EU AI Act — one-page summary

Structure

• Chapters I–III — general provisions, prohibited AI practices, high-risk systems.
• Chapter IV — transparency obligations for providers and deployers of certain AI systems (Article 50).
• Chapters V–VII — governance, conformity assessment, post-market monitoring.
• Annexes I–IV — technical documentation, conformity assessment procedures, high-risk use cases, internal-control thresholds.

Risk classes

1. Unacceptable risk — prohibited (Article 5). E.g. social scoring, real-time biometric ID in public spaces (limited exceptions).
2. High risk — Annex III systems, and certain product-safety systems. Strict requirements on data, documentation, transparency, human oversight, accuracy, robustness, cybersecurity.
3. Limited risk — transparency obligations (Article 50): chatbot disclosure, deepfake marking, synthetic content marking, biometric categorisation, emotion recognition.
4. Minimal risk — no specific obligations; voluntary codes of conduct.

Consequences for non-compliance

• Prohibited use (Article 5): up to €35M or 7% of global annual turnover.
• Other breaches: up to €15M or 3%.
• Misleading information: up to €7.5M or 1%.

Dates

• Entered force: 1 August 2024.
• Prohibited practices (Article 5): 2 February 2025.
• General-purpose AI obligations: 2 August 2025.
• Most obligations (including high-risk): 2 August 2026.
• Embedded high-risk systems in regulated products: 2 August 2027.

What CSOAI measures

See EU AI Act hub for the harness list. See also ProvBench for the measured reality: embedded Article 50 markings do not survive the real world.