EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules
A 140-card, source-linked review of the amended EU AI Act timeline, roles, risk structure, GPAI, transparency, high-risk duties, and enforcement.
Über dieses Lernkartenset
EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules
Build reliable recall of the amended EU AI Act with 140 focused, source-linked cards. The deck covers implementation dates, scope and exclusions, prohibited practices, provider and deployer roles, GPAI, Article 50 transparency, high-risk duties, governance, and penalty ceilings.
What you will practise
- Separate entry into force, general applicability, and later high-risk dates.
- Distinguish providers, deployers, importers, distributors, authorised representatives, and affected persons.
- Recall the risk gateways, prohibited practices, GPAI duties, and Article 50 disclosure rules.
- Recognise when a fact needs a fresh official-source check or fact-specific legal analysis.
Recall map and exclusions
The deck practises milestone → date and selected date → milestone recall, term or role → definition or duty, and rule or fact pattern → legal status, exception, or consequence. Composite prompts are limited to tests whose parts work together, including the Article 6 high-risk gateways and the role-specific triggers for the two 2026 prohibitions. Mechanical reversals of every definition, citation, exception, penalty ceiling, and multi-answer duty list are excluded because they would duplicate existing prompts or allow several correct answers.
Freshness
Official sources were checked on 26 August 2026. The deck incorporates Regulation (EU) 2026/1744 and the amended implementation timeline. Every card links to an official EU source and carries its retrieval date. Recheck EUR-Lex and the Commission timeline for later changes.
Important boundary
This deck is educational material, not legal advice. It does not classify any real AI system, decide whether an exception applies, or resolve a fact-specific compliance question. Consult qualified counsel and the competent authority for an actual system.
Sources and method
The primary source is the 27 July 2026 consolidated text of Regulation (EU) 2024/1689, read with Regulation (EU) 2026/1744. Commission timeline, FAQ, regulatory-framework, enforcement, GPAI, prohibited-practice, and Article 50 pages provide current implementation context. Commission guidance is useful but non-binding; courts and competent authorities give authoritative interpretations.
Cards use one root tag, EU AI Act, plus one learning group. The final order rotates across groups so related rules and exceptions are separated for stronger retrieval practice.
Independent study aid
This independently authored deck is unofficial. It is not affiliated with, endorsed by, or official material from the European Union, the European Commission, or any other EU institution.
Karten in diesem Lernkartenset
Karte 1
Frage
When did the EU AI Act enter into force?
Antwort
Answer. 1 August 2024, twenty days after publication in the Official Journal. Most duties did not apply immediately; the Act uses a phased timetable.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Karte 2
Frage
When can the EU AI Act apply to a provider outside the EU?
Antwort
Answer. When the provider places an AI system or GPAI model on the EU market, puts an AI system into service in the EU, or when the output of its AI system is used in the EU. The exact facts still matter.
Source: Regulation (EU) 2024/1689, Article 2. Retrieved 2026-08-26.
Karte 3
Frage
Who is a provider under the EU AI Act?
Antwort
Answer. A person, public authority, agency, or other body that develops an AI system or GPAI model, or has one developed, and places it on the market or puts the system into service under its own name or trademark, whether paid or free.
Source: Regulation (EU) 2024/1689, Article 3(3). Retrieved 2026-08-26.
Karte 4
Frage
What is a general-purpose AI model?
Antwort
Answer. An AI model with significant generality that can competently perform a wide range of distinct tasks and can be integrated into many downstream systems or applications. Models used only for research, development, or prototyping before market placement are excluded from this definition.
Source: Regulation (EU) 2024/1689, Article 3(63). Retrieved 2026-08-26.
Karte 5
Frage
When must people be told they are interacting with AI?
Antwort
Answer. Providers must design direct-interaction AI systems so people are informed that they are interacting with AI, unless this is obvious to a reasonably well-informed, observant, and circumspect person in the circumstances.
Source: Regulation (EU) 2024/1689, Article 50(1). Retrieved 2026-08-26.
Karte 6
Frage
What is the core purpose of high-risk AI risk management?
Antwort
Answer. To establish a continuous, iterative lifecycle process that identifies, analyses, evaluates, and treats known and reasonably foreseeable risks to health, safety, and fundamental rights, then tests whether controls work.
Source: Regulation (EU) 2024/1689, Article 9. Retrieved 2026-08-26.
Karte 7
Frage
Who enforces most EU AI Act rules?
Antwort
Answer. National competent authorities, including market-surveillance authorities, enforce most AI-system rules in Member States. The Commission’s AI Office has central responsibilities, especially for GPAI.
Source: European Commission enforcement framework. Retrieved 2026-08-26.
Karte 8
Frage
Which EU AI Act rules began applying on 2 February 2025?
Antwort
Answer. The AI-system definition and scope-related provisions, AI-literacy duty, and most original prohibited-practice rules began applying on 2 February 2025.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Karte 9
Frage
Does the EU AI Act apply to an EU-based deployer?
Antwort
Answer. Yes. The Act applies to deployers that have their place of establishment or are located in the EU, subject to the Act’s specific exclusions and transitions.
Source: Regulation (EU) 2024/1689, Article 2(1)(b). Retrieved 2026-08-26.
Karte 10
Frage
Who is a deployer under the EU AI Act?
Antwort
Answer. A person, public authority, agency, or other body using an AI system under its authority, except where the system is used in a personal, non-professional activity.
Source: Regulation (EU) 2024/1689, Article 3(4). Retrieved 2026-08-26.
Karte 11
Frage
Which baseline duties apply to all GPAI-model providers?
Antwort
Answer. Keep technical documentation current, give downstream providers information needed for integration and compliance, maintain an EU-copyright-compliance policy, publish a sufficiently detailed training-content summary, and cooperate with authorities.
Source: Regulation (EU) 2024/1689, Article 53. Retrieved 2026-08-26.
Karte 12
Frage
Who must machine-mark AI-generated content under Article 50?
Antwort
Answer. Providers of AI systems that generate synthetic audio, image, video, or text content must ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated.
Source: Regulation (EU) 2024/1689, Article 50(2). Retrieved 2026-08-26.
Karte 13
Frage
What data quality does Article 10 require for high-risk AI?
Antwort
Answer. Training, validation, and testing datasets must be governed appropriately and, for their intended purpose, be relevant, sufficiently representative, and as far as possible free of errors and complete, with suitable statistical properties.
Source: Regulation (EU) 2024/1689, Article 10. Retrieved 2026-08-26.
