The EU AI Act sorts AI systems by risk and assigns duties by role. Your first two questions are which role you hold, provider or deployer, and which risk tier your system falls in. This glossary explains the main terms in plain words, based on a high level summary of the Act, with dates to verify.
Who has duties?
Provider. A developer that places a high-risk AI system on the EU market or puts it into service, whether established in the EU or in a third country. Third country providers are covered where the system's output is used in the EU.
Deployer. A person, public authority or other body that uses an AI system in a professional capacity. Affected end users are not deployers.
The same company can be both, for example when it builds a tool and uses it internally.
What are the risk tiers?
- Unacceptable risk. Prohibited.
- High risk. Subject to most of the Act's requirements.
- Limited risk. Lighter transparency duties, such as telling people they are talking to an AI (chatbots, deepfakes).
- Minimal risk. Not regulated by the Act.
Prohibited practices (Article 5). These include manipulative or deceptive techniques that cause significant harm, exploiting vulnerabilities linked to age, disability or social circumstances, social scoring that causes unfavorable treatment, building facial recognition databases by untargeted scraping, and inferring emotions in workplaces or schools except for medical or safety reasons. There are narrow exceptions for some law enforcement uses of real time biometric identification.
What makes a system high risk?
Under Article 6 and Annexes I and III, a system is high risk if either it is a safety component of a product covered by listed laws that needs third party conformity assessment, or it fits an Annex III use case, unless a narrow exception applies. Annex III areas include biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and justice. Systems in Annex III that profile individuals are always high risk. A provider that thinks an Annex III system is not high risk must document that assessment before deployment.
Provider duties for high-risk systems include risk management, data governance, technical documentation, logging, instructions for deployers, human oversight, accuracy and cybersecurity, a quality management system, conformity assessment, an EU declaration of conformity, CE marking and registration in an EU database.
What is a GPAI model?
GPAI model (general purpose AI model). One that displays significant generality, can perform a wide range of tasks and can be integrated into many downstream systems. Models used only for research and prototyping before release are excluded.
GPAI system. An AI system built on a GPAI model that can serve varied purposes.
All GPAI model providers must provide technical documentation, give information to downstream providers, follow copyright rules and publish a summary of training content. Free and open source models need only the copyright and training summary duties, unless they carry systemic risk.
Systemic risk. Presumed when cumulative training compute exceeds 10 to the power of 25 floating point operations. Providers must notify the Commission within two weeks. Extra duties include model evaluations with adversarial testing, risk assessment and mitigation, serious incident reporting and cybersecurity protections.
Code of Practice for GPAI. A voluntary tool published on 10 July 2025. Providers that do not adhere must show another way to comply.
AI Office. The body inside the European Commission that oversees GPAI model providers.
When do the rules apply?
Per the summary we read:
- 1 August 2024: the Act entered into force.
- 2 February 2025: most prohibitions apply.
- 2 August 2025: GPAI obligations apply.
- 2 August 2026: AI Office enforcement powers begin, and Article 50 transparency rules apply, with a grace period for existing systems under Article 50(2) until 2 December 2026.
- 2 December 2026: prohibitions on non-consensual intimate imagery and child abuse material take effect.
- 2 December 2027: Annex III high-risk obligations apply.
- 2 August 2028: Annex I high-risk obligations apply.
The summary did not cover penalties, so we do not state them. Dates have been amended before, so confirm them against the current official text and with counsel.
What to do
- List every AI system you build or use, with its purpose.
- Mark your role for each: provider, deployer or both.
- Check each against the Article 5 list and the Annex III areas.
- For systems you build on a GPAI model, collect the documentation your upstream provider must give you.
- Add transparency notices where people interact with an AI.
- Keep a register with owners and review dates.
Where Safeguard fits
Knowing what AI components you use is part of the work. A dependency inventory covers the libraries and packages, and an AI bill of materials practice covers models and data. Safeguard's compliance automation can help organize evidence, but it does not make a system compliant with the Act, and this post is not legal advice.
Quick check
Am I a deployer if I only use a chatbot at work?
Yes, using an AI system in a professional capacity makes you a deployer under the summary's definition. Your duties depend on the tier of the system.
Does open source exempt a model?
Only partly. Free and open source models need just the copyright and training summary duties, unless they carry systemic risk.
Sources
Last reviewed: 18 October 2026.
