EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules
A 140-card, source-linked review of the amended EU AI Act timeline, roles, risk structure, GPAI, transparency, high-risk duties, and enforcement.
Sobre este mazo
EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules
Build reliable recall of the amended EU AI Act with 140 focused, source-linked cards. The deck covers implementation dates, scope and exclusions, prohibited practices, provider and deployer roles, GPAI, Article 50 transparency, high-risk duties, governance, and penalty ceilings.
What you will practise
- Separate entry into force, general applicability, and later high-risk dates.
- Distinguish providers, deployers, importers, distributors, authorised representatives, and affected persons.
- Recall the risk gateways, prohibited practices, GPAI duties, and Article 50 disclosure rules.
- Recognise when a fact needs a fresh official-source check or fact-specific legal analysis.
Recall map and exclusions
The deck practises milestone → date and selected date → milestone recall, term or role → definition or duty, and rule or fact pattern → legal status, exception, or consequence. Composite prompts are limited to tests whose parts work together, including the Article 6 high-risk gateways and the role-specific triggers for the two 2026 prohibitions. Mechanical reversals of every definition, citation, exception, penalty ceiling, and multi-answer duty list are excluded because they would duplicate existing prompts or allow several correct answers.
Freshness
Official sources were checked on 26 August 2026. The deck incorporates Regulation (EU) 2026/1744 and the amended implementation timeline. Every card links to an official EU source and carries its retrieval date. Recheck EUR-Lex and the Commission timeline for later changes.
Important boundary
This deck is educational material, not legal advice. It does not classify any real AI system, decide whether an exception applies, or resolve a fact-specific compliance question. Consult qualified counsel and the competent authority for an actual system.
Sources and method
The primary source is the 27 July 2026 consolidated text of Regulation (EU) 2024/1689, read with Regulation (EU) 2026/1744. Commission timeline, FAQ, regulatory-framework, enforcement, GPAI, prohibited-practice, and Article 50 pages provide current implementation context. Commission guidance is useful but non-binding; courts and competent authorities give authoritative interpretations.
Cards use one root tag, EU AI Act, plus one learning group. The final order rotates across groups so related rules and exceptions are separated for stronger retrieval practice.
Independent study aid
This independently authored deck is unofficial. It is not affiliated with, endorsed by, or official material from the European Union, the European Commission, or any other EU institution.
Tarjetas de este mazo
Tarjeta 1
Pregunta
When did the EU AI Act enter into force?
Respuesta
Answer. 1 August 2024, twenty days after publication in the Official Journal. Most duties did not apply immediately; the Act uses a phased timetable.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Tarjeta 2
Pregunta
When can the EU AI Act apply to a provider outside the EU?
Respuesta
Answer. When the provider places an AI system or GPAI model on the EU market, puts an AI system into service in the EU, or when the output of its AI system is used in the EU. The exact facts still matter.
Source: Regulation (EU) 2024/1689, Article 2. Retrieved 2026-08-26.
Tarjeta 3
Pregunta
Who is a provider under the EU AI Act?
Respuesta
Answer. A person, public authority, agency, or other body that develops an AI system or GPAI model, or has one developed, and places it on the market or puts the system into service under its own name or trademark, whether paid or free.
Source: Regulation (EU) 2024/1689, Article 3(3). Retrieved 2026-08-26.
Tarjeta 4
Pregunta
What is a general-purpose AI model?
Respuesta
Answer. An AI model with significant generality that can competently perform a wide range of distinct tasks and can be integrated into many downstream systems or applications. Models used only for research, development, or prototyping before market placement are excluded from this definition.
Source: Regulation (EU) 2024/1689, Article 3(63). Retrieved 2026-08-26.
Tarjeta 5
Pregunta
When must people be told they are interacting with AI?
Respuesta
Answer. Providers must design direct-interaction AI systems so people are informed that they are interacting with AI, unless this is obvious to a reasonably well-informed, observant, and circumspect person in the circumstances.
Source: Regulation (EU) 2024/1689, Article 50(1). Retrieved 2026-08-26.
Tarjeta 6
Pregunta
What is the core purpose of high-risk AI risk management?
Respuesta
Answer. To establish a continuous, iterative lifecycle process that identifies, analyses, evaluates, and treats known and reasonably foreseeable risks to health, safety, and fundamental rights, then tests whether controls work.
Source: Regulation (EU) 2024/1689, Article 9. Retrieved 2026-08-26.
Tarjeta 7
Pregunta
Who enforces most EU AI Act rules?