Karte 14
Frage
What is the European AI Office’s main EU AI Act role?
Antwort
Answer. It supports implementation and enforcement at EU level, including central supervision of GPAI obligations and coordination, guidance, evaluations, and investigations within its legal remit.
Source: European Commission enforcement framework. Retrieved 2026-08-26.
Karte 15
Frage
Which EU AI Act rules began applying on 2 August 2025?
Antwort
Answer. The GPAI obligations and much of the governance framework began applying on 2 August 2025, alongside Member State penalty-notification and authority-designation steps.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Karte 16
Frage
When can EU output-use bring a non-EU actor into scope?
Antwort
Answer. When a provider or deployer is outside the EU but the output produced by its AI system is used in the EU. This is a territorial hook, not an automatic conclusion about every remote service.
Source: Regulation (EU) 2024/1689, Article 2(1)(c). Retrieved 2026-08-26.
Karte 17
Frage
Who is an importer under the EU AI Act?
Antwort
Answer. An EU-located or EU-established person that places on the market an AI system bearing the name or trademark of a person established outside the EU.
Source: Regulation (EU) 2024/1689, Article 3(6). Retrieved 2026-08-26.
Karte 18
Frage
When is a GPAI model presumed to have systemic risk?
Antwort
Answer. When cumulative training compute exceeds 10^25 floating-point operations, the model is presumed to have high-impact capabilities and therefore systemic risk, unless the legal classification is successfully rebutted.
Source: Regulation (EU) 2024/1689, Articles 51–52. Retrieved 2026-08-26.
Karte 19
Frage
How strong must Article 50 machine marking be?
Antwort
Answer. The technical solution must be effective, interoperable, robust, and reliable as far as technically feasible, considering the content’s nature, implementation costs, and generally acknowledged state of the art.
Source: Regulation (EU) 2024/1689, Article 50(2). Retrieved 2026-08-26.
Karte 20
Frage
When must high-risk technical documentation exist?
Antwort
Answer. It must be drawn up before the high-risk system is placed on the market or put into service and kept up to date throughout the relevant lifecycle.
Source: Regulation (EU) 2024/1689, Article 11. Retrieved 2026-08-26.
Karte 21
Frage
What does the European AI Board do?
Antwort
Answer. It advises and assists the Commission and Member States to support consistent and effective application of the Act, including coordination among national authorities and sharing technical and regulatory expertise.
Source: Regulation (EU) 2024/1689, Articles 65–66. Retrieved 2026-08-26.
Karte 22
Frage
What was the EU AI Act’s general applicability date?
Antwort
Answer. 2 August 2026. Important exceptions and later dates remain, especially for certain prohibitions, high-risk categories, and legacy GPAI models.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Karte 23
Frage
Which national-security activity is outside the EU AI Act?
Antwort
Answer. The Act does not apply to areas outside EU law and does not affect Member State competences concerning national security, regardless of the entity carrying out the national-security tasks.
Source: Regulation (EU) 2024/1689, Article 2(3). Retrieved 2026-08-26.
Karte 24
Frage
Who is a distributor under the EU AI Act?
Antwort
Answer. A supply-chain person, other than the provider or importer, that makes an AI system available on the EU market.
Source: Regulation (EU) 2024/1689, Article 3(7). Retrieved 2026-08-26.
Karte 25
Frage
Can the Commission classify a GPAI model as systemic risk below 10^25 FLOPs?
Antwort
Answer. Yes. The Commission may designate a model when it has high-impact capabilities evaluated through appropriate technical tools and criteria, even without crossing the compute presumption.
Source: Regulation (EU) 2024/1689, Article 51. Retrieved 2026-08-26.
Karte 26
Frage
Who must disclose AI-generated deepfakes?
Antwort
Answer. Deployers of AI systems that generate or manipulate image, audio, or video content constituting a deepfake must disclose that the content was artificially generated or manipulated.
Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.
Karte 27
Frage
What logging capability must a high-risk AI system have?
Antwort
Answer. It must technically allow automatic recording of events over its lifetime to support traceability, monitoring, post-market work, and investigation appropriate to the system’s purpose.
Source: Regulation (EU) 2024/1689, Article 12. Retrieved 2026-08-26.
Karte 28
Frage
What is the Scientific Panel’s governance role?
Antwort
Answer. The independent Scientific Panel supports enforcement with technical expertise, including alerts and advice on GPAI models, systemic risks, evaluations, and other technically complex matters.
Source: Regulation (EU) 2024/1689, Articles 68 and 90. Retrieved 2026-08-26.
Karte 29
Frage
What did Regulation (EU) 2026/1744 do to the AI Act timetable?
Antwort
Answer. It amended Regulation (EU) 2024/1689, including deferred dates for Annex III and Annex I high-risk obligations and targeted Article 50 and prohibited-practice transitions.
Source: Regulation (EU) 2026/1744. Retrieved 2026-08-26.
Karte 30
Frage
Are exclusively military or defence AI systems covered?
Antwort
Answer. No. The Act excludes AI systems placed on the market, put into service, or used exclusively for military, defence, or national-security purposes, regardless of the actor. Mixed or changed uses need separate analysis.
Source: Regulation (EU) 2024/1689, Article 2(3). Retrieved 2026-08-26.
Karte 31
Frage
Who is an authorised representative under the EU AI Act?
Antwort
Answer. An EU-located or EU-established person that receives and accepts a written mandate from a provider to perform specified obligations and procedures on the provider’s behalf.
Source: Regulation (EU) 2024/1689, Article 3(5). Retrieved 2026-08-26.
Karte 32
Frage
When must a GPAI provider notify the Commission of a systemic-risk threshold?
Antwort
Answer. Without delay and, in any event, within two weeks after the provider knows or has reasonable grounds to believe the model meets the systemic-risk condition.
Source: Regulation (EU) 2024/1689, Article 52(1). Retrieved 2026-08-26.
Karte 33
Frage
How does Article 50 treat artistic deepfakes?
Antwort
Answer. For evidently artistic, creative, satirical, fictional, or analogous works, disclosure may be made in an appropriate way that does not hamper display or enjoyment of the work. The disclosure duty still exists.
Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.
Karte 34
Frage
What information must accompany a high-risk AI system?
Antwort
Answer. Concise, complete, correct, and clear instructions for use with the provider’s identity, capabilities and limits, intended purpose, performance, risks, human-oversight measures, input-data specifications, logging, maintenance, and other legally required details.
Source: Regulation (EU) 2024/1689, Article 13. Retrieved 2026-08-26.
