Last updated: April 2026. Reflects the Digital Omnibus amendments adopted by the European Parliament in March 2026.
The Basics
Scope and Applicability
The Four Risk Categories
Roles and Obligations
Conformity Assessment
General-Purpose AI (GPAI) Models
Penalties
Enforcement
GDPR and AI Act: How They Interact
Sector-Specific FAQs
SMEs and Startups
Key Terms Glossary
- Provider — The company that builds and markets an AI system
- Deployer — The company or institution that uses an AI system professionally
- High-risk AI — AI in categories where failures can significantly harm health, safety, or fundamental rights
- GPAI model — A large foundation model capable of performing many different tasks (e.g., GPT-4, Gemini)
- Systemic risk GPAI — A frontier GPAI model whose failure could cause widespread societal harm
- Conformity assessment — The process of verifying a high-risk AI system meets the Act's requirements
- Notified body — An independent third-party assessor designated by a Member State
- CE marking — The mark confirming an AI system meets EU regulatory requirements
- FRIA — Fundamental Rights Impact Assessment — a structured evaluation of how an AI system may affect individual rights
- AI Office — The EU-level body within the Commission that supervises GPAI models and coordinates enforcement
- Regulatory sandbox — A supervised testing environment where AI can be developed and validated before market entry
- Substantial modification — A change to an AI system significant enough to require re-assessment — and potentially turning a deployer into a provider