Respuesta
Answer. National competent authorities, including market-surveillance authorities, enforce most AI-system rules in Member States. The Commission’s AI Office has central responsibilities, especially for GPAI.
Source: European Commission enforcement framework. Retrieved 2026-08-26.
Tarjeta 8
Pregunta
Which EU AI Act rules began applying on 2 February 2025?
Respuesta
Answer. The AI-system definition and scope-related provisions, AI-literacy duty, and most original prohibited-practice rules began applying on 2 February 2025.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Tarjeta 9
Pregunta
Does the EU AI Act apply to an EU-based deployer?
Respuesta
Answer. Yes. The Act applies to deployers that have their place of establishment or are located in the EU, subject to the Act’s specific exclusions and transitions.
Source: Regulation (EU) 2024/1689, Article 2(1)(b). Retrieved 2026-08-26.
Tarjeta 10
Pregunta
Who is a deployer under the EU AI Act?
Respuesta
Answer. A person, public authority, agency, or other body using an AI system under its authority, except where the system is used in a personal, non-professional activity.
Source: Regulation (EU) 2024/1689, Article 3(4). Retrieved 2026-08-26.
Tarjeta 11
Pregunta
Which baseline duties apply to all GPAI-model providers?
Respuesta
Answer. Keep technical documentation current, give downstream providers information needed for integration and compliance, maintain an EU-copyright-compliance policy, publish a sufficiently detailed training-content summary, and cooperate with authorities.
Source: Regulation (EU) 2024/1689, Article 53. Retrieved 2026-08-26.
Tarjeta 12
Pregunta
Who must machine-mark AI-generated content under Article 50?
Respuesta
Answer. Providers of AI systems that generate synthetic audio, image, video, or text content must ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated.
Source: Regulation (EU) 2024/1689, Article 50(2). Retrieved 2026-08-26.
Tarjeta 13
Pregunta
What data quality does Article 10 require for high-risk AI?
Respuesta
Answer. Training, validation, and testing datasets must be governed appropriately and, for their intended purpose, be relevant, sufficiently representative, and as far as possible free of errors and complete, with suitable statistical properties.
Source: Regulation (EU) 2024/1689, Article 10. Retrieved 2026-08-26.
Tarjeta 14
Pregunta
What is the European AI Office’s main EU AI Act role?
Respuesta
Answer. It supports implementation and enforcement at EU level, including central supervision of GPAI obligations and coordination, guidance, evaluations, and investigations within its legal remit.
Source: European Commission enforcement framework. Retrieved 2026-08-26.
Tarjeta 15
Pregunta
Which EU AI Act rules began applying on 2 August 2025?
Respuesta
Answer. The GPAI obligations and much of the governance framework began applying on 2 August 2025, alongside Member State penalty-notification and authority-designation steps.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Tarjeta 16
Pregunta
When can EU output-use bring a non-EU actor into scope?
Respuesta
Answer. When a provider or deployer is outside the EU but the output produced by its AI system is used in the EU. This is a territorial hook, not an automatic conclusion about every remote service.
Source: Regulation (EU) 2024/1689, Article 2(1)(c). Retrieved 2026-08-26.
Tarjeta 17
Pregunta
Who is an importer under the EU AI Act?
Respuesta
Answer. An EU-located or EU-established person that places on the market an AI system bearing the name or trademark of a person established outside the EU.
Source: Regulation (EU) 2024/1689, Article 3(6). Retrieved 2026-08-26.
Tarjeta 18
Pregunta
When is a GPAI model presumed to have systemic risk?
Respuesta
Answer. When cumulative training compute exceeds 10^25 floating-point operations, the model is presumed to have high-impact capabilities and therefore systemic risk, unless the legal classification is successfully rebutted.
Source: Regulation (EU) 2024/1689, Articles 51–52. Retrieved 2026-08-26.
Tarjeta 19
Pregunta
How strong must Article 50 machine marking be?
Respuesta
Answer. The technical solution must be effective, interoperable, robust, and reliable as far as technically feasible, considering the content’s nature, implementation costs, and generally acknowledged state of the art.
Source: Regulation (EU) 2024/1689, Article 50(2). Retrieved 2026-08-26.
Tarjeta 20
Pregunta
When must high-risk technical documentation exist?
Respuesta
Answer. It must be drawn up before the high-risk system is placed on the market or put into service and kept up to date throughout the relevant lifecycle.
Source: Regulation (EU) 2024/1689, Article 11. Retrieved 2026-08-26.
Tarjeta 21
Pregunta
What does the European AI Board do?
Respuesta
Answer. It advises and assists the Commission and Member States to support consistent and effective application of the Act, including coordination among national authorities and sharing technical and regulatory expertise.
