements and to any other Union harmonisation legislation requiring it. It is a declaration by the provider, not a certificate issued to it. ### post-market monitoring system [EU Art. 3(25)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") Everything a provider does to collect and review experience from systems it has placed on the market or put into service, so that corrective or preventive action can be taken immediately when needed. ### market surveillance authority [EU Art. 3(26)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") The national authority that carries out market surveillance under Regulation (EU) 2019/1020. This is who serious incidents are reported to, and who approves real-world testing. ### harmonised standard [EU Art. 3(27)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") A harmonised standard as defined in Regulation (EU) No 1025/2012: a European standard adopted on a Commission request. Conformity with one whose reference has been published in the Official Journal buys the presumption of conformity under Article 40. A standard that has not been cited in the Official Journal buys nothing yet. ### common specification [EU Art. 3(28)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") A set of technical specifications providing means to comply with certain requirements of this Regulation. The Commission may adopt them where harmonised standards are missing or insufficient, which is what makes them worth watching while the standards are still in drafting. ### serious incident [EU Art. 3(49)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") An incident or malfunction that directly or indirectly leads to a death or serious harm to health, a serious and irreversible disruption of critical infrastructure, a breach of Union law protecting fundamental rights, or serious harm to property or the environment. ### profiling [EU Art. 3(52)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") Profiling as the GDPR defines it: automated processing of personal data to evaluate personal aspects of a natural person. It carries a hard consequence here. An Annex III system that performs profiling of natural persons is always high-risk, with no route through the Article 6(3) derogation. ### AI regulatory sandbox [EU Art. 3(55)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") A controlled framework set up by a competent authority where providers can develop, train, validate and test an innovative system, in real-world conditions where appropriate, under supervision and for a limited time. ### AI literacy [EU Art. 3(56)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") The skills, knowledge and understanding that let providers, deployers and affected persons make an informed deployment of AI systems and be aware of the opportunities and risks. Article 4 turns it into a duty on providers and deployers, and it is the one obligation that applies at any risk level. ### deep fake [EU Art. 3(60)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") AI-generated or manipulated image, audio or video content resembling real people, objects, places, entities or events, which would falsely appear authentic. The disclosure duty in Article 50(4) falls on the deployer who generates or manipulates the content, which is a different party from the provider who must mark synthetic outputs under Article 50(2). ### general-purpose AI model [EU Art. 3(63)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") A model that displays significant generality and can competently perform a wide range of distinct tasks, whatever way it reaches the market, and that can be integrated into many downstream systems. Models used only for research, development or prototyping before market are excluded. ### systemic risk [EU Art. 3(65)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") A risk specific to the high-impact capabilities of general-purpose models, significant for the Union market through their reach or through reasonably foreseeable negative effects on health, safety, security, fundamental rights or society, and able to propagate at scale along the value chain. ### general-purpose AI system [EU Art. 3(66)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") An AI system based on a general-purpose AI model that can serve a variety of purposes, both directly and integrated into other systems. The model and the system are different objects with different duties: Chapter V binds whoever provides the model, while the system you build on it is classified like any other system. ### high-risk AI system [EU Art. 6](https://ai-act.astrokube.com/law/art-6/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") Not a judgement about how important a system is. Article 6 makes a system high-risk on two routes: it is a safety component of a product covered by Annex I that needs third-party conformity assessment, or it is a use case listed in Annex III. An Annex III system escapes only through the Article 6(3) derogation, which the provider must document before placing the system on the market, and never where the system performs profiling of natural persons. ### significant risk of harm [EU Art. 6(3)](https://ai-act.astrokube.com/law/art-6/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") The test an Annex III system must fail to escape the high-risk tier: it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making. Article 6(3) then lists the four narrow conditions, and the provider documents the assessment before placing the system on the market. ### fundamental rights impact assessment [EU Art. 27](https://ai-act.astrokube.com/law/art-27/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") The assessment some deployers of Annex III high-risk systems must carry out before putting one into use, covering the processes the system will be used in, the period and frequency of use, the categories of people affected, the specific risks of harm to them, the human oversight measures, and what happens if the risks materialize. It is not a data protection impact assessment, and one does not replace the other. ### presumption of conformity [EU Art. 40(1)](https://ai-act.astrokube.com/law/art-40/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") The legal effect of following a harmonised standard whose reference is published in the Official Journal: the system or model is presumed to meet the requirements that the standard covers. It is a presumption, not a certificate, it reaches only as far as the standard reaches, and it needs the reference to be published first. ### synthetic content [EU Art. 50(2)](https://ai-act.astrokube.com/law/art-50/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") Audio, image, video or text content generated by an AI system. Article 50(2) makes the provider mark the outputs in a machine-readable format and detectable as artificially generated or manipulated. The duty sits on whoever provides the generating system, before anyone decides whether a particular output is a deep fake.