{"article": "Article 50", "ref": "Art. 50(1)", "role": "provider", "trigger": "AI system intended to interact directly with natural persons (chatbots, assistants, voice agents)", "rule": "Inform the persons concerned that they are interacting with an AI system", "exception": "Unless obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and context of use", "timing": "At the latest at the time of the first interaction or exposure (Art. 50(5))", "law_enforcement_carveout": "Does not apply to AI systems authorised by law to detect, prevent, investigate or prosecute criminal offences (with safeguards), unless those systems are available for the public to report a criminal offence.", "notes_for_vendors": "", "applies_from": "2026-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 50", "ref": "Art. 50(2)", "role": "provider", "trigger": "AI systems generating synthetic audio, image, video or text content", "rule": "Mark outputs in a machine-readable format, detectable as artificially generated or manipulated", "exception": "Does not apply to the extent the AI system performs an assistive function for standard editing or does not substantially alter the input data provided by the deployer or the semantics thereof", "timing": "", "law_enforcement_carveout": "Marking duty does not apply where authorised by law to detect, prevent, investigate or prosecute criminal offences.", "notes_for_vendors": "", "applies_from": "2026-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 50", "ref": "Art. 50(3)", "role": "deployer", "trigger": "Emotion recognition system or biometric categorisation system", "rule": "Inform the natural persons exposed to the operation of the system", "exception": "", "timing": "", "law_enforcement_carveout": "Does not apply to biometric categorisation and emotion recognition permitted by law to detect, prevent or investigate criminal offences (with safeguards, in accordance with Union law).", "notes_for_vendors": "Inferring emotions of natural persons in workplace and education settings is prohibited outright (Art. 5(1)(f), applicable since 2025-02-02), save for medical or safety reasons — disclosure cannot cure a prohibited use", "applies_from": "2026-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 50", "ref": "Art. 50(4)", "role": "deployer", "trigger": "Deepfakes (image, audio or video content that is artificially generated or manipulated); AI-generated or manipulated text published with the purpose of informing the public on matters of public interest", "rule": "Disclose that the content has been artificially generated or manipulated", "exception": "", "timing": "", "law_enforcement_carveout": "Does not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences.", "notes_for_vendors": "", "applies_from": "2026-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 50", "ref": "Art. 50(5)", "role": "both", "trigger": "", "rule": "Information must be provided in a clear and distinguishable manner at the latest at the time of the first interaction or exposure, conforming to accessibility requirements", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "", "applies_from": "2026-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(1)(a)", "role": "", "trigger": "", "rule": "Applies to providers placing AI systems or general-purpose AI models on the market, or putting AI systems into service, in the Union — irrespective of whether the provider is established or located within the Union or in a third country.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Extraterritorial trigger 1: a US or other non-EU vendor selling into the EU is in scope simply by placing the system on the EU market. Establishment location is irrelevant.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(1)(b)", "role": "", "trigger": "", "rule": "Applies to deployers of AI systems that have their place of establishment or are located within the Union.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Your EU customers are in scope as deployers regardless of where you (the vendor) sit — expect them to push compliance requirements upstream via procurement questionnaires and contract clauses.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(1)(c)", "role": "", "trigger": "", "rule": "Applies to providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Extraterritorial trigger 2 (the broadest): even without selling in the EU, if your system's output is used in the Union, you can be in scope. Relevant for API-delivered and SaaS products.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(1)(d)", "role": "", "trigger": "", "rule": "Applies to importers and distributors of AI systems.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "EU resellers and channel partners carry their own obligations; distribution agreements should allocate them.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(1)(e)", "role": "", "trigger": "", "rule": "Applies to product manufacturers placing on the market or putting into service an AI system together with their product and under their own name or trademark.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "White-labelling matters: a manufacturer shipping your AI under its own brand takes on obligations for the combined product.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(1)(f)", "role": "", "trigger": "", "rule": "Applies to authorised representatives of providers which are not established in the Union.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Non-EU providers of high-risk systems need an EU authorised representative; that representative is itself within scope.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(1)(g)", "role": "", "trigger": "", "rule": "Applies to affected persons that are located in the Union.