Source: Regulation (EU) 2024/1689, Articles 65–66. Retrieved 2026-08-26.
Tarjeta 22
Pregunta
What was the EU AI Act’s general applicability date?
Respuesta
Answer. 2 August 2026. Important exceptions and later dates remain, especially for certain prohibitions, high-risk categories, and legacy GPAI models.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Tarjeta 23
Pregunta
Which national-security activity is outside the EU AI Act?
Respuesta
Answer. The Act does not apply to areas outside EU law and does not affect Member State competences concerning national security, regardless of the entity carrying out the national-security tasks.
Source: Regulation (EU) 2024/1689, Article 2(3). Retrieved 2026-08-26.
Tarjeta 24
Pregunta
Who is a distributor under the EU AI Act?
Respuesta
Answer. A supply-chain person, other than the provider or importer, that makes an AI system available on the EU market.
Source: Regulation (EU) 2024/1689, Article 3(7). Retrieved 2026-08-26.
Tarjeta 25
Pregunta
Can the Commission classify a GPAI model as systemic risk below 10^25 FLOPs?
Respuesta
Answer. Yes. The Commission may designate a model when it has high-impact capabilities evaluated through appropriate technical tools and criteria, even without crossing the compute presumption.
Source: Regulation (EU) 2024/1689, Article 51. Retrieved 2026-08-26.
Tarjeta 26
Pregunta
Who must disclose AI-generated deepfakes?
Respuesta
Answer. Deployers of AI systems that generate or manipulate image, audio, or video content constituting a deepfake must disclose that the content was artificially generated or manipulated.
Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.
Tarjeta 27
Pregunta
What logging capability must a high-risk AI system have?
Respuesta
Answer. It must technically allow automatic recording of events over its lifetime to support traceability, monitoring, post-market work, and investigation appropriate to the system’s purpose.
Source: Regulation (EU) 2024/1689, Article 12. Retrieved 2026-08-26.
Tarjeta 28
Pregunta
What is the Scientific Panel’s governance role?
Respuesta
Answer. The independent Scientific Panel supports enforcement with technical expertise, including alerts and advice on GPAI models, systemic risks, evaluations, and other technically complex matters.
Source: Regulation (EU) 2024/1689, Articles 68 and 90. Retrieved 2026-08-26.
Tarjeta 29
Pregunta
What did Regulation (EU) 2026/1744 do to the AI Act timetable?
Respuesta
Answer. It amended Regulation (EU) 2024/1689, including deferred dates for Annex III and Annex I high-risk obligations and targeted Article 50 and prohibited-practice transitions.
Source: Regulation (EU) 2026/1744. Retrieved 2026-08-26.
Tarjeta 30
Pregunta
Are exclusively military or defence AI systems covered?
Respuesta
Answer. No. The Act excludes AI systems placed on the market, put into service, or used exclusively for military, defence, or national-security purposes, regardless of the actor. Mixed or changed uses need separate analysis.
Source: Regulation (EU) 2024/1689, Article 2(3). Retrieved 2026-08-26.
Tarjeta 31
Pregunta
Who is an authorised representative under the EU AI Act?
Respuesta
Answer. An EU-located or EU-established person that receives and accepts a written mandate from a provider to perform specified obligations and procedures on the provider’s behalf.
Source: Regulation (EU) 2024/1689, Article 3(5). Retrieved 2026-08-26.
Tarjeta 32
Pregunta
When must a GPAI provider notify the Commission of a systemic-risk threshold?
Respuesta
Answer. Without delay and, in any event, within two weeks after the provider knows or has reasonable grounds to believe the model meets the systemic-risk condition.
Source: Regulation (EU) 2024/1689, Article 52(1). Retrieved 2026-08-26.
Tarjeta 33
Pregunta
How does Article 50 treat artistic deepfakes?
Respuesta
Answer. For evidently artistic, creative, satirical, fictional, or analogous works, disclosure may be made in an appropriate way that does not hamper display or enjoyment of the work. The disclosure duty still exists.
Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.
Tarjeta 34
Pregunta
What information must accompany a high-risk AI system?
Respuesta
Answer. Concise, complete, correct, and clear instructions for use with the provider’s identity, capabilities and limits, intended purpose, performance, risks, human-oversight measures, input-data specifications, logging, maintenance, and other legally required details.
Source: Regulation (EU) 2024/1689, Article 13. Retrieved 2026-08-26.
Tarjeta 35
Pregunta
What is the Advisory Forum’s role?
Respuesta
Answer. It supplies stakeholder expertise and advice to the AI Board and Commission through a balanced group representing industry, startups, civil society, academia, and other affected interests.