Karte 35
Frage
What is the Advisory Forum’s role?
Antwort
Answer. It supplies stakeholder expertise and advice to the AI Board and Commission through a balanced group representing industry, startups, civil society, academia, and other affected interests.
Source: Regulation (EU) 2024/1689, Article 67. Retrieved 2026-08-26.
Karte 36
Frage
When did Regulation (EU) 2026/1744 enter into force?
Antwort
Answer. 27 July 2026. The amendment changed the then-current consolidated AI Act and must be considered when studying implementation dates.
Source: Regulation (EU) 2026/1744, Article 4. Retrieved 2026-08-26.
Karte 37
Frage
Is pure scientific research and development covered?
Antwort
Answer. The Act does not apply to AI systems or models, including outputs, specifically developed and put into service for the sole purpose of scientific research and development. Other uses need separate analysis.
Source: Regulation (EU) 2024/1689, Article 2(6). Retrieved 2026-08-26.
Karte 38
Frage
Which actors count as operators under the EU AI Act?
Antwort
Answer. Providers, product manufacturers, deployers, authorised representatives, importers, and distributors. “Operator” is the Act’s umbrella term for these value-chain roles.
Source: Regulation (EU) 2024/1689, Article 3(8). Retrieved 2026-08-26.
Karte 39
Frage
Can a GPAI provider challenge the systemic-risk presumption?
Antwort
Answer. Yes. With the threshold notification, the provider may present sufficiently substantiated arguments that the model exceptionally does not present systemic risks despite meeting the compute presumption. The Commission decides.
Source: Regulation (EU) 2024/1689, Article 52(2). Retrieved 2026-08-26.
Karte 40
Frage
When must AI-generated public-interest text be disclosed?
Antwort
Answer. A deployer must disclose artificial generation or manipulation when publishing AI-generated or manipulated text to inform the public on matters of public interest, unless a stated exception applies.
Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.
Karte 41
Frage
What must human oversight enable for high-risk AI?
Antwort
Answer. Effective oversight by competent people who can understand capabilities and limits, detect anomalies and automation bias, interpret outputs, decide not to use or override them, and safely interrupt the system where appropriate.
Source: Regulation (EU) 2024/1689, Article 14. Retrieved 2026-08-26.
Karte 42
Frage
Can a person complain about an alleged AI Act infringement?
Antwort
Answer. Yes. Any natural or legal person with grounds to consider that the Act was infringed may lodge a complaint with the relevant market-surveillance authority, without prejudice to other remedies.
Source: Regulation (EU) 2024/1689, Article 85. Retrieved 2026-08-26.
Karte 43
Frage
When do the two new 2026 prohibited practices begin applying?
Antwort
Answer. 2 December 2026. They concern specified non-consensual intimate or sexually explicit deepfakes and specified child-sexual-abuse material or performances.
Source: Regulation (EU) 2026/1744, Article 1 and transition provisions. Retrieved 2026-08-26.
Karte 44
Frage
Is pre-market AI research, testing, or development covered?
Antwort
Answer. Generally no, before placement on the market or putting into service, if the activity respects applicable EU law. Testing in real-world conditions is not part of this exclusion.
Source: Regulation (EU) 2024/1689, Article 2(8). Retrieved 2026-08-26.
Karte 45
Frage
Is an affected person an operator?
Antwort
Answer. No. “Operator” covers specified supply-chain and use roles. An affected person is someone in the EU affected by an AI system and may hold rights such as complaint or explanation rights where their conditions are met.
Source: Regulation (EU) 2024/1689, Articles 2, 3(8), 85–86. Retrieved 2026-08-26.
Karte 46
Frage
What must GPAI technical documentation cover?
Antwort
Answer. The model’s development, training, testing, evaluation, architecture, design specifications, capabilities, limitations, and other information required by Annex XI, kept current and available to the AI Office and national authorities on request.
Source: Regulation (EU) 2024/1689, Article 53(1)(a) and Annex XI. Retrieved 2026-08-26.
Karte 47
Frage
What is the public-interest text disclosure exception for human review?
Antwort
Answer. Disclosure is not required when the AI-generated content underwent human review or editorial control and a natural or legal person holds editorial responsibility for publication.
Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.
Karte 48
Frage
Which performance qualities must high-risk AI maintain?
Antwort
Answer. An appropriate level of accuracy, robustness, and cybersecurity throughout the lifecycle, consistent with the system’s intended purpose and the acknowledged state of the art.
Source: Regulation (EU) 2024/1689, Article 15. Retrieved 2026-08-26.
Karte 49
Frage
When does Article 86 give an explanation right?
Antwort
Answer. When a deployer takes a decision about an affected person on the basis of output from an Annex III high-risk system, except point 2 systems, and the decision produces legal effects or similarly significantly affects that person in a way they consider adverse to their health, safety, or fundamental rights, subject to the Article’s conditions and exceptions.
Source: Regulation (EU) 2024/1689, Article 86. Retrieved 2026-08-26.
Karte 50
Frage
What is the Article 50 transition for older synthetic-content systems?
Antwort
Answer. A system placed on the market before 2 August 2026 that generates or manipulates synthetic content has until 2 December 2026 to comply with Article 50(2)’s machine-readable marking duty.
Source: Regulation (EU) 2026/1744, Article 1 transition amendment. Retrieved 2026-08-26.
Karte 51
Frage
Does personal non-professional AI use fall under deployer duties?
Antwort
Answer. No. A natural person using AI in a purely personal, non-professional activity is excluded from the deployer definition and the Act does not apply to that use. Other applicable law can still matter.
Source: Regulation (EU) 2024/1689, Articles 2(10) and 3(4). Retrieved 2026-08-26.
Karte 52
Frage
When does a downstream actor become the provider of an AI system?
Antwort
Answer. If it places its name or trademark on a high-risk system, makes a substantial modification, or changes the intended purpose so a previously non-high-risk system becomes high-risk.
Source: Regulation (EU) 2024/1689, Article 25. Retrieved 2026-08-26.
Karte 53
Frage
What must GPAI providers tell downstream system providers?
Antwort
Answer. They must provide and maintain information and documentation enabling downstream providers to understand the model’s capabilities and limitations and comply with the Act, without disclosing protected intellectual property unnecessarily.
Source: Regulation (EU) 2024/1689, Article 53(1)(b) and Annex XII. Retrieved 2026-08-26.
Karte 54
Frage
Who must be informed about emotion-recognition use?
Antwort
Answer. Deployers of emotion-recognition systems must inform the natural persons exposed to the system and process personal data consistently with EU data-protection law.
