Art. 3(1)
- AI System
- A machine-based system designed to operate with varying levels of autonomy, that may show adaptiveness after deployment, and that infers from the input it receives how to generate outputs — such as predictions, content, recommendations, or decisions — that can influence physical or virtual environments.
Art. 3(3)
- Provider
- The person or organization that develops an AI system (or has one developed) and places it on the market, or puts it into service, under its own name or trademark. Providers carry the heaviest compliance burden under the Act.
Art. 3(4)
- Deployer
- The person or organization using an AI system under its own authority in a professional context. A company that buys and uses a third-party AI hiring tool is a deployer of that system, not a provider — but still has its own set of obligations.
Annex III
- High-Risk AI System
- An AI system that falls into one of the use-case categories listed in Annex III (e.g., recruitment, credit scoring, law enforcement, access to essential services) or acts as a safety component of a product already regulated under EU product-safety law (Annex I). High-risk obligations under Annex III were deferred to December 2027 by the Digital Omnibus.
Art. 5 — applicable since Feb 2025, penalties since Aug 2025
- Prohibited AI Practices
- A short, fixed list of AI uses banned outright regardless of context — including social scoring, certain forms of biometric categorization, and AI designed to manipulate or exploit vulnerabilities. This is the earliest-applied part of the Act: prohibitions took effect February 2, 2025, with penalties (up to €35M or 7% of global turnover) enforceable since August 2, 2025 — well before most other obligations.
Art. 3(63)
- GPAI (General-Purpose AI Model)
- An AI model trained on broad data at scale, capable of competently performing a wide range of distinct tasks, and able to be integrated into a variety of downstream systems or applications. GPAI obligations are separate from — and can overlap with — high-risk system obligations.
Art. 43
- Conformity Assessment
- The process by which a provider demonstrates that a high-risk AI system meets the Act's requirements before placing it on the market — generally through internal control, or, for certain systems, review by an external notified body.
Art. 50 — enforceable since Aug 2026
- Transparency Obligations
- Requirements to disclose certain AI interactions to end users — for example, informing people they are interacting with an AI system, or labeling AI-generated or manipulated audio, image, or video content. Frequently confused with Article 13 (a different, high-risk-specific transparency requirement); Article 50 is the one enforceable since August 2026.
Art. 6
- Risk-Based Classification
- The Act's core structure: AI systems are grouped into unacceptable (prohibited), high-risk, limited-risk, and minimal-risk tiers, with obligations scaled to the tier. Article 6(3) sets out four functional conditions used to determine high-risk status, alongside a separate documentation obligation — it does not require notifying a supervisory authority.
Regulation (EU) 2026/1744
- Digital Omnibus
- A regulation that amends the original AI Act (Regulation (EU) 2024/1689) — not a separate legislative package. In force since July 27, 2026, it deferred certain high-risk obligations (Annex III stand-alone systems, Articles 9–15, 16, and 26) to December 2, 2027. It did not touch the Article 5 prohibitions (already applicable since February 2025) or Article 50 transparency obligations (applicable since August 2, 2026). High-risk obligations for AI embedded in regulated products (Annex I) were separately deferred to August 2, 2028.
Spain
- AESIA
- The Agencia Española de Supervisión de Inteligencia Artificial — Spain's national supervisory authority for AI Act enforcement and oversight, distinct from the AEPD (which handles data protection). AESIA already holds market-surveillance powers, but its full sanctioning authority under Article 99 depends on national enabling legislation still moving through the Spanish parliament — this does not affect the direct applicability of Articles 5 and 50, which apply regardless.