EU Artificial Intelligence Act

Training, validation, and testing datasets for high-risk AI must meet quality criteria and be subject to governance practices addressing bias, representativeness, and data origin

Article 10 — Data and data governance · Read the full page →

Technical documentation must be drawn up before a high-risk AI system is placed on market, demonstrating compliance with all requirements and kept up to date

Article 11 + Annex IV — Technical documentation · Read the full page →

High-risk AI systems must support automatic logging of events to enable traceability, risk monitoring, and post-market surveillance

Article 12 — Record-keeping (automatic logging) · Read the full page →

High-risk AI systems must be transparent enough for deployers to interpret outputs and use them appropriately, with clear instructions for use

Article 13 — Transparency and provision of information to deployers · Read the full page →

High-risk AI systems must be designed for effective human oversight including the ability to understand, monitor, interpret, override, and stop the system

Article 14 — Human oversight · Read the full page →

High-risk AI systems must achieve appropriate accuracy, robustness against errors, and cybersecurity resilience against adversarial attacks throughout their lifecycle

Article 15 — Accuracy, robustness, and cybersecurity · Read the full page →

Deployers of Annex III high-risk AI systems that make or assist decisions about people must inform those people that they are subject to the use of the system

Article 26(11) — Deployer duty to inform natural persons that they are subject to the use of a high-risk AI system · Read the full page →

Deployers must assign human oversight of a high-risk AI system to named natural persons who have the competence, training, authority and support the role requires

Article 26(2) — Deployer duty to assign human oversight to competent, trained and authorised persons · Read the full page →

Where the deployer controls the input data, it must ensure that data is relevant and sufficiently representative for the system's intended purpose

Article 26(4) — Deployer duty to ensure input data is relevant and sufficiently representative · Read the full page →

Deployers must retain the logs a high-risk AI system generates automatically, where those logs are under their control, for a period appropriate to the intended purpose and at least six months

Article 26(6) — Deployer duty to keep the logs automatically generated by the high-risk AI system · Read the full page →

Employers must inform workers' representatives and the affected workers before putting a high-risk AI system into service or using it at the workplace

Article 26(7) — Employer duty to inform workers' representatives and affected workers before workplace use · Read the full page →

Deployers of high-risk AI must use the system in accordance with the provider’s instructions for use, monitor its operation, and report risks and serious incidents to the provider and the market surveillance authority

Article 26(1), (3), (5) — Deployer use per instructions, monitoring and incident reporting · Read the full page →

Public-law bodies, private entities providing public services, and deployers of creditworthiness or life/health-insurance AI must complete a fundamental rights impact assessment before first use of a high-risk AI system and notify its results to the market surveillance authority

Article 27 — Fundamental rights impact assessment for high-risk AI systems · Read the full page →

Take context-sensitive measures to support AI literacy development among staff and persons operating AI systems on your behalf

Article 4(1) — AI literacy (amended 2026) · Read the full page →

Providers must register themselves and each Annex III high-risk AI system in the EU database before placing it on the market or putting it into service; point 2 (critical infrastructure) systems are registered nationally instead

Article 49(1) — Registration of the provider and the high-risk AI system in the EU database · Read the full page →

Public-authority deployers must register themselves, select the system and register its use in the EU database before putting an Annex III high-risk AI system into service or using it

Article 49(3) — Registration of public-authority deployers and their use of the system · Read the full page →

Biometric categorisation systems that deduce a person's race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation are prohibited

Article 5(1)(g) — Prohibition on biometric categorisation to deduce protected attributes · Read the full page →

AI systems that infer emotions of natural persons in the workplace or in education institutions are prohibited, unless intended for medical or safety reasons

Article 5(1)(f) — Prohibition on inferring emotions in the workplace and in education institutions · Read the full page →

AI systems that create or expand facial recognition databases by untargeted scraping of facial images from the internet or CCTV footage are prohibited

Article 5(1)(e) — Prohibition on building facial recognition databases by untargeted scraping · Read the full page →

AI systems that predict a person's risk of committing a criminal offence based solely on profiling or personality traits are prohibited; systems supporting a human assessment grounded in objective, verifiable facts are not

Article 5(1)(d) — Prohibition on predicting criminal offending from profiling or personality traits · Read the full page →

'Real-time' remote biometric identification in publicly accessible spaces for law-enforcement purposes is prohibited except for three strictly necessary objectives, and then only with prior judicial authorisation, a fundamental rights impact assessment and EU-database registration

Article 5(1)(h) — Prohibition on 'real-time' remote biometric identification in publicly accessible spaces for law enforcement · Read the full page →