Source: Regulation (EU) 2024/1689, Article 50(3). Retrieved 2026-08-26.
Karte 55
Frage
What is a high-risk provider’s basic compliance duty?
Antwort
Answer. Ensure the system complies with the Chapter III Section 2 requirements, identify itself, operate quality and documentation controls, complete conformity steps, register where required, take corrective action, and cooperate with authorities.
Source: Regulation (EU) 2024/1689, Article 16. Retrieved 2026-08-26.
Karte 56
Frage
What must an Article 86 explanation contain?
Antwort
Answer. Clear and meaningful explanations of the AI system’s role in the decision-making procedure and the main elements of the decision taken. It is not a general right to source code or every model detail.
Source: Regulation (EU) 2024/1689, Article 86. Retrieved 2026-08-26.
Karte 57
Frage
When do Annex III high-risk duties begin applying after the 2026 amendment?
Antwort
Answer. 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, subject to the Act’s detailed transitions and any applicable exceptions.
Source: Regulation (EU) 2026/1744. Retrieved 2026-08-26.
Karte 58
Frage
Does open-source release create a blanket EU AI Act exemption?
Antwort
Answer. No. The free-and-open-source exception does not cover systems placed on the market or put into service as high-risk systems or systems falling under Article 5 or Article 50. Other conditions also matter.
Source: Regulation (EU) 2024/1689, Article 2(12). Retrieved 2026-08-26.
Karte 59
Frage
What happens to the original provider after a downstream actor becomes provider?
Antwort
Answer. For that specific system, the original provider is no longer treated as provider under Article 25, but must cooperate and supply reasonably expected technical access and information unless it clearly prohibited the conversion into a high-risk system.
Source: Regulation (EU) 2024/1689, Article 25. Retrieved 2026-08-26.
Karte 60
Frage
What copyright policy must a GPAI provider maintain?
Antwort
Answer. A policy to comply with EU copyright and related-rights law, including identifying and respecting rights reservations expressed under Article 4(3) of the Digital Single Market Copyright Directive.
Source: Regulation (EU) 2024/1689, Article 53(1)(c). Retrieved 2026-08-26.
Karte 61
Frage
Who must be informed about biometric-categorisation use?
Antwort
Answer. Deployers of biometric-categorisation systems must inform the natural persons exposed to the system and process personal data under applicable EU data-protection rules. Article 5 separately prohibits certain sensitive-trait categorisation.
Source: Regulation (EU) 2024/1689, Article 50(3). Retrieved 2026-08-26.
Karte 62
Frage
What must a high-risk provider’s quality-management system cover?
Antwort
Answer. A documented, proportionate system covering compliance strategy, design and development, testing, data, technical specifications, verification, records, accountability, post-market monitoring, incident reporting, communications, and continuous improvement.
Source: Regulation (EU) 2024/1689, Article 17. Retrieved 2026-08-26.
Karte 63
Frage
What is the top fine tier for prohibited AI practices?
Antwort
Answer. Up to €35 million or, for undertakings, up to 7% of total worldwide annual turnover for the preceding financial year, whichever is higher, subject to the Act’s penalty rules and case-specific assessment.
Source: Regulation (EU) 2024/1689, Article 99(3). Retrieved 2026-08-26.
Karte 64
Frage
How do the AI Act’s application rules differ for Annex I Section A and Section B high-risk systems?
Antwort
Answer. Section A systems enter the Chapter III, Sections 1–3 regime on 2 August 2028. Section B systems do not take on that full regime: Article 2(2) limits the AI Act to Articles 6(1), 60a, and 102–112, with Articles 57–59 applying only when high-risk requirements are integrated into the relevant sectoral law. Articles 102–110 have applied since 27 July 2026.
Source: Regulation (EU) 2024/1689, Articles 2(2) and 113. Retrieved 2026-08-26.
Karte 65
Frage
Does the EU AI Act replace privacy law?
Antwort
Answer. No. EU data-protection, privacy, communications-confidentiality, and consumer-protection law continue to apply. AI Act compliance does not by itself establish compliance with those rules.
Source: Regulation (EU) 2024/1689, Article 2 and recitals. Retrieved 2026-08-26.
Karte 66
Frage
When is a product manufacturer treated as an AI-system provider?
Antwort
Answer. For a high-risk AI system that is a safety component of a product covered by Section A of Annex I, the product manufacturer becomes the provider and takes on Article 16 duties if either: (1) the system is placed on the market together with the product under the manufacturer’s name or trademark; or (2) the system is put into service under that name or trademark after the product has already been placed on the market.
Source: Regulation (EU) 2024/1689, Article 25(3). Retrieved 2026-08-26.
Karte 67
Frage
What training-content disclosure must a GPAI provider publish?
Antwort
Answer. A sufficiently detailed summary of the content used to train the model, using the template provided by the AI Office. It is a public transparency duty, not a requirement to publish every training item.
Source: Regulation (EU) 2024/1689, Article 53(1)(d). Retrieved 2026-08-26.
Karte 68
Frage
When must an Article 50 disclosure be presented?
Antwort
Answer. In a clear and distinguishable manner no later than the first interaction with or exposure to the AI system or its output, while satisfying applicable accessibility requirements.
Source: Regulation (EU) 2024/1689, Article 50(5). Retrieved 2026-08-26.
Karte 69
Frage
How long must high-risk providers keep core compliance documents?
Antwort
Answer. Generally ten years after the AI system is placed on the market or put into service, including technical documentation, quality-system documentation, changes approved by notified bodies, notified-body decisions, and the EU declaration of conformity.
Source: Regulation (EU) 2024/1689, Article 18. Retrieved 2026-08-26.
Karte 70
Frage
What is the main fine tier for listed operator and Article 50 violations?
Antwort
Answer. Up to €15 million or, for undertakings, up to 3% of total worldwide annual turnover for the preceding year, whichever is higher, subject to the exact provision and case-specific penalty assessment.
Source: Regulation (EU) 2024/1689, Article 99(4). Retrieved 2026-08-26.
140 Karten
EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules
Mit diesem Lernkartenset kostenlos lernenFlashcards wird geöffnet, damit du mit dem Lernen beginnen kannst.
Karte 71
Frage
When must Member States have at least one AI regulatory sandbox operational?
Antwort
Answer. By 2 August 2027, either nationally or through joint participation with other Member States, according to the Commission’s current implementation timeline.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Karte 72
Frage
What makes software an AI system under the Act?