Source: Regulation (EU) 2024/1689, Article 67. Retrieved 2026-08-26.
Tarjeta 36
Pregunta
When did Regulation (EU) 2026/1744 enter into force?
Respuesta
Answer. 27 July 2026. The amendment changed the then-current consolidated AI Act and must be considered when studying implementation dates.
Source: Regulation (EU) 2026/1744, Article 4. Retrieved 2026-08-26.
Tarjeta 37
Pregunta
Is pure scientific research and development covered?
Respuesta
Answer. The Act does not apply to AI systems or models, including outputs, specifically developed and put into service for the sole purpose of scientific research and development. Other uses need separate analysis.
Source: Regulation (EU) 2024/1689, Article 2(6). Retrieved 2026-08-26.
Tarjeta 38
Pregunta
Which actors count as operators under the EU AI Act?
Respuesta
Answer. Providers, product manufacturers, deployers, authorised representatives, importers, and distributors. “Operator” is the Act’s umbrella term for these value-chain roles.
Source: Regulation (EU) 2024/1689, Article 3(8). Retrieved 2026-08-26.
Tarjeta 39
Pregunta
Can a GPAI provider challenge the systemic-risk presumption?
Respuesta
Answer. Yes. With the threshold notification, the provider may present sufficiently substantiated arguments that the model exceptionally does not present systemic risks despite meeting the compute presumption. The Commission decides.
Source: Regulation (EU) 2024/1689, Article 52(2). Retrieved 2026-08-26.
Tarjeta 40
Pregunta
When must AI-generated public-interest text be disclosed?
Respuesta
Answer. A deployer must disclose artificial generation or manipulation when publishing AI-generated or manipulated text to inform the public on matters of public interest, unless a stated exception applies.
Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.
Tarjeta 41
Pregunta
What must human oversight enable for high-risk AI?
Respuesta
Answer. Effective oversight by competent people who can understand capabilities and limits, detect anomalies and automation bias, interpret outputs, decide not to use or override them, and safely interrupt the system where appropriate.
Source: Regulation (EU) 2024/1689, Article 14. Retrieved 2026-08-26.
Tarjeta 42
Pregunta
Can a person complain about an alleged AI Act infringement?
Respuesta
Answer. Yes. Any natural or legal person with grounds to consider that the Act was infringed may lodge a complaint with the relevant market-surveillance authority, without prejudice to other remedies.
Source: Regulation (EU) 2024/1689, Article 85. Retrieved 2026-08-26.
Tarjeta 43
Pregunta
When do the two new 2026 prohibited practices begin applying?
Respuesta
Answer. 2 December 2026. They concern specified non-consensual intimate or sexually explicit deepfakes and specified child-sexual-abuse material or performances.
Source: Regulation (EU) 2026/1744, Article 1 and transition provisions. Retrieved 2026-08-26.
Tarjeta 44
Pregunta
Is pre-market AI research, testing, or development covered?
Respuesta
Answer. Generally no, before placement on the market or putting into service, if the activity respects applicable EU law. Testing in real-world conditions is not part of this exclusion.
Source: Regulation (EU) 2024/1689, Article 2(8). Retrieved 2026-08-26.
Tarjeta 45
Pregunta
Is an affected person an operator?
Respuesta
Answer. No. “Operator” covers specified supply-chain and use roles. An affected person is someone in the EU affected by an AI system and may hold rights such as complaint or explanation rights where their conditions are met.
Source: Regulation (EU) 2024/1689, Articles 2, 3(8), 85–86. Retrieved 2026-08-26.
Tarjeta 46
Pregunta
What must GPAI technical documentation cover?
Respuesta
Answer. The model’s development, training, testing, evaluation, architecture, design specifications, capabilities, limitations, and other information required by Annex XI, kept current and available to the AI Office and national authorities on request.
Source: Regulation (EU) 2024/1689, Article 53(1)(a) and Annex XI. Retrieved 2026-08-26.
Tarjeta 47
Pregunta
What is the public-interest text disclosure exception for human review?
Respuesta
Answer. Disclosure is not required when the AI-generated content underwent human review or editorial control and a natural or legal person holds editorial responsibility for publication.
Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.
Tarjeta 48
Pregunta
Which performance qualities must high-risk AI maintain?
Respuesta
Answer. An appropriate level of accuracy, robustness, and cybersecurity throughout the lifecycle, consistent with the system’s intended purpose and the acknowledged state of the art.
Source: Regulation (EU) 2024/1689, Article 15. Retrieved 2026-08-26.