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "End users and other persons in the EU affected by the system are covered by the Act's protections.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(2)", "role": "", "trigger": "", "rule": "For high-risk AI systems related to products covered by the Union harmonisation legislation listed in Annex I, Section B, only a limited set of provisions applies (Art. 6(1), Articles 102 to 109 and Article 112). Article 57 (regulatory sandboxes) applies only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "AI embedded in already-regulated products (e.g. aviation, automotive) follows a narrower, sector-integrated track.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(3)", "role": "", "trigger": "", "rule": "The Regulation does not apply to AI systems used exclusively for military, defence or national security purposes, regardless of the type of entity carrying out those activities and regardless of whether the systems are placed on the market in the Union.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "The exclusion turns on exclusive military/defence/national-security purpose. Dual-use products sold commercially do NOT benefit from it.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(4)", "role": "", "trigger": "", "rule": "Does not apply to public authorities in a third country or international organisations using AI systems in the framework of international cooperation or agreements for law enforcement and judicial cooperation, provided adequate safeguards are offered with respect to the protection of fundamental rights and freedoms.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Narrow carve-out for international law-enforcement cooperation; not available to commercial vendors.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(5)", "role": "", "trigger": "", "rule": "Does not affect the application of the provisions on the liability of providers of intermediary services in Chapter II of Regulation (EU) 2022/2065 (Digital Services Act).", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "DSA intermediary-liability rules run in parallel; AI Act compliance does not displace them.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(6)", "role": "", "trigger": "", "rule": "Does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "'Sole purpose' is the operative limit — a research model later commercialised loses this exclusion at commercialisation.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(7)", "role": "", "trigger": "", "rule": "Union law on the protection of personal data, privacy and the confidentiality of communications applies to personal data processed in connection with this Regulation; the Regulation does not affect the GDPR (Regulation (EU) 2016/679), Regulation (EU) 2018/1725, the ePrivacy Directive or the Law Enforcement Directive.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "GDPR compliance is cumulative with the AI Act, not alternative to it.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(8)", "role": "", "trigger": "", "rule": "Does not apply to any research, testing or development activity regarding AI systems or AI models prior to their being placed on the market or put into service; however, testing in real-world conditions is not covered by this exclusion.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Internal pre-market R&D and testing is out of scope — but pilots with real users in real-world conditions are not shielded by this paragraph.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(9)", "role": "", "trigger": "", "rule": "The Regulation is without prejudice to the rules laid down by other Union legal acts related to consumer protection and product safety.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Consumer-protection and product-safety law continues to apply on top of the AI Act.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(10)", "role": "", "trigger": "", "rule": "Does not apply to obligations of deployers who are natural persons using AI systems in the course of a purely personal non-professional activity.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Your individual consumer users are outside deployer obligations; your business customers are not.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(11)", "role": "", "trigger": "", "rule": "Does not preclude the Union or Member States from maintaining or introducing laws, regulations or administrative provisions more favourable to workers in terms of protecting their rights in respect of the use of AI systems by employers, or from encouraging or allowing the application of collective agreements which are more favourable to workers.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Expect stricter national rules for workplace AI in some Member States — the AI Act is a floor, not a ceiling, for worker protection.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 2", "ref": "Art. 2(12)", "role": "", "trigger": "", "rule": "Does not apply to AI systems released under free and open-source licences, UNLESS they are placed on the market or put into service as high-risk AI systems or fall under Article 5 (prohibited practices) or Article 50 (transparency obligations).", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "The open-source exclusion is PARTIAL: an open-source chatbot or generative system still carries Article 50 transparency duties, and open-source status never excuses high-risk or prohibited uses. Do not rely on an OSS licence as a compliance strategy for interactive or generative products.