Antwort
Answer. It must be machine-based, operate with varying autonomy, possibly adapt after deployment, infer from inputs how to generate outputs such as predictions, content, recommendations, or decisions, and influence physical or virtual environments.
Source: Regulation (EU) 2024/1689, Article 3(1). Retrieved 2026-08-26.
Karte 73
Frage
Must a provider’s identity be visible on a high-risk AI system?
Antwort
Answer. Yes. The provider must place its name, registered trade name or trademark, and contact address on the system or, when that is not possible, on packaging or accompanying documentation.
Source: Regulation (EU) 2024/1689, Article 16(b). Retrieved 2026-08-26.
Karte 74
Frage
Which GPAI duties may an open-source provider avoid?
Antwort
Answer. If the model meets the qualifying free-and-open-source conditions and is not systemic-risk, Article 53(1)(a) and (b) technical and downstream documentation duties do not apply. Copyright policy, training summary, and cooperation duties remain.
Source: Regulation (EU) 2024/1689, Article 53(2). Retrieved 2026-08-26.
Karte 75
Frage
Must Article 50 disclosures be accessible?
Antwort
Answer. Yes. The information must meet applicable accessibility requirements in addition to being clear, distinguishable, and timely. The right format depends on the surface and audience.
Source: Regulation (EU) 2024/1689, Article 50(5). Retrieved 2026-08-26.
Karte 76
Frage
Must high-risk providers keep automatically generated logs?
Antwort
Answer. Yes, when the logs are under their control. Providers must retain them for a period appropriate to the system’s intended purpose and generally at least six months unless other law provides otherwise.
Source: Regulation (EU) 2024/1689, Article 19. Retrieved 2026-08-26.
Karte 77
Frage
What is the fine tier for misleading information to authorities?
Antwort
Answer. Up to €7.5 million or, for undertakings, up to 1% of total worldwide annual turnover for the preceding year, whichever is higher, for supplying incorrect, incomplete, or misleading information to notified bodies or authorities in response to a request.
Source: Regulation (EU) 2024/1689, Article 99(5). Retrieved 2026-08-26.
Karte 78
Frage
When did most AI Act enforcement powers start operating?
Antwort
Answer. 2 August 2026 for the provisions applicable then. Later-applying obligations cannot be enforced as if already in force, and transitions must be checked provision by provision.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Karte 79
Frage
Which manipulation practice does Article 5 prohibit?
Antwort
Answer. Placing on the market, putting into service, or using AI that deploys subliminal, purposefully manipulative, or deceptive techniques with the objective or effect of materially distorting a person’s or group’s behaviour by appreciably impairing informed decision-making, thereby causing a decision they would not otherwise have taken in a manner that causes, or is reasonably likely to cause, significant harm to that person or another person or group.
Source: Regulation (EU) 2024/1689, Article 5(1)(a). Retrieved 2026-08-26.
Karte 80
Frage
What must a provider do after discovering high-risk non-conformity?
Antwort
Answer. Immediately take corrective action to bring the system into conformity, withdraw it, disable it, or recall it as appropriate, inform relevant downstream actors, and notify authorities when the risk conditions are met.
Source: Regulation (EU) 2024/1689, Article 20. Retrieved 2026-08-26.
Karte 81
Frage
What qualifies a model as open source for the GPAI documentation exception?
Antwort
Answer. Its parameters, including weights, architecture information, and information on model usage, must be publicly accessible under a free-and-open-source licence that permits access, use, modification, and distribution.
Source: Regulation (EU) 2024/1689, Article 53(2). Retrieved 2026-08-26.
Karte 82
Frage
Does obvious AI interaction remove every Article 50 duty?
Antwort
Answer. No. Obviousness is specific to the direct-interaction notice in Article 50(1). Separate marking and deployer-disclosure duties can still apply to synthetic content, deepfakes, public-interest text, or covered biometric uses.
Source: Regulation (EU) 2024/1689, Article 50. Retrieved 2026-08-26.
Karte 83
Frage
How must high-risk providers cooperate with authorities?
Antwort
Answer. On a reasoned request, provide information and documentation necessary to demonstrate conformity, grant access to automatically generated logs under their control, and otherwise cooperate in actions concerning the system.
Source: Regulation (EU) 2024/1689, Article 21. Retrieved 2026-08-26.
Karte 84
Frage
How are SME fines treated under the AI Act?
Antwort
Answer. For undertakings that are SMEs, each Article 99 fine must not exceed the lower of the stated percentage or fixed amount. Penalties must still be effective, proportionate, and dissuasive.
Source: Regulation (EU) 2024/1689, Article 99(6). Retrieved 2026-08-26.
Karte 85
Frage
By when must legacy GPAI models comply with GPAI duties?
Antwort
Answer. Providers of GPAI models placed on the market before 2 August 2025 must comply with the applicable GPAI obligations by 2 August 2027.
Source: European Commission GPAI provider guidelines. Retrieved 2026-08-26.
Karte 86
Frage
Which vulnerability exploitation does Article 5 prohibit?
Antwort
Answer. AI that exploits vulnerability due to age, disability, or a specific social or economic situation to materially distort behaviour in a way causing, or reasonably likely to cause, significant harm.
Source: Regulation (EU) 2024/1689, Article 5(1)(b). Retrieved 2026-08-26.
Karte 87
Frage
When must a non-EU high-risk provider appoint an authorised representative?
Antwort
Answer. Before making the high-risk AI system available in the EU, when the provider is established outside the EU, it must appoint an EU-established authorised representative by written mandate.
Source: Regulation (EU) 2024/1689, Article 22. Retrieved 2026-08-26.
Karte 88
Frage
Do systemic-risk GPAI models receive the open-source documentation exception?
Antwort
Answer. No. A GPAI model with systemic risk remains subject to the full applicable Article 53 baseline and Article 55 systemic-risk duties even if released under an open-source licence.
Source: Regulation (EU) 2024/1689, Articles 53(2) and 55. Retrieved 2026-08-26.
Karte 89
Frage
Is the direct-interaction notice required when AI use is obvious?
Antwort
Answer. Not under Article 50(1), if AI interaction is obvious to a reasonably well-informed, observant, and circumspect person, considering the circumstances and context. This is a contextual test, not a broad product label.
Source: European Commission Article 50 FAQ. Retrieved 2026-08-26.
Karte 90
Frage
What must an authorised representative verify for high-risk AI?
Antwort
Answer. That the EU declaration of conformity and technical documentation exist and that an appropriate conformity-assessment procedure was completed, then retain specified documents and support authority access and cooperation.
