EU AI Act — AI Glossary

Reference details

Related terms

• AI Governance
• Red Teaming

How it works

1. Classification comes first. A system is sorted into prohibited, high-risk, limited-risk or minimal-risk by its intended purpose and deployment context, not by its architecture — the same model is low-risk in a drafting tool and high-risk in a hiring screen.
2. Role determines obligation. The Act distinguishes provider, deployer, importer and distributor, and most duties attach to the provider; fine-tuning and rebranding a model can move a company into the provider role it assumed it was outside.
3. High-risk systems require a conformity assessment before market entry, supported by technical documentation, a risk-management system, data-governance records, logging, and specified human oversight.
4. General-purpose AI models carry their own track: transparency and copyright-policy documentation for all, plus systemic-risk obligations — evaluation, adversarial testing, incident reporting — above a training-compute threshold.
5. Post-market monitoring is continuous. Providers track real-world performance and report serious incidents, so compliance is an operating process rather than a launch gate.
6. Enforcement is national, through market-surveillance authorities, with penalties tiered by the severity of the breach and assessed against global turnover.

Example: Why the same model lands in two different tiers

One general-purpose model is deployed twice. In an internal drafting assistant that suggests wording a human then edits, the use is minimal-risk and the obligations are essentially transparency. In a CV-screening tool that ranks applicants, the use falls in the employment category, which is high-risk: conformity assessment, documented risk management, data governance for the training and evaluation sets, logging sufficient to reconstruct a decision, and human oversight that is real rather than nominal. The model weights are identical; the compliance cost is not. The practical consequence is that risk classification belongs in product design, before the model choice — a team that classifies after building has to retrofit logging and oversight into a system that was never designed to produce an audit trail, which is usually more expensive than the assessment itself.

Commonly confused with

The Act regulates uses and roles, not models, which is the distinction most procurement conversations get wrong. 'Is this model EU AI Act compliant' is close to meaningless: compliance is a property of a deployed system in a context, and the same model is minimal-risk in one product and high-risk in another. The other common error is assuming a vendor's provider-side documentation discharges the deployer's duties. It does not — human oversight, use-context risk assessment and monitoring sit with whoever deploys, and a vendor cannot assess a context it cannot see.

When to use it

Reach for it when:

• Scoping a product that will be offered in the EU, where classification should precede architecture and model selection.
• Deciding whether fine-tuning a third-party model moves your organisation into the provider role.
• Specifying logging and oversight requirements, since high-risk categories require reconstructable decisions rather than aggregate metrics.
• Vendor assessment, to establish which documentation the provider supplies and which obligations remain yours.

Reach for something else when:

• As a technical standard. The Act states obligations, not implementations; harmonised standards and frameworks such as the NIST AI RMF are what you build against.
• As a substitute for sector regulation. Medical, financial and automotive rules apply in addition, not instead.
• To judge a model in isolation. Without a stated use and role, no risk tier can be assigned.
• As legal advice from a summary. Tiering, thresholds and transition dates are specific and phased — this is a point to brief counsel, not to infer from a glossary.

Continue your research

Use these connected ModelRefs sections to compare alternatives, inspect implementation paths, and review the evidence and governance boundaries relevant to EU AI Act — AI Glossary.

• Browse models
• Review providers
• Inspect benchmarks
• Explore workflows
• Learn AI concepts
• Read decision guides
• Review trust and methodology
• Start a decision path