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 25", "ref": "Art. 25(1)(a)", "role": "", "trigger": "", "rule": "Any distributor, importer, deployer or other third party shall be considered a provider of a high-risk AI system and assumes the provider obligations if they put their name or trademark on a high-risk AI system already placed on the market or put into service, without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "White-labelling / rebranding a high-risk AI system makes you its provider — full provider duties (risk management, technical documentation, conformity assessment, registration) transfer to you, although the text allows contractual arrangements to allocate the obligations otherwise. Distinct from Article 50: the transparency duties there follow the provider definition of Article 3(3), while this re-labelling rule is high-risk only, but with far heavier obligations.", "applies_from": "2027-12-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 25", "ref": "Art. 25(1)(b)", "role": "", "trigger": "", "rule": "The same applies if they make a substantial modification to a high-risk AI system that has already been placed on the market or put into service, in such a way that it remains a high-risk AI system.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Heavily customising a third-party high-risk system (retraining, changing core behaviour) can shift provider status to you. Configuration within the provider's intended parameters is the safe zone; substantial modification is not.", "applies_from": "2027-12-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 25", "ref": "Art. 25(1)(c)", "role": "", "trigger": "", "rule": "The same applies if they modify the intended purpose of an AI system, including a general-purpose AI system, which has not been classified as high-risk and has already been placed on the market or put into service, in such a way that it becomes a high-risk AI system.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Taking a general-purpose model or a non-high-risk tool and pointing it at an Annex III use (e.g. wiring an LLM into CV screening) makes YOU the provider of a new high-risk system, even though the upstream model provider was never one.", "applies_from": "2027-12-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 25", "ref": "Art. 25(2)", "role": "", "trigger": "", "rule": "Where the circumstances of paragraph 1 occur, the provider that initially placed the system on the market is no longer considered a provider of that specific AI system. That initial provider shall closely cooperate with new providers, make available the necessary information and provide the reasonably expected technical access and other assistance required for compliance. This does not apply where the initial provider has clearly specified that its AI system is not to be changed into a high-risk AI system.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Two-sided: if a customer rebrands or repurposes your system, provider duties move to them, but you owe cooperation and technical access — UNLESS your terms clearly state the system must not be changed into a high-risk system. That contractual clause is the standard shield for upstream vendors.", "applies_from": "2027-12-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 25", "ref": "Art. 25(3)", "role": "", "trigger": "", "rule": "For high-risk AI systems that are safety components of products covered by the Union harmonisation legislation listed in Section A of Annex I, the product manufacturer is considered the provider where the system is placed on the market together with the product under the manufacturer's name or trademark, or put into service under the manufacturer's name or trademark after the product has been placed on the market.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "If your AI is embedded as a safety component in a regulated product sold under the manufacturer's brand, the product manufacturer carries provider status, not the component developer.", "applies_from": "2027-12-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 25", "ref": "Art. 25(4)", "role": "", "trigger": "", "rule": "The provider of a high-risk AI system and third parties supplying AI systems, tools, services, components or processes used or integrated in it shall specify, by written agreement, the necessary information, capabilities, technical access and other assistance to enable the provider to comply. This paragraph shall not apply to third parties making accessible to the public tools, services, processes, or components, other than general-purpose AI models, under a free and open-source licence. The AI Office may develop and recommend voluntary model contractual terms.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Expect high-risk customers to demand a written compliance-assistance agreement from you as a component/tool supplier. The open-source exemption covers FOSS tools and components but explicitly does NOT cover general-purpose AI models.", "applies_from": "2027-12-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 25", "ref": "Art. 25(5)", "role": "", "trigger": "", "rule": "Paragraphs 2 and 3 are without prejudice to the need to observe and protect intellectual property rights, confidential business information and trade secrets in accordance with Union and national law.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "The cooperation and information duties do not force you to surrender IP or trade secrets; assistance can be structured to protect them.", "applies_from": "2027-12-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 3", "ref": "Art. 3(1)", "role": "", "trigger": "", "rule": "'AI system' means a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "The gatekeeper definition: the key element is inference from input to output with some autonomy. Most ML-based SaaS features qualify; purely deterministic rule engines are the main arguable exclusion.