Tarjeta 49
Pregunta
When does Article 86 give an explanation right?
Respuesta
Answer. When a deployer takes a decision about an affected person on the basis of output from an Annex III high-risk system, except point 2 systems, and the decision produces legal effects or similarly significantly affects that person in a way they consider adverse to their health, safety, or fundamental rights, subject to the Article’s conditions and exceptions.
Source: Regulation (EU) 2024/1689, Article 86. Retrieved 2026-08-26.
Tarjeta 50
Pregunta
What is the Article 50 transition for older synthetic-content systems?
Respuesta
Answer. A system placed on the market before 2 August 2026 that generates or manipulates synthetic content has until 2 December 2026 to comply with Article 50(2)’s machine-readable marking duty.
Source: Regulation (EU) 2026/1744, Article 1 transition amendment. Retrieved 2026-08-26.
Tarjeta 51
Pregunta
Does personal non-professional AI use fall under deployer duties?
Respuesta
Answer. No. A natural person using AI in a purely personal, non-professional activity is excluded from the deployer definition and the Act does not apply to that use. Other applicable law can still matter.
Source: Regulation (EU) 2024/1689, Articles 2(10) and 3(4). Retrieved 2026-08-26.
Tarjeta 52
Pregunta
When does a downstream actor become the provider of an AI system?
Respuesta
Answer. If it places its name or trademark on a high-risk system, makes a substantial modification, or changes the intended purpose so a previously non-high-risk system becomes high-risk.
Source: Regulation (EU) 2024/1689, Article 25. Retrieved 2026-08-26.
Tarjeta 53
Pregunta
What must GPAI providers tell downstream system providers?
Respuesta
Answer. They must provide and maintain information and documentation enabling downstream providers to understand the model’s capabilities and limitations and comply with the Act, without disclosing protected intellectual property unnecessarily.
Source: Regulation (EU) 2024/1689, Article 53(1)(b) and Annex XII. Retrieved 2026-08-26.
Tarjeta 54
Pregunta
Who must be informed about emotion-recognition use?
Respuesta
Answer. Deployers of emotion-recognition systems must inform the natural persons exposed to the system and process personal data consistently with EU data-protection law.
Source: Regulation (EU) 2024/1689, Article 50(3). Retrieved 2026-08-26.
Tarjeta 55
Pregunta
What is a high-risk provider’s basic compliance duty?
Respuesta
Answer. Ensure the system complies with the Chapter III Section 2 requirements, identify itself, operate quality and documentation controls, complete conformity steps, register where required, take corrective action, and cooperate with authorities.
Source: Regulation (EU) 2024/1689, Article 16. Retrieved 2026-08-26.
Tarjeta 56
Pregunta
What must an Article 86 explanation contain?
Respuesta
Answer. Clear and meaningful explanations of the AI system’s role in the decision-making procedure and the main elements of the decision taken. It is not a general right to source code or every model detail.
Source: Regulation (EU) 2024/1689, Article 86. Retrieved 2026-08-26.
Tarjeta 57
Pregunta
When do Annex III high-risk duties begin applying after the 2026 amendment?
Respuesta
Answer. 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, subject to the Act’s detailed transitions and any applicable exceptions.
Source: Regulation (EU) 2026/1744. Retrieved 2026-08-26.
Tarjeta 58
Pregunta
Does open-source release create a blanket EU AI Act exemption?
Respuesta
Answer. No. The free-and-open-source exception does not cover systems placed on the market or put into service as high-risk systems or systems falling under Article 5 or Article 50. Other conditions also matter.
Source: Regulation (EU) 2024/1689, Article 2(12). Retrieved 2026-08-26.
Tarjeta 59
Pregunta
What happens to the original provider after a downstream actor becomes provider?
Respuesta
Answer. For that specific system, the original provider is no longer treated as provider under Article 25, but must cooperate and supply reasonably expected technical access and information unless it clearly prohibited the conversion into a high-risk system.
Source: Regulation (EU) 2024/1689, Article 25. Retrieved 2026-08-26.
Tarjeta 60
Pregunta
What copyright policy must a GPAI provider maintain?
Respuesta
Answer. A policy to comply with EU copyright and related-rights law, including identifying and respecting rights reservations expressed under Article 4(3) of the Digital Single Market Copyright Directive.
Source: Regulation (EU) 2024/1689, Article 53(1)(c). Retrieved 2026-08-26.
Tarjeta 61
Pregunta
Who must be informed about biometric-categorisation use?
Respuesta
Answer. Deployers of biometric-categorisation systems must inform the natural persons exposed to the system and process personal data under applicable EU data-protection rules. Article 5 separately prohibits certain sensitive-trait categorisation.
