EU AI Act: Upcoming Deadlines and Compliance Essentials

AI Definition  

According to the definition in Article 3(1) of the AI Act, an AI system is a machine-based system designed to operate autonomously and adaptively, generating outputs such as predictions, content, recommendations, or decisions from the input it receives. Recital 12 clarifies that AI systems do not include rule-based systems solely operated by humans, with a defining feature being their ability to infer through machine learning or logic- and knowledge-based approaches, enabling learning, reasoning, and modeling beyond basic data processing.

The impact of AI Act on an organisation differs depending on the role

The legal framework will apply to both public and private actors inside and outside the EU as long as the AI system is placed on the Union market or the output is used in the EU. It can concern both providers and deployers of high-risk AI systems. It does not apply to private, non-professional uses. In general, the AI Act distinguishes between the following roles:

A risk-based approach towards AI

The AI Act adopts a risk-based approach to regulating AI systems. The stringency of the applicable rules depends on the potential severity of harm to fundamental rights and the likelihood of that harm occurring. The risk categories are:

Deployers’ Obligations

Deployers of high-risk AI systems must implement technical and organisational measures, provide human oversight, monitor the systems, ensure the input data is relevant and representative, maintain logs, and conduct data protection impact assessments. For instance, if AI is used in an employment context, employees must be informed of its use.

General Purpose AI models (GPAI)

Providers and deployers of AI systems using GPAI models are not subject to Chapter V of the AI Act but must follow its general rules. GPAI models and systems are treated separately, as highlighted on the graph above. GPAI providers must fulfill several obligations, including creating technical documentation, establishing a copyright policy, and publishing data on training content.