Source: Regulation (EU) 2024/1689, Article 22. Retrieved 2026-08-26.
Karte 91
Frage
When did Article 50’s transparency duties begin applying?
Antwort
Answer. 2 August 2026, with a targeted transition to 2 December 2026 for Article 50(2) marking by qualifying synthetic-content systems already on the market before that date.
Source: European Commission Article 50 guidelines. Retrieved 2026-08-26.
Karte 92
Frage
Which social-scoring practice is prohibited?
Antwort
Answer. Evaluating or classifying people over time by social behaviour or known, inferred, or predicted traits when this causes detrimental treatment in unrelated contexts or unjustified or disproportionate treatment.
Source: Regulation (EU) 2024/1689, Article 5(1)(c). Retrieved 2026-08-26.
Karte 93
Frage
When must an authorised representative end its mandate?
Antwort
Answer. If it considers or has reason to consider the provider is acting contrary to the Act, it must terminate the mandate and immediately inform the relevant market-surveillance authority and, where applicable, the notified body.
Source: Regulation (EU) 2024/1689, Article 22(4). Retrieved 2026-08-26.
Karte 94
Frage
What evaluations must systemic-risk GPAI providers perform?
Antwort
Answer. State-of-the-art model evaluations, including documented adversarial testing, to identify and mitigate systemic risks. The evaluations must follow standardised protocols and reflect the model’s capabilities and risks.
Source: Regulation (EU) 2024/1689, Article 55(1)(a). Retrieved 2026-08-26.
Karte 95
Frage
What is Article 50’s law-enforcement exception for interaction notices?
Antwort
Answer. Systems authorised by law to detect, prevent, investigate, or prosecute criminal offences can be exempt from the notice when appropriate safeguards protect third-party rights and freedoms. Systems available for public crime reporting remain subject to the notice.
Source: Regulation (EU) 2024/1689, Article 50(1). Retrieved 2026-08-26.
Karte 96
Frage
What must a high-risk importer verify before market placement?
Antwort
Answer. That the provider completed the correct conformity assessment, drew up technical documentation, affixed required CE marking, supplied the EU declaration and instructions, and appointed an authorised representative where required.
Source: Regulation (EU) 2024/1689, Article 23. Retrieved 2026-08-26.
Karte 97
Frage
What date should this deck’s legal summaries be checked against?
Antwort
Answer. 26 August 2026. Later amendments, delegated acts, standards, court decisions, or guidance can change how the rules should be understood.
Source: European Commission AI regulatory framework. Retrieved 2026-08-26.
Karte 98
Frage
Is criminal-risk prediction based solely on profiling allowed?
Antwort
Answer. No. Article 5 prohibits assessing or predicting an individual’s risk of committing an offence solely from profiling or personality traits. AI may support a human assessment already based on objective, verifiable facts linked to criminal activity.
Source: Regulation (EU) 2024/1689, Article 5(1)(d). Retrieved 2026-08-26.
Karte 99
Frage
What identity information must a high-risk importer provide?
Antwort
Answer. Its name, registered trade name or trademark, and contact address. The importer must put them on the high-risk AI system and, where applicable, on its packaging or accompanying documentation.
Source: Regulation (EU) 2024/1689, Article 23(3). Retrieved 2026-08-26.
Karte 100
Frage
Which systemic risks must GPAI providers assess and mitigate?
Antwort
Answer. EU-level risks arising from the model’s development, market placement, or use, including sources and propagation pathways. Measures must be proportionate, documented, and kept current.
Source: Regulation (EU) 2024/1689, Article 55(1)(b). Retrieved 2026-08-26.
Karte 101
Frage
Does Article 50 machine marking apply to ordinary editing?
Antwort
Answer. Not when the AI performs an assistive function for standard editing or does not substantially alter input data or its semantics. The exception is narrow and depends on what the system actually does.
Source: Regulation (EU) 2024/1689, Article 50(2). Retrieved 2026-08-26.
Karte 102
Frage
What must a high-risk distributor check before availability?
Antwort
Answer. The distributor must verify the required CE marking; a copy of the EU declaration and instructions for use; the provider’s Article 16(b) identity marking and Article 16(c) quality-management system; and, where applicable, the importer’s Article 23(3) identity marking.
Source: Regulation (EU) 2024/1689, Article 24(1). Retrieved 2026-08-26.
Karte 103
Frage
Which official text should be the default legal source for this deck?
Antwort
Answer. The EUR-Lex consolidated Regulation (EU) 2024/1689 version dated 27 July 2026, read together with Regulation (EU) 2026/1744 and later official updates. Consolidation is a study aid; the Official Journal acts remain legally authoritative.
Source: EUR-Lex consolidated Regulation (EU) 2024/1689. Retrieved 2026-08-26.
Karte 104
Frage
Is untargeted facial-image scraping for a recognition database allowed?
Antwort
Answer. No. Article 5 prohibits creating or expanding facial-recognition databases through untargeted scraping of facial images from the internet or CCTV footage.
Source: Regulation (EU) 2024/1689, Article 5(1)(e). Retrieved 2026-08-26.
Karte 105
Frage
What must an importer do if it suspects high-risk non-conformity?
Antwort
Answer. If the system is non-conforming, falsified, or accompanied by falsified documentation, the importer must not place it on the market until conformity is restored. Separately, if the system presents an Article 79(1) risk, the importer must inform the provider, authorised representative, and market-surveillance authorities.
Source: Regulation (EU) 2024/1689, Article 23(2). Retrieved 2026-08-26.
Karte 106
Frage
What serious incidents must systemic-risk GPAI providers report?
Antwort
Answer. Relevant serious incidents and possible corrective measures must be tracked, documented, and reported without undue delay to the AI Office and, where appropriate, national competent authorities.
Source: Regulation (EU) 2024/1689, Article 55(1)(c). Retrieved 2026-08-26.
Karte 107
Frage
Does authorised law-enforcement use remove machine-marking duties?
Antwort
Answer. Article 50(2) does not require synthetic-content marking where the AI system is authorised by law to detect, prevent, investigate, or prosecute criminal offences. The authorising law and its conditions still control the use.
Source: Regulation (EU) 2024/1689, Article 50(2). Retrieved 2026-08-26.
Karte 108
Frage
What storage and transport duties apply to high-risk importers?
Antwort
Answer. While responsible for the system, an importer must ensure storage and transport conditions do not jeopardise compliance with high-risk-system requirements.
Source: Regulation (EU) 2024/1689, Article 23(4). Retrieved 2026-08-26.