Source: Regulation (EU) 2024/1689, Article 50(3). Retrieved 2026-08-26.
Tarjeta 62
Pregunta
What must a high-risk provider’s quality-management system cover?
Respuesta
Answer. A documented, proportionate system covering compliance strategy, design and development, testing, data, technical specifications, verification, records, accountability, post-market monitoring, incident reporting, communications, and continuous improvement.
Source: Regulation (EU) 2024/1689, Article 17. Retrieved 2026-08-26.
Tarjeta 63
Pregunta
What is the top fine tier for prohibited AI practices?
Respuesta
Answer. Up to €35 million or, for undertakings, up to 7% of total worldwide annual turnover for the preceding financial year, whichever is higher, subject to the Act’s penalty rules and case-specific assessment.
Source: Regulation (EU) 2024/1689, Article 99(3). Retrieved 2026-08-26.
Tarjeta 64
Pregunta
How do the AI Act’s application rules differ for Annex I Section A and Section B high-risk systems?
Respuesta
Answer. Section A systems enter the Chapter III, Sections 1–3 regime on 2 August 2028. Section B systems do not take on that full regime: Article 2(2) limits the AI Act to Articles 6(1), 60a, and 102–112, with Articles 57–59 applying only when high-risk requirements are integrated into the relevant sectoral law. Articles 102–110 have applied since 27 July 2026.
Source: Regulation (EU) 2024/1689, Articles 2(2) and 113. Retrieved 2026-08-26.
Tarjeta 65
Pregunta
Does the EU AI Act replace privacy law?
Respuesta
Answer. No. EU data-protection, privacy, communications-confidentiality, and consumer-protection law continue to apply. AI Act compliance does not by itself establish compliance with those rules.
Source: Regulation (EU) 2024/1689, Article 2 and recitals. Retrieved 2026-08-26.
Tarjeta 66
Pregunta
When is a product manufacturer treated as an AI-system provider?
Respuesta
Answer. For a high-risk AI system that is a safety component of a product covered by Section A of Annex I, the product manufacturer becomes the provider and takes on Article 16 duties if either: (1) the system is placed on the market together with the product under the manufacturer’s name or trademark; or (2) the system is put into service under that name or trademark after the product has already been placed on the market.
Source: Regulation (EU) 2024/1689, Article 25(3). Retrieved 2026-08-26.
Tarjeta 67
Pregunta
What training-content disclosure must a GPAI provider publish?
Respuesta
Answer. A sufficiently detailed summary of the content used to train the model, using the template provided by the AI Office. It is a public transparency duty, not a requirement to publish every training item.
Source: Regulation (EU) 2024/1689, Article 53(1)(d). Retrieved 2026-08-26.
Tarjeta 68
Pregunta
When must an Article 50 disclosure be presented?
Respuesta
Answer. In a clear and distinguishable manner no later than the first interaction with or exposure to the AI system or its output, while satisfying applicable accessibility requirements.
Source: Regulation (EU) 2024/1689, Article 50(5). Retrieved 2026-08-26.
Tarjeta 69
Pregunta
How long must high-risk providers keep core compliance documents?
Respuesta
Answer. Generally ten years after the AI system is placed on the market or put into service, including technical documentation, quality-system documentation, changes approved by notified bodies, notified-body decisions, and the EU declaration of conformity.
Source: Regulation (EU) 2024/1689, Article 18. Retrieved 2026-08-26.
Tarjeta 70
Pregunta
What is the main fine tier for listed operator and Article 50 violations?
Respuesta
Answer. Up to €15 million or, for undertakings, up to 3% of total worldwide annual turnover for the preceding year, whichever is higher, subject to the exact provision and case-specific penalty assessment.
Source: Regulation (EU) 2024/1689, Article 99(4). Retrieved 2026-08-26.
140 tarjetas
EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules
Estudia este mazo gratisFlashcards se abrirá para que puedas empezar a estudiar.
Tarjeta 71
Pregunta
When must Member States have at least one AI regulatory sandbox operational?
Respuesta
Answer. By 2 August 2027, either nationally or through joint participation with other Member States, according to the Commission’s current implementation timeline.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Tarjeta 72
Pregunta
What makes software an AI system under the Act?
Respuesta
Answer. It must be machine-based, operate with varying autonomy, possibly adapt after deployment, infer from inputs how to generate outputs such as predictions, content, recommendations, or decisions, and influence physical or virtual environments.
Source: Regulation (EU) 2024/1689, Article 3(1). Retrieved 2026-08-26.