AI systems used for social scoring that leads to detrimental treatment in unrelated contexts or disproportionate treatment are prohibited

Article 5(1)(c) — Prohibition on social scoring · Read the full page →

AI systems that use subliminal, manipulative, or deceptive techniques to materially distort behaviour causing significant harm are prohibited

Article 5(1)(a) — Prohibition on subliminal AI techniques · Read the full page →

AI systems that exploit vulnerabilities of specific groups — including children due to their age — to distort behaviour causing harm are prohibited

Article 5(1)(b) — Prohibition on exploiting vulnerabilities · Read the full page →

AI systems intended to interact directly with people must be designed so that those people are informed they are interacting with an AI system, unless that is obvious to a reasonably well-informed observer

Article 50(1) — Informing natural persons that they are interacting with an AI system · Read the full page →

Providers of AI systems that generate synthetic audio, image, video or text must mark the outputs in a machine-readable format so they are detectable as artificially generated or manipulated

Article 50(2) — Marking AI-generated or manipulated content in a machine-readable format · Read the full page →

Deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them of the system's operation, and must process the personal data in accordance with EU data-protection law

Article 50(3) — Deployer duty to inform persons exposed to emotion recognition or biometric categorisation · Read the full page →

Deployers publishing AI-generated or AI-manipulated text to inform the public on matters of public interest must disclose that it is artificially generated, unless it has undergone human review or editorial control with a named person holding editorial responsibility

Article 50(4), second subparagraph — Deployer duty to disclose AI-generated text published to inform the public · Read the full page →

Deployers of AI that generates or manipulates image, audio or video constituting a deep fake must disclose that the content is artificially generated or manipulated, with a lighter form of disclosure for evidently artistic or satirical works

Article 50(4), first subparagraph — Deployer duty to disclose deep fakes · Read the full page →

Assess GPAI high-impact capabilities and Commission designation, including the greater-than-10^25 FLOP presumption and Article 52 notification procedure

Articles 51 and 52 - GPAI systemic-risk classification and notification · Read the full page →

Maintain the Article 53(1)(c) copyright policy and publish the separate Article 53(1)(d) training-content summary; open-source status does not exempt either duty

Article 53(1)(c)(d) - Obligations for providers of general-purpose AI models: copyright policy and training data summary · Read the full page →

Maintain Annex XI model documentation and Annex XII downstream integration information, subject to the limited Article 53(2) open-source exception

Article 53(1)(a)(b) - Obligations for providers of general-purpose AI models: technical documentation and transparency · Read the full page →

Appoint and enable a Union-established authorised representative for an in-scope third-country GPAI model provider

Article 54 · Read the full page →

Document the selected route for demonstrating GPAI compliance; code adherence is optional and alternative adequate means require Commission assessment

Articles 53(4), 55(2) and 56 - GPAI means of demonstrating compliance · Read the full page →

Systemic risk GPAI providers must conduct adversarial testing (red-teaming) using state-of-the-art protocols and document the results, with a view to identifying and mitigating systemic risks

Article 55(1)(a) - Obligations for providers of general-purpose AI models with systemic risk: model evaluation and adversarial testing · Read the full page →

Track, document and report serious incidents and possible corrective measures without undue delay under Article 55(1)(c)

Article 55(1)(c) - Serious-incident tracking, documentation and reporting for systemic-risk GPAI · Read the full page →

Assess and mitigate possible Union-level systemic risks and their sources throughout the GPAI model lifecycle

Article 55(1)(b) · Read the full page →

Systemic risk GPAI providers must implement adequate cybersecurity measures protecting both the model itself and the physical infrastructure on which it runs

Article 55(1)(d) - Cybersecurity of systemic-risk GPAI models and their physical infrastructure · Read the full page →

Keep the additional Annex XI Section 2 documentation current for systemic-risk GPAI models

Article 53(1)(a) and Annex XI Section 2 - Additional documentation for systemic-risk GPAI · Read the full page →

Every AI system must be classified against Article 6(2) and Annex III; a system in an Annex III area is high-risk unless a documented Article 6(3) derogation applies, and profiling of natural persons always makes it high-risk

Article 6(2)-(4) + Annex III — Classification of AI systems as high-risk · Read the full page →

A person subject to a decision taken on the basis of an Annex III high-risk AI system's output with legal or similarly significant adverse effect has the right to obtain clear and meaningful explanations of the system's role and the main elements of the decision

Article 86 — Right to explanation of individual decision-making · Read the full page →

High-risk AI systems require a continuous, documented risk management system covering the entire lifecycle — from design through post-market monitoring

Article 9 — Risk management system · Read the full page →