EU AI Act I: scope, roles and risk tiers
The EU AI Act (Regulation (EU) 2024/1689) is a risk-based, product-safety-style law. It is the most heavily tested law on the exam.
Scope
It applies to providers placing AI systems or general-purpose AI models on the EU market, wherever they are established; to deployers in the EU; and to providers and deployers outside the EU where the system's output is used in the EU. Exclusions include military and national-security uses, and pure scientific research and development.
Roles
| Role | Who |
|---|---|
| Provider | Develops an AI system or GPAI model (or has it developed) and places it on the market or into service under its own name |
| Deployer | Uses an AI system under its authority (not purely personal use) |
| Importer | EU entity placing a non-EU provider's system on the market |
| Distributor | Makes a system available in the supply chain |
| Authorized representative | EU-based agent of a non-EU provider |
Becoming a provider: a deployer, distributor or importer takes on provider obligations if it puts its name or trademark on a high-risk system, makes a substantial modification, or changes the intended purpose so that the system becomes high risk.
The four risk tiers
1. Unacceptable risk: prohibited (Art. 5)
- Subliminal, manipulative or deceptive techniques causing significant harm
- Exploiting vulnerabilities due to age, disability or social or economic situation
- Social scoring leading to detrimental treatment
- Predicting criminal offences based solely on profiling or personality traits
- Untargeted scraping of facial images to build facial recognition databases
- Emotion recognition in workplaces and education (except medical or safety reasons)
- Biometric categorization to infer race, political opinions, union membership, religion, sex life or sexual orientation
- Real-time remote biometric identification in public spaces for law enforcement, except narrow cases (searching for victims, preventing imminent threats, locating suspects of serious crimes)
- Added by the 2026 AI Omnibus, from 2 December 2026: AI that generates non-consensual intimate imagery or child sexual abuse material
2. High risk
- Annex I: AI that is a safety component of, or itself is, a product under EU harmonization law needing third-party conformity assessment (medical devices, machinery, toys, vehicles, lifts).
- Annex III areas: biometrics; critical infrastructure; education and vocational training; employment and worker management; access to essential private and public services (credit scoring, life and health insurance pricing, public benefits, emergency dispatch); law enforcement; migration, asylum and border control; administration of justice and democratic processes.
- An Annex III system is not high risk if it poses no significant risk, for example it performs a narrow procedural task, but systems that profile individuals are always high risk.
3. Limited risk: transparency (Art. 50)
People must be told they are interacting with AI (chatbots); synthetic audio, image, video and text must be machine-readably marked; deepfakes must be disclosed; people exposed to emotion recognition or biometric categorization must be informed.
4. Minimal risk
Everything else (spam filters, AI in games). No obligations; voluntary codes encouraged.
Check your understanding
Which of these is a high-risk use under Annex III?
A school uses AI to detect students' emotions during class. Under the EU AI Act this is: