16 things worth knowing before you build
Ordered by how often they change a decision, not by article number. Each carries its
article, its sources, and whether the point is settled in the text or still open.
| Term | Means |
|---|
| provider | whoever develops an AI system, or has it developed, and puts it on the market or into service under their own name — paid or free (Art. 3(3)). |
| deployer | whoever uses an AI system under their own authority, other than for personal non-professional activity (Art. 3(4)). |
| Annex I route | high risk because the AI is a safety component of a product already covered by EU product law — medical devices, machinery, and so on — and that law requires third-party assessment (Art. 6(1)). |
| Annex III route | high risk because the intended use is on a list of eight areas — biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice (Art. 6(2)). |
| notified body | an independent organisation designated by a Member State to assess conformity before certain products may carry the CE mark. |
| GPAI model | a general-purpose AI model — the large language model itself, as distinct from a system built on top of it (Art. 3(63)). |
| SME / SMC | small and medium-sized enterprise, and — a category the amendment added — small mid-cap company. The Regulation borrows the EU's standard size definitions. |
Offering it free does not put you outside the Regulation
"Making available on the market" is defined as supply for distribution or use in the course of a commercial activity, "whether in return for payment or free of charge". A free academic service can still be a market act. What the definition turns on is the commercial-activity limb, not the price.
“the supply of an AI system or a general-purpose AI model for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge”
Being outside the EU does not put you outside it either
The Regulation reaches providers and deployers established in a third country where the output produced by the AI system is used in the Union. For a Swiss, UK or US group with EU users, this is the hook that applies. Note a divergence nobody has resolved: the article says the output "is used" in the Union, while Recital 22 speaks of output "intended to be used" there. The binding text is the article.
“providers and deployers of AI systems that have their place of establishment or who are located in a third country, where the output produced by the AI system is used in the Union”
Calling someone else's model through an API does not make you a model provider
If you build a service on top of a third-party large language model, you are a provider of an AI system, not a provider of a general-purpose AI model. The model-provider obligations (Art. 53-55: technical documentation, training-data summary, copyright policy) do not attach to you. The Commission's guidelines say the downstream actor integrating the model into a system and placing that system on the Union market may be the provider of the system, and must comply with the requirements for AI systems.
“the downstream actor integrating the model into an AI system and placing the system on the Union market ... may be the provider of the system”
Fine-tuning can make you one, though
Retrain the model heavily enough and you become the provider of a new model. The same guidelines propose the line: a downstream actor becomes a model provider when the compute used to modify the model exceeds roughly one third of the compute used to train the original. They also flag a less obvious trap: using an upstream model whose licence terms exclude EU-market use can shift model-provider status downstream. Prompting, retrieval augmentation and system prompts are not addressed in the text; treating them as safe is an inference, not a statement of the guidelines.
Open-sourcing your system does not exempt you from the transparency rules
The free and open-source exemption is real but narrow: it stops at high-risk systems, at Article 5, and at Article 50. Since Article 50 is the obligation most small AI services actually land on, publishing under a permissive licence buys nothing there. It buys something else worth having — a third party can reproduce your results independently — but not an exemption.
“This Regulation does not apply to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems or as an AI system that falls under Article 5 or 50.”
The scientific research exemption is narrower than it looks
Article 2(6) excludes systems "specifically developed and put into service for the sole purpose of scientific research and development". It says put into service; it does not say placed on the market. Recital 25 narrows it from three directions, and one of them is decisive for anyone running a tool for other researchers: a system merely used in the conduct of research stays inside the Regulation. The Commission's Article 50 guidelines read Article 2(6) only within Article 50: the exclusion covers the outputs of generative systems used in scientific research, but once a system is put into service, or its outputs are used, for anything other than that sole purpose, the Article 50 duties apply (para. 21). An example the guidelines give right after that paragraph has researchers who "develop and place on the market or put into service" an interactive system for a study and still need not meet the Article 50(1) and (2) duties, which reads more generously than the article's own wording. Neither those guidelines nor any court addresses whether the exclusion covers a tool offered as a service to other researchers.
“any other AI system that may be used for the conduct of any research and development activity should remain subject to the provisions of this Regulation”
Statistics, visualisation and hypothesis testing are not AI systems at all
The Commission's guidelines on the definition of an AI system place several things researchers use daily outside the definition: statistical analysis, data visualisation, hypothesis testing, machine-learning acceleration of physics simulations, and approximations of established optimisation methods such as linear and logistic regression. The question prior to risk tier is whether the definition is met at all. In our own case, one service split this way — its language-model stage inside the definition, its rule-based code scan outside it.
The high-risk deadlines moved; older commentary gives the wrong date
The amendment moved the Annex III route to 2027-12-02 and the Annex I route to 2028-08-02, as fixed calendar dates. The Commission's earlier proposal to tie the start to standards being ready did not survive. Anything written before 2026-07 gives 2026-08-02 for high-risk, and that is now wrong.
Article 50 is in force now, and it applies regardless of risk tier
Transparency duties sit in their own chapter and do not depend on being high-risk. Two bind providers: telling people they are interacting with an AI system, and marking synthetic content in a machine-readable form. Two bind deployers: disclosing emotion recognition or biometric categorisation, and disclosing deep fakes and AI-generated text published to inform the public on matters of public interest. The information must be given clearly and at the latest at the time of first interaction or exposure. Text counts as published when it is accessible to an indeterminate, fairly large number of unrelated potential readers; a closed private group, private correspondence and organisation-internal documents are not published (Article 50 guidelines, para. 131).
Two Article 50 carve-outs are worth knowing before you build
The duty to tell a person they are dealing with an AI system does not apply where that is obvious to a reasonably well-informed, observant and circumspect person in the circumstances. The Commission's Article 50 guidelines read this against the EU consumer-law notion of the average consumer, say it is to be interpreted restrictively, and put the burden on the provider to assess and demonstrate it; general awareness that AI systems exist does not make an interaction obvious (paras. 42-45). Their examples include code assistants available only to professional developers and interactive systems used only by properly trained health professionals. The duty to disclose AI-generated text published on matters of public interest does not apply where the text has undergone human review or editorial control and a natural or legal person holds editorial responsibility. The guidelines require review of the substance by people with relevant knowledge, with fact-checking as a minimum; spell-checks, the mere existence of an editorial policy, automated review or cursory approval do not count, and a substantive AI edit after sign-off voids the exception (paras. 133-136). An academic blog under internal peer review, with the research centre holding editorial responsibility, is one of their examples that qualifies (example after para. 138). The guidelines are not binding, and no court has ruled on either carve-out.
“unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use”
Annex III has no category for research tools or laboratory analysis
The eight high-risk areas cover biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and border control, and administration of justice. Scientific research, clinical laboratory analysis and genomics appear nowhere. A research platform reaches high risk only by a different route: by being a medical device or IVD requiring notified-body involvement under the Annex I route, or by a specific function landing in one of the sub-points — biometric categorisation, eligibility assessment for public benefits, life and health insurance pricing, or emergency triage.
Even when high-risk, most Annex III systems are self-assessed
Article 43(2) states in terms that points 2 to 8 of Annex III follow the internal-control procedure of Annex VI, "which does not provide for the involvement of a notified body". Third-party assessment is required for point 1 (biometrics) in defined circumstances. This is the provision that decides whether a certification body is involved at all. The Commission may change it in future.
“internal control as referred to in Annex VI, which does not provide for the involvement of a notified body”
You can become the provider of someone else's system without meaning to
Putting your name or trademark on a high-risk system already on the market, making a substantial modification to it (a change not foreseen by the original provider that affects compliance or intended purpose), or changing the intended purpose of a system so that it becomes high-risk — any of these makes you the provider, carrying the provider's full set of duties: documentation, quality management, registration, conformity assessment. For the name-and-trademark case, a contractual allocation between the parties does not undo it.
The start dates are fixed; what counts as compliance is not
The classification guidelines the Commission was required to publish by 2026-02-02 under Article 6(5) were still in draft on 2026-10-03. Three draft volumes were published on 2026-05-19; the targeted consultation closed on 2026-07-23, and the consultation page says the final guidelines will be adopted by the end of 2026. No harmonised standard from CEN-CENELEC JTC 21 had been cited in the Official Journal by 2026-10-03, checked through the Publications Office database because the EUR-Lex search itself refuses automated clients. CEN-CENELEC has announced EN 18286 (quality management for AI) as published; publication by a standards body is not citation in the Official Journal, and only citation gives a presumption of conformity. You can know when the obligations begin without yet knowing what satisfying them looks like.
The fines, and the small-company rule that changes them
Prohibited practices: EUR 35 million or 7% of worldwide annual turnover, whichever is higher. Most other operator obligations, including Article 50: EUR 15 million or 3%, whichever is higher. Supplying incorrect or misleading information: EUR 7.5 million or 1%. For small and medium-sized enterprises including start-ups, Article 99(6) inverts this to whichever is lower, across all three tiers. The amendment added Article 99(6a) for small mid-cap companies, which takes the lower figure but only for the second and third tiers — prohibited practices stay on the higher rule. As of 2026-10-03 we found no officially confirmed enforcement decision; figures circulating in commercial blogs are mutually inconsistent and are not repeated here.
The AI Act does not replace data protection law
The two apply in parallel and compliance with one is not compliance with the other; Article 2(7) preserves the GDPR. One AI-Act-specific permission matters for anyone checking models for bias: the new Article 4a allows processing of special categories of personal data for that purpose, under six conditions, and reaches systems that are not high-risk. If you handle genetic or health data, Article 9 GDPR governs it whatever the AI Act says, and Article 9(4) lets Member States add further conditions on genetic data, so national law varies.