Karte 109
Frage
What does 2 August 2028 mark, and which Article 111 transitions come later?
Antwort
Answer. It is the selected main application milestone for Chapter III, Sections 1–3 for Article 6(1) high-risk systems tied to Annex I Section A products. It is not the Act’s last operative transition. Article 111 requires providers and deployers of high-risk systems intended to be used by public authorities to comply by 2 August 2030. It also requires AI systems that are components of large-scale IT systems established by the legal acts in Annex X, if placed on the market or put into service before 2 August 2027, to comply by 31 December 2030. Annex I Section B systems remain under Article 2(2)’s limited regime, not the full Chapter III regime.
Sources: Regulation (EU) 2024/1689, Articles 2(2), 111 and 113 and European Commission implementation timeline. Retrieved 2026-08-26.
Karte 110
Frage
Is workplace or school emotion inference allowed?
Antwort
Answer. Generally no. Inferring emotions of natural persons in workplaces or educational institutions is prohibited, except where use is intended for medical or safety reasons.
Source: Regulation (EU) 2024/1689, Article 5(1)(f). Retrieved 2026-08-26.
Karte 111
Frage
How long must a high-risk importer keep conformity records?
Antwort
Answer. For ten years after the system is placed on the market or put into service, the importer must keep a copy of the relevant certificate, where applicable, the instructions, and the EU declaration of conformity.
Source: Regulation (EU) 2024/1689, Article 23(5). Retrieved 2026-08-26.
Karte 112
Frage
What cybersecurity duty applies to systemic-risk GPAI models?
Antwort
Answer. Providers must ensure an adequate level of cybersecurity protection for the model and its physical infrastructure, proportionate to systemic risk and the state of the art.
Source: Regulation (EU) 2024/1689, Article 55(1)(d). Retrieved 2026-08-26.
Karte 113
Frage
Is there a law-enforcement exception to deepfake disclosure?
Antwort
Answer. Yes, for use authorised by law to detect, prevent, investigate, or prosecute criminal offences, with the relevant legal safeguards. The exception should not be generalized to ordinary public communications.
Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.
Karte 114
Frage
What must a distributor do if a high-risk system seems non-compliant?
Antwort
Answer. Withhold it from the market until conformity is restored. Separately, if the system presents an Article 79(1) risk, inform the provider or importer. Article 24(2) does not add an authority-notification duty at this pre-market stage.
Source: Regulation (EU) 2024/1689, Article 24(2). Retrieved 2026-08-26.
Karte 115
Frage
What must be rechecked before relying on an AI Act date?
Antwort
Answer. The current consolidated regulation, any amending regulation, and the Commission implementation timeline. A date in an older course or card set may have been superseded.
Source: European Commission AI Act FAQ. Retrieved 2026-08-26.
Karte 116
Frage
Which biometric categorisation is prohibited?
Antwort
Answer. Biometric categorisation that individually categorises people to deduce or infer race, political opinions, trade-union membership, religious or philosophical beliefs, sex life, or sexual orientation, subject to narrow dataset and law-enforcement carve-outs.
Source: Regulation (EU) 2024/1689, Article 5(1)(g). Retrieved 2026-08-26.
Karte 117
Frage
What must a distributor do after a high-risk system is already available?
Antwort
Answer. If it becomes non-compliant, take or ensure the corrective action needed to bring it into conformity, withdraw it, or recall it. Separately, if the system presents an Article 79(1) risk, immediately inform the provider or importer and competent authorities, with details of the non-compliance and corrective action.
Source: Regulation (EU) 2024/1689, Article 24(4). Retrieved 2026-08-26.
Karte 118
Frage
Can a GPAI code of practice demonstrate compliance?
Antwort
Answer. Yes. Until harmonised standards are available, providers may rely on approved codes of practice to demonstrate compliance. A provider choosing another route must show alternative adequate means of compliance.
Source: Regulation (EU) 2024/1689, Article 56. Retrieved 2026-08-26.
Karte 119
Frage
Does Article 50 replace other transparency law?
Antwort
Answer. No. Article 50 adds AI-specific duties without displacing stricter or overlapping obligations under consumer, media, electoral, platform, accessibility, privacy, or other applicable law.
Source: European Commission Article 50 guidelines. Retrieved 2026-08-26.
Karte 120
Frage
What storage and transport duties apply to high-risk distributors?
Antwort
Answer. While responsible for the system, a distributor must ensure storage and transport conditions do not jeopardise compliance with high-risk-system requirements.
Source: Regulation (EU) 2024/1689, Article 24(3). Retrieved 2026-08-26.
Karte 121
Frage
When is an Annex I product-linked AI system high-risk?
Antwort
Answer. Only when the Article 6(1) gateway remains satisfied after paragraphs 1a–1c: the AI is a safety component of an Annex I product, is itself such a product, or its failure or malfunction would endanger health and safety; and the product must undergo third-party conformity assessment before market placement or service. AI used solely for non-safety assistance, optimisation, efficiency, automation, convenience, or quality control is not a safety component unless its failure or malfunction would endanger health or safety. An assessment required solely for non-health-and-safety risks does not satisfy the second condition.
Source: Regulation (EU) 2024/1689, Article 6(1)–(1c). Retrieved 2026-08-26.
Karte 122
Frage
How must high-risk distributors cooperate with authorities?
Antwort
Answer. They must provide relevant information and documentation on a reasoned request and cooperate in actions concerning the high-risk system, including measures to reduce or mitigate risks.
Source: Regulation (EU) 2024/1689, Article 24(5)–(6). Retrieved 2026-08-26.
Karte 123
Frage
Are the Commission’s Article 50 guidelines legally binding?
Antwort
Answer. No. They are practical interpretive guidance. The AI Act’s text is binding, and authoritative interpretation belongs to competent authorities and ultimately the Court of Justice of the European Union.
Source: European Commission Article 50 guidelines. Retrieved 2026-08-26.
Karte 124
Frage
What input-data duty applies to high-risk deployers?
Antwort
Answer. When a deployer controls input data, it must ensure that the input is relevant and sufficiently representative for the system’s intended purpose.
Source: Regulation (EU) 2024/1689, Article 26(4). Retrieved 2026-08-26.
Karte 125
Frage
Which non-consensual intimate deepfake practice is prohibited?