Tarjeta 73
Pregunta
Must a provider’s identity be visible on a high-risk AI system?
Respuesta
Answer. Yes. The provider must place its name, registered trade name or trademark, and contact address on the system or, when that is not possible, on packaging or accompanying documentation.
Source: Regulation (EU) 2024/1689, Article 16(b). Retrieved 2026-08-26.
Tarjeta 74
Pregunta
Which GPAI duties may an open-source provider avoid?
Respuesta
Answer. If the model meets the qualifying free-and-open-source conditions and is not systemic-risk, Article 53(1)(a) and (b) technical and downstream documentation duties do not apply. Copyright policy, training summary, and cooperation duties remain.
Source: Regulation (EU) 2024/1689, Article 53(2). Retrieved 2026-08-26.
Tarjeta 75
Pregunta
Must Article 50 disclosures be accessible?
Respuesta
Answer. Yes. The information must meet applicable accessibility requirements in addition to being clear, distinguishable, and timely. The right format depends on the surface and audience.
Source: Regulation (EU) 2024/1689, Article 50(5). Retrieved 2026-08-26.
Tarjeta 76
Pregunta
Must high-risk providers keep automatically generated logs?
Respuesta
Answer. Yes, when the logs are under their control. Providers must retain them for a period appropriate to the system’s intended purpose and generally at least six months unless other law provides otherwise.
Source: Regulation (EU) 2024/1689, Article 19. Retrieved 2026-08-26.
Tarjeta 77
Pregunta
What is the fine tier for misleading information to authorities?
Respuesta
Answer. Up to €7.5 million or, for undertakings, up to 1% of total worldwide annual turnover for the preceding year, whichever is higher, for supplying incorrect, incomplete, or misleading information to notified bodies or authorities in response to a request.
Source: Regulation (EU) 2024/1689, Article 99(5). Retrieved 2026-08-26.
Tarjeta 78
Pregunta
When did most AI Act enforcement powers start operating?
Respuesta
Answer. 2 August 2026 for the provisions applicable then. Later-applying obligations cannot be enforced as if already in force, and transitions must be checked provision by provision.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Tarjeta 79
Pregunta
Which manipulation practice does Article 5 prohibit?
Respuesta
Answer. Placing on the market, putting into service, or using AI that deploys subliminal, purposefully manipulative, or deceptive techniques with the objective or effect of materially distorting a person’s or group’s behaviour by appreciably impairing informed decision-making, thereby causing a decision they would not otherwise have taken in a manner that causes, or is reasonably likely to cause, significant harm to that person or another person or group.
Source: Regulation (EU) 2024/1689, Article 5(1)(a). Retrieved 2026-08-26.
Tarjeta 80
Pregunta
What must a provider do after discovering high-risk non-conformity?
Respuesta
Answer. Immediately take corrective action to bring the system into conformity, withdraw it, disable it, or recall it as appropriate, inform relevant downstream actors, and notify authorities when the risk conditions are met.
Source: Regulation (EU) 2024/1689, Article 20. Retrieved 2026-08-26.
Tarjeta 81
Pregunta
What qualifies a model as open source for the GPAI documentation exception?
Respuesta
Answer. Its parameters, including weights, architecture information, and information on model usage, must be publicly accessible under a free-and-open-source licence that permits access, use, modification, and distribution.
Source: Regulation (EU) 2024/1689, Article 53(2). Retrieved 2026-08-26.
Tarjeta 82
Pregunta
Does obvious AI interaction remove every Article 50 duty?
Respuesta
Answer. No. Obviousness is specific to the direct-interaction notice in Article 50(1). Separate marking and deployer-disclosure duties can still apply to synthetic content, deepfakes, public-interest text, or covered biometric uses.
Source: Regulation (EU) 2024/1689, Article 50. Retrieved 2026-08-26.
Tarjeta 83
Pregunta
How must high-risk providers cooperate with authorities?
Respuesta
Answer. On a reasoned request, provide information and documentation necessary to demonstrate conformity, grant access to automatically generated logs under their control, and otherwise cooperate in actions concerning the system.
Source: Regulation (EU) 2024/1689, Article 21. Retrieved 2026-08-26.
Tarjeta 84
Pregunta
How are SME fines treated under the AI Act?
Respuesta
Answer. For undertakings that are SMEs, each Article 99 fine must not exceed the lower of the stated percentage or fixed amount. Penalties must still be effective, proportionate, and dissuasive.
Source: Regulation (EU) 2024/1689, Article 99(6). Retrieved 2026-08-26.