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 3", "ref": "Art. 3(3)", "role": "", "trigger": "", "rule": "'Provider' means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "'Under its own name or trademark' is the trap: integrating a third-party foundation model into a product sold under your brand makes YOU the provider of the resulting AI system. Free products count — 'whether for payment or free of charge'.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 3", "ref": "Art. 3(4)", "role": "", "trigger": "", "rule": "'Deployer' means a natural or legal person, public authority, agency or other body using an AI system under its authority, except where the AI system is used in the course of a personal non-professional activity.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Your business customers are deployers. Deployers carry their own duties (e.g. Art. 50(3)-(4) disclosures), which they will contractually pass through to vendors where they can.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 3", "ref": "Art. 3(9)", "role": "", "trigger": "", "rule": "'Placing on the market' means the first making available of an AI system or a general-purpose AI model on the Union market. Under Art. 3(10), 'making available on the market' means supplying it for distribution or use on the Union market in the course of a commercial activity, whether for payment or free of charge.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "'First making available' — one EU customer, one free EU pilot in the course of commercial activity, is enough. This is the trigger event for provider obligations and for the extraterritorial hook in Art. 2(1)(a).", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 3", "ref": "Art. 3(11)", "role": "", "trigger": "", "rule": "'Putting into service' means the supply of an AI system for first use directly to the deployer, or for own use, in the Union for its intended purpose.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Catches what 'placing on the market' misses: deploying a system for your own internal use in the EU, or supplying it directly to a single deployer, also triggers obligations.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 3", "ref": "Art. 3(63)", "role": "", "trigger": "", "rule": "'General-purpose AI model' means an AI model, including where trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market, and that can be integrated into a variety of downstream systems or applications — except AI models used for research, development or prototyping activities before they are placed on the market.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Wrapping a GPAI model in your product does not make you a GPAI model provider — but check Art. 3(3): under your own brand you become provider of the resulting AI SYSTEM. GPAI-model obligations (Art. 53 et seq.) apply from 2025-08-02.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 3", "ref": "Art. 3(65)", "role": "", "trigger": "", "rule": "'Systemic risk' means a risk that is specific to the high-impact capabilities of general-purpose AI models, having a significant impact on the Union market due to their reach, or due to actual or reasonably foreseeable negative effects on public health, safety, public security, fundamental rights, or society as a whole, that can be propagated at scale across the value chain.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Relevant when choosing an upstream model: GPAI models classified with systemic risk carry heavier provider obligations, which can surface in your supply-chain due diligence and customer questionnaires.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 4", "ref": "Art. 4", "role": "", "trigger": "", "rule": "Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "This duty binds both providers and deployers, and it is not limited to high-risk systems — it applies to any AI system in scope of the Regulation. It is a best-effort obligation ('to their best extent'), calibrated to staff background and context of use. Enterprise buyers increasingly ask vendors to evidence AI-literacy measures (training records, role-specific guidance, documentation for operators) in procurement questionnaires. It has applied since 2025-02-02, well before the Article 50 transparency duties (2026-08-02).", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 5", "ref": "Art. 5(1)(a)", "role": "", "trigger": "", "rule": "Prohibits placing on the market, putting into service or using an AI system that deploys subliminal techniques beyond a person's consciousness or purposefully manipulative or deceptive techniques, with the objective or effect of materially distorting the behaviour of a person or group by appreciably impairing their ability to make an informed decision, causing them to take a decision they would not otherwise have taken, in a manner that causes or is reasonably likely to cause that person, another person or a group of persons significant harm.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Covers dark-pattern-style AI persuasion and deceptive interfaces where material behavioural distortion plus (likely) significant harm are present.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 5", "ref": "Art. 5(1)(b)", "role": "", "trigger": "", "rule": "Prohibits AI systems that exploit vulnerabilities of a natural person or specific group due to their age, disability or a specific social or economic situation, with the objective or effect of materially distorting the behaviour of that person or a person belonging to that group in a manner that causes or is reasonably likely to cause that person or another person significant harm.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Relevant to products targeting minors, elderly users, or financially vulnerable segments.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 5", "ref": "Art. 5(1)(c)", "role": "", "trigger": "", "rule": "Prohibits AI systems for the evaluation or classification of natural persons or groups over a period of time based on their social behaviour or known, inferred or predicted personal or personality characteristics (social scoring), where the social score leads to either or both of the following: (i) detrimental or unfavourable treatment in social contexts unrelated to the contexts in which the data was originally generated or collected; (ii) detrimental or unfavourable treatment that is unjustified or disproportionate to the social behaviour or its gravity.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Scoring products that repurpose behavioural data across unrelated contexts, or produce disproportionate detrimental treatment, are exposed.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 5", "ref": "Art. 5(1)(d)", "role": "", "trigger": "", "rule": "Prohibits AI systems for making risk assessments of natural persons in order to assess or predict the risk of committing a criminal offence, based solely on profiling or on assessing personality traits and characteristics. The prohibition does not apply to AI systems used to support the human assessment of a person's involvement in criminal activity that is already based on objective and verifiable facts directly linked to a criminal activity.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Predictive-policing-style products are prohibited when based solely on profiling/personality; supporting fact-based human assessments is the carve-out.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 5", "ref": "Art. 5(1)(e)", "role": "", "trigger": "", "rule": "Prohibits AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Applies to the database-building practice itself, regardless of the downstream use.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 5", "ref": "Art. 5(1)(f)", "role": "", "trigger": "", "rule": "Prohibits the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "High-exposure area for HR tech, workforce analytics, proctoring and ed-tech: sentiment/engagement/attention scoring of employees or students is emotion inference. Selling such a feature 'for this specific purpose' into workplace or education contexts implicates the vendor directly, not only the customer deploying it. The medical-or-safety exception is narrow; productivity, hiring, evaluation or engagement purposes do not qualify.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 5", "ref": "Art. 5(1)(g)", "role": "", "trigger": "", "rule": "Prohibits biometric categorisation systems that categorise individually natural persons based on their biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. Does not cover labelling or filtering of lawfully acquired biometric datasets, or categorising of biometric data, in the area of law enforcement.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Inferring the listed sensitive attributes from biometric data (face, voice, gait) is prohibited for commercial products; the carve-out is confined to law enforcement dataset labelling/filtering.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 5", "ref": "Art. 5(1)(h)", "role": "", "trigger": "", "rule": "Prohibits the use of 'real-time' remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement, unless and in so far as strictly necessary for: (i) the targeted search for specific victims of abduction, trafficking or sexual exploitation, or the search for missing persons; (ii) the prevention of a specific, substantial and imminent threat to life or physical safety, or a genuine and present or genuine and foreseeable threat of a terrorist attack; (iii) the localisation or identification of a person suspected of a criminal offence referred to in Annex II punishable by a custodial sentence or detention order of a maximum period of at least four years, for the purpose of a criminal investigation, prosecution or executing a criminal penalty.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "A law-enforcement-use prohibition with narrowly enumerated exceptions; the exception regime is conditioned by Art. 5(2)-(8).", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 5", "ref": "Art. 5(2)-(8)", "role": "", "trigger": "", "rule": "Condition the Art. 5(1)(h) exceptions: use only to confirm the identity of the specifically targeted individual, taking into account the seriousness, probability and scale of harm and the consequences for rights and freedoms, plus judicial or independent administrative authorisation, notifications, Member State implementing rules and reporting procedures.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Not directly applicable to commercial vendors' products; included for completeness of the article's structure.", "applies_from": "2025-02-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 53", "ref": "Art. 53(1)(a)", "role": "", "trigger": "", "rule": "Draw up and keep up-to-date technical documentation of the model, including its training and testing process and the results of its evaluation, containing at minimum the information set out in Annex XI, for provision to the AI Office and national competent authorities upon request.