Antwort
Answer. For providers, placing the system on the market or putting it into service is prohibited only if generating or manipulating the covered realistic intimate or sexually explicit material of an identifiable person without freely given, specific, informed, unambiguous, and explicit consent is intended, or is reasonably foreseeable and reproducible without significant technical modification and reasonable, adequate safeguards are absent. For deployers, use is prohibited only when they use the system for that purpose. The rule applies from 2 December 2026; manipulation counts only if it increases intimate-part exposure or alters the nature of the sexually explicit activity.
Source: Regulation (EU) 2026/1744, Article 1 (AI Act Article 5(1)(ba) and 5(1a)–(1b)). Retrieved 2026-08-26.
Karte 126
Frage
How must a high-risk deployer use the system?
Antwort
Answer. According to the accompanying instructions, while assigning human oversight to natural persons with the necessary competence, training, authority, and support.
Source: Regulation (EU) 2024/1689, Article 26(1)–(2). Retrieved 2026-08-26.
Karte 127
Frage
What is the safest Article 50 disclosure design?
Antwort
Answer. Put a clear, distinguishable, accessible notice at the first interaction or exposure, close to the relevant AI experience or content, while also meeting any machine-marking duty. Exact design remains context-specific.
Source: European Commission Article 50 FAQ. Retrieved 2026-08-26.
Karte 128
Frage
Who must complete a fundamental-rights impact assessment?
Antwort
Answer. Before first use, deployers that are public bodies, private entities providing public services, and deployers of specified Annex III creditworthiness and life or health-insurance systems, subject to Article 27’s exact scope and exceptions.
Source: Regulation (EU) 2024/1689, Article 27. Retrieved 2026-08-26.
Karte 129
Frage
How does Annex III create high-risk status?
Antwort
Answer. Article 6(2) classifies systems in Annex III’s listed use cases as high-risk, unless Article 6(3)’s limited no-significant-risk conditions apply. A use-case label alone is not the full analysis.
Source: Regulation (EU) 2024/1689, Article 6(2)–(3) and Annex III. Retrieved 2026-08-26.
Karte 130
Frage
What must a deployer do when high-risk use may create a risk?
Antwort
Answer. If use in accordance with the instructions may present an Article 79(1) risk, the deployer must, without undue delay, inform the provider or distributor and the relevant market-surveillance authority, and suspend use. A serious incident triggers a separate immediate chain: inform the provider first, then the importer or distributor and the relevant market-surveillance authorities; if the provider cannot be reached, Article 73 applies mutatis mutandis.
Source: Regulation (EU) 2024/1689, Article 26(5). Retrieved 2026-08-26.
Karte 131
Frage
Can a high-risk FRIA reuse a data-protection impact assessment?
Antwort
Answer. Yes. If a DPIA already addresses relevant elements, the deployer should complement it with the additional Article 27 information rather than duplicate the work.
Source: Regulation (EU) 2024/1689, Article 27(4). Retrieved 2026-08-26.
Karte 132
Frage
When may law enforcement use real-time remote biometric identification in public?
Antwort
Answer. Only for narrow listed objectives and under strict necessity, proportionality, temporal, geographic, and personal limits, generally with prior judicial or independent administrative authorisation. The default rule is prohibition.
Source: Regulation (EU) 2024/1689, Article 5(1)(h) and 5(2)–(7). Retrieved 2026-08-26.
Karte 133
Frage
How long must a high-risk deployer keep logs under its control?
Antwort
Answer. For a period appropriate to the intended purpose and generally at least six months, unless applicable EU or national law provides otherwise, particularly on personal-data protection.
Source: Regulation (EU) 2024/1689, Article 26(6). Retrieved 2026-08-26.
Karte 134
Frage
What conformity steps precede high-risk market placement?
Antwort
Answer. The provider must complete the applicable conformity assessment, draw up the EU declaration of conformity, affix CE marking, and register the system where required before placement or service. The exact route depends on the system.
Source: Regulation (EU) 2024/1689, Articles 43, 47–49. Retrieved 2026-08-26.
Karte 135
Frage
When can an Annex III system be treated as not high-risk?
Antwort
Answer. Only when both parts of Article 6(3) are met: it poses no significant risk of harm to health, safety, or fundamental rights—including, for example, by not materially influencing decision-making—and it satisfies at least one listed task condition: a narrow procedural task; improvement of the result of a previously completed human activity; detection of decision-making patterns or deviations without being meant to replace or influence the previously completed human assessment without proper human review; or a preparatory task for an Annex III assessment. Profiling systems remain high-risk, and the provider must document the assessment.
Source: Regulation (EU) 2024/1689, Article 6(3)–(4). Retrieved 2026-08-26.
Karte 136
Frage
When must workers be told about workplace high-risk AI?
Antwort
Answer. Before putting the system into service or using it at work, the deployer that is an employer must inform worker representatives and affected workers that they will be subject to the system, following applicable information rules.
Source: Regulation (EU) 2024/1689, Article 26(7). Retrieved 2026-08-26.
Karte 137
Frage
What ongoing monitoring must high-risk providers run?
Antwort
Answer. A documented post-market monitoring system proportionate to the technology and risks, actively collecting and analysing performance data throughout the system’s lifetime to evaluate continuous compliance.
Source: Regulation (EU) 2024/1689, Article 72. Retrieved 2026-08-26.
Karte 138
Frage
Which child-sexual-abuse AI practice is prohibited from 2 December 2026?
Antwort
Answer. From 2 December 2026, providers may not place the system on the market or put it into service if generating or manipulating the covered child-sexual-abuse material or performances is intended, or is reasonably foreseeable and reproducible without significant technical modification and reasonable, adequate safeguards are absent. Deployers are prohibited only when they use the system for that purpose. A ‘without right’ defence under national law remains possible.
Source: Regulation (EU) 2026/1744, Article 1 (AI Act Article 5(1)(bb) and 5(1a)). Retrieved 2026-08-26.
Karte 139
Frage
Who must be told when high-risk AI informs a decision about them?
Antwort
Answer. The deployer must inform the affected natural person that the relevant Annex III high-risk system is being used, where Article 26’s notice condition applies. Other explanation and data-protection rights may also be relevant.
Source: Regulation (EU) 2024/1689, Article 26(11). Retrieved 2026-08-26.
Karte 140
Frage
Does Article 6(3) ever exclude profiling systems from high-risk status?
Antwort
Answer. No. An Annex III system that performs profiling of natural persons is always considered high-risk, even if another Article 6(3) task description might appear narrow.
Source: Regulation (EU) 2024/1689, Article 6(3). Retrieved 2026-08-26.
140 Karten
EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules
Flashcards wird geöffnet, damit du mit dem Lernen beginnen kannst.