Glossary

The EU AI Act, term by term

37 terms, grouped the way the Regulation actually works: first whether it applies to you, then which tier your system falls into, then which role you hold, what that role obliges you to do, and what you have to be able to show for it.

Each entry is a full page — the legal definition, the articles it comes from, a worked example, the misreading that catches people out, and the questions that follow. Start with AI system if you are checking scope, high-risk AI system if you already know you are in scope, or AI literacy if you want the obligation that is already overdue.

Core concepts

Scope questions. These decide whether the Regulation reaches you at all.

AI system

Art. 3(1)

The Article 3(1) definition that decides whether the Act applies to your software at all.

EU AI Act

Reg. (EU) 2024/1689

The EU's risk-tiered AI regulation, phased in from 2025 to 2028.

Extraterritoriality

Art. 2

Why a company with no EU entity can still be fully bound by the Act.

General-purpose AI (GPAI) model

Art. 3(63)

The foundation-model category with its own obligation set under Articles 53 to 55.

Systemic risk (GPAI)

Art. 51, 55

The compute-threshold tier that adds evaluation, incident and security duties to a GPAI model.

Risk tiers

Classification. Which tier a system lands in determines everything that follows.

Annex III

The eight-area list of use cases that makes an AI system high-risk by purpose.

High-risk AI system

Annex III / Art. 6

The tier where the Act's full compliance machinery applies, from Annex III and regulated products.

Limited-risk AI

Art. 50

The transparency-only tier: disclose the AI, label the output, nothing more.

Minimal-risk AI

The unregulated remainder — where most AI systems actually sit.

Prohibited AI practices

Art. 5

The eight Article 5 practices that are illegal in the EU regardless of safeguards.

Operator roles

Who owes what. Roles attach to conduct, and one company usually holds several.

Authorised representative

Art. 22

The mandatory EU contact point a third-country provider must appoint before selling.

Deployer

Art. 3(4)

The role most companies hold: using someone else's AI in your own operations.

Distributor

Art. 3(7)

The reseller role: lighter checks, but a real duty to stop non-conforming systems.

GPAI model provider

Art. 53–55

The model-layer role supervised by the AI Office rather than national authorities.

Importer

Art. 3(6)

The EU-side gatekeeper for AI systems arriving from third-country providers.

Provider

Art. 3(3)

The role that builds and brands the system — and carries the largest obligation set.

Substantial modification

Art. 25

The change threshold that restarts conformity assessment and can move the provider role.

Obligations

The work itself — the requirements a high-risk system and its users have to satisfy.

AI literacy

Art. 4

The cross-cutting training duty that has been live since February 2025.

Data governance

Art. 10

The Article 10 dataset requirements where fairness is engineered rather than promised.

Fundamental Rights Impact Assessment (FRIA)

Art. 27

The deployer-side assessment required before first use of certain high-risk systems.

Human oversight

Art. 14

The Article 14 design requirement that keeps a person genuinely able to intervene.

Post-market monitoring

Art. 72

The documented plan that watches a high-risk system in production and feeds risk management.

Record-keeping (logging)

Art. 12

Automatic event logging built into the system, plus the deployer's duty to retain it.

Risk management system

Art. 9

The lifecycle process at the centre of every high-risk compliance file.

Serious incident reporting

Art. 73

The mandatory notification duty when a high-risk system causes serious harm.

Transparency obligations

Art. 50

The four Article 50 disclosure duties that have applied since August 2026.

Documents & conformity

The evidence trail: what you write, who checks it, and what goes on the market.

CE marking

Art. 48

The visible mark that a high-risk AI system has completed the conformity route.

Conformity assessment

Art. 43

The pre-market check that unlocks the declaration of conformity and the CE marking.

EU database registration

Art. 49

The public register that makes high-risk AI systems visible before they go to market.

EU declaration of conformity

Art. 47

The provider's signed statement of compliance — a legal assumption of responsibility.

Notified body

Annex VII

The independent assessor required where AI Act self-assessment is not available.

Technical documentation (Annex IV)

Art. 11 / Annex IV

The Annex IV file that proves a high-risk system meets the requirements.

Training-data summary

Art. 53(1)(d)

The public summary of what a general-purpose model was trained on.

Governance

Who supervises, where you can test safely, and the two biometric topics with their own rules.

AI regulatory sandbox

Art. 57

The supervised testing environment member states must offer, with SME priority.

Emotion recognition

Art. 5 / Annex III(1)

Inferring emotions from biometric data — banned at work and school, high-risk elsewhere.

European AI Office

The Commission body that supervises GPAI models and shapes the Act's guidance.

Real-time remote biometric identification

Art. 5

Live biometric identification in public — banned for law enforcement bar narrow exceptions.