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "If you train or substantially fine-tune a GPAI model, expect authorities to be able to request this documentation. If you only integrate a third-party GPAI model via API, this duty sits with the upstream model provider, not with you.", "applies_from": "2025-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 53", "ref": "Art. 53(1)(b)", "role": "", "trigger": "", "rule": "Draw up, keep up-to-date and make available information and documentation to providers of AI systems who intend to integrate the GPAI model into their AI systems, enabling them to understand the model's capabilities and limitations and to comply with the Regulation, containing at minimum the elements set out in Annex XII — without prejudice to the need to observe and protect intellectual property rights and confidential business information or trade secrets in accordance with Union and national law.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "As a downstream integrator you are entitled to this documentation from your model supplier — ask for the Annex XII package; buyers' questionnaires increasingly expect you to have it on file.", "applies_from": "2025-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 53", "ref": "Art. 53(1)(c)", "role": "", "trigger": "", "rule": "Put in place a policy to comply with Union law on copyright and related rights, in particular to identify and comply with reservations of rights expressed pursuant to Directive (EU) 2019/790.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "The open-source exemption of Art. 53(2) does NOT cover this point — a copyright policy is required even for open-source GPAI models.", "applies_from": "2025-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 53", "ref": "Art. 53(1)(d)", "role": "", "trigger": "", "rule": "Draw up and make publicly available a sufficiently detailed summary about the content used for training of the GPAI model, according to a template provided by the AI Office.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "The open-source exemption of Art. 53(2) does NOT cover this point either — the public training-content summary is required for all GPAI providers.", "applies_from": "2025-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 53", "ref": "Art. 53(2)", "role": "", "trigger": "", "rule": "The obligations set out in paragraph 1, points (a) and (b), do not apply to providers of AI models released under a free and open-source licence with parameters made publicly available. This exemption does not apply to general-purpose AI models with systemic risk.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "The exemption is narrow: it only lifts 53(1)(a)-(b) (documentation duties), never 53(1)(c) copyright policy or 53(1)(d) training summary, and it falls away entirely if the model is classified as having systemic risk.", "applies_from": "2025-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 53", "ref": "Art. 53(3)", "role": "", "trigger": "", "rule": "Providers of GPAI models shall cooperate as necessary with the Commission and the national competent authorities.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Cooperation with authorities is a standing obligation regardless of the open-source exemption.", "applies_from": "2025-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 53", "ref": "Art. 53(4)", "role": "", "trigger": "", "rule": "Providers may rely on codes of practice to demonstrate compliance with the obligations of this Article until a harmonised standard is published.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Adhering to the GPAI Code of Practice is the practical route to demonstrating compliance while harmonised standards are pending.", "applies_from": "2025-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 6", "ref": "Art. 6(1)", "role": "", "trigger": "", "rule": "An AI system is high-risk when both conditions are met: (a) it is intended to be used as a safety component of a product, or is itself a product, covered by the Union harmonisation legislation listed in Annex I; and (b) that product, or the AI system itself as a product, is required to undergo a third-party conformity assessment.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "This route is independent of Annex III. If your AI ships inside a regulated product (e.g. machinery, medical devices, toys, vehicles listed in Annex I) that needs third-party conformity assessment, it is high-risk regardless of use case. This route applies from 2028-08-02.", "applies_from": "2027-12-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 6", "ref": "Art. 6(2)", "role": "", "trigger": "", "rule": "In addition to the systems under paragraph 1, AI systems referred to in Annex III shall be considered to be high-risk.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Check the eight Annex III areas (see annex_iii_areas_summary). Most SaaS vendors hit this route via employment (HR/recruiting tools), essential services (credit, insurance) or education. Applies from 2027-12-02 post-Omnibus.", "applies_from": "2027-12-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 6", "ref": "Art. 6(3)", "role": "", "trigger": "", "rule": "By way of derogation from paragraph 2, an Annex III system is NOT high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision making, where any of these conditions is met: (a) the AI system is intended to perform a narrow procedural task; (b) it is intended to improve the result of a previously completed human activity; (c) it is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment without proper human review; or (d) it is intended to perform a preparatory task to an assessment relevant for the purposes listed in Annex III. Exception: an AI system referred to in Annex III that performs profiling of natural persons is always considered high-risk.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "This is the main escape hatch for vendors in Annex III areas whose tool only does procedural or preparatory work (e.g. formatting applications, deduplicating records, drafting material a human then assesses). It never applies if the system profiles natural persons.", "applies_from": "2027-12-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 6", "ref": "Art. 6(4)", "role": "", "trigger": "", "rule": "A provider that considers its Annex III system not to be high-risk under paragraph 3 must document its assessment before that system is placed on the market or put into service, is subject to the registration obligation set out in Article 49(2), and must provide that documentation to national competent authorities upon request.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "The carve-out is self-assessed but not free-form: write the assessment down BEFORE launch, register the system in the EU database under Article 49(2), and keep the assessment ready for regulators. Vendors invoking Art. 6(3) in security questionnaires should be able to produce this document.", "applies_from": "2027-12-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 6", "ref": "Art. 6(5)-(8)", "role": "", "trigger": "", "rule": "The Commission shall provide guidelines specifying the practical implementation of this Article, including a comprehensive list of practical examples of high-risk and non-high-risk use cases (due by 2 February 2026), and may adopt delegated acts adding, modifying or deleting the conditions in paragraph 3, provided the level of protection is maintained.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "The Art. 6(3) conditions are not frozen: Commission delegated acts can amend them. Re-check the carve-out conditions and the Commission guidelines when relying on a non-high-risk classification.", "applies_from": "2027-12-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 99", "ref": "Art. 99(1)", "role": "", "trigger": "", "rule": "Member States shall lay down rules on penalties that are effective, proportionate and dissuasive, taking into account the interests of SMEs, including start-ups, and their economic viability.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Actual enforcement is national: the fine ceilings below are EU-wide maxima, but the enforcing authority and procedure depend on the Member State.", "applies_from": "2025-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 99", "ref": "Art. 99(3)", "role": "", "trigger": "", "rule": "Non-compliance with the prohibition of the AI practices referred to in Article 5: administrative fines of up to EUR 35 000 000 or, if the offender is an undertaking, up to 7% of its total worldwide annual turnover for the preceding financial year, whichever is higher.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Top tier. Prohibited practices (Art. 5) have applied since 2025-02-02 — e.g. emotion inference in workplace or education settings cannot be cured by disclosure.", "applies_from": "2025-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 99", "ref": "Art. 99(4)", "role": "", "trigger": "", "rule": "Non-compliance with any of the following: (a) obligations of providers pursuant to Article 16; (b) obligations of authorised representatives pursuant to Article 22; (c) obligations of importers pursuant to Article 23; (d) obligations of distributors pursuant to Article 24; (e) obligations of deployers pursuant to Article 26; (f) requirements and obligations of notified bodies pursuant to Article 31, Article 33(1), (3) and (4) or Article 34; (g) transparency obligations for providers and deployers pursuant to Article 50 — administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "This is the tier that covers Article 50 transparency breaches (point (g)): chatbot disclosure, machine-readable marking of synthetic content, and deepfake disclosure. Article 50 applies from 2026-08-02.", "applies_from": "2025-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 99", "ref": "Art. 99(5)", "role": "", "trigger": "", "rule": "Supply of incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request: administrative fines of up to EUR 7 500 000 or, if the offender is an undertaking, up to 1% of its total worldwide annual turnover for the preceding financial year, whichever is higher.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Answering an authority's request inaccurately is a sanctionable infringement in its own right — keep questionnaire and audit answers verifiable.", "applies_from": "2025-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 99", "ref": "Art. 99(6)", "role": "", "trigger": "", "rule": "In the case of SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "The SME rule inverts the cap: for SMEs and start-ups the maximum is the LOWER of the fixed amount and the turnover percentage, not the higher.", "applies_from": "2025-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}
{"article": "Article 99", "ref": "Art. 99(7)", "role": "", "trigger": "", "rule": "When deciding the amount of the fine, all relevant circumstances shall be taken into account, including the nature, gravity and duration of the infringement, previous fines, the size and market share of the operator, the degree of cooperation with authorities, and the intentional or negligent character of the infringement.", "exception": "", "timing": "", "law_enforcement_carveout": "", "notes_for_vendors": "Documented good-faith compliance efforts and cooperation with authorities are mitigating factors in fine-setting.", "applies_from": "2025-08-02", "source_of_truth": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}