Tarjeta 85
Pregunta
By when must legacy GPAI models comply with GPAI duties?
Respuesta
Answer. Providers of GPAI models placed on the market before 2 August 2025 must comply with the applicable GPAI obligations by 2 August 2027.
Source: European Commission GPAI provider guidelines. Retrieved 2026-08-26.
Tarjeta 86
Pregunta
Which vulnerability exploitation does Article 5 prohibit?
Respuesta
Answer. AI that exploits vulnerability due to age, disability, or a specific social or economic situation to materially distort behaviour in a way causing, or reasonably likely to cause, significant harm.
Source: Regulation (EU) 2024/1689, Article 5(1)(b). Retrieved 2026-08-26.
Tarjeta 87
Pregunta
When must a non-EU high-risk provider appoint an authorised representative?
Respuesta
Answer. Before making the high-risk AI system available in the EU, when the provider is established outside the EU, it must appoint an EU-established authorised representative by written mandate.
Source: Regulation (EU) 2024/1689, Article 22. Retrieved 2026-08-26.
Tarjeta 88
Pregunta
Do systemic-risk GPAI models receive the open-source documentation exception?
Respuesta
Answer. No. A GPAI model with systemic risk remains subject to the full applicable Article 53 baseline and Article 55 systemic-risk duties even if released under an open-source licence.
Source: Regulation (EU) 2024/1689, Articles 53(2) and 55. Retrieved 2026-08-26.
Tarjeta 89
Pregunta
Is the direct-interaction notice required when AI use is obvious?
Respuesta
Answer. Not under Article 50(1), if AI interaction is obvious to a reasonably well-informed, observant, and circumspect person, considering the circumstances and context. This is a contextual test, not a broad product label.
Source: European Commission Article 50 FAQ. Retrieved 2026-08-26.
Tarjeta 90
Pregunta
What must an authorised representative verify for high-risk AI?
Respuesta
Answer. That the EU declaration of conformity and technical documentation exist and that an appropriate conformity-assessment procedure was completed, then retain specified documents and support authority access and cooperation.
Source: Regulation (EU) 2024/1689, Article 22. Retrieved 2026-08-26.
Tarjeta 91
Pregunta
When did Article 50’s transparency duties begin applying?
Respuesta
Answer. 2 August 2026, with a targeted transition to 2 December 2026 for Article 50(2) marking by qualifying synthetic-content systems already on the market before that date.
Source: European Commission Article 50 guidelines. Retrieved 2026-08-26.
Tarjeta 92
Pregunta
Which social-scoring practice is prohibited?
Respuesta
Answer. Evaluating or classifying people over time by social behaviour or known, inferred, or predicted traits when this causes detrimental treatment in unrelated contexts or unjustified or disproportionate treatment.
Source: Regulation (EU) 2024/1689, Article 5(1)(c). Retrieved 2026-08-26.
Tarjeta 93
Pregunta
When must an authorised representative end its mandate?
Respuesta
Answer. If it considers or has reason to consider the provider is acting contrary to the Act, it must terminate the mandate and immediately inform the relevant market-surveillance authority and, where applicable, the notified body.
Source: Regulation (EU) 2024/1689, Article 22(4). Retrieved 2026-08-26.
Tarjeta 94
Pregunta
What evaluations must systemic-risk GPAI providers perform?
Respuesta
Answer. State-of-the-art model evaluations, including documented adversarial testing, to identify and mitigate systemic risks. The evaluations must follow standardised protocols and reflect the model’s capabilities and risks.
Source: Regulation (EU) 2024/1689, Article 55(1)(a). Retrieved 2026-08-26.
Tarjeta 95
Pregunta
What is Article 50’s law-enforcement exception for interaction notices?
Respuesta
Answer. Systems authorised by law to detect, prevent, investigate, or prosecute criminal offences can be exempt from the notice when appropriate safeguards protect third-party rights and freedoms. Systems available for public crime reporting remain subject to the notice.
Source: Regulation (EU) 2024/1689, Article 50(1). Retrieved 2026-08-26.
Tarjeta 96
Pregunta
What must a high-risk importer verify before market placement?
Respuesta
Answer. That the provider completed the correct conformity assessment, drew up technical documentation, affixed required CE marking, supplied the EU declaration and instructions, and appointed an authorised representative where required.
Source: Regulation (EU) 2024/1689, Article 23. Retrieved 2026-08-26.
Tarjeta 97
Pregunta
What date should this deck’s legal summaries be checked against?
Respuesta
Answer. 26 August 2026. Later amendments, delegated acts, standards, court decisions, or guidance can change how the rules should be understood.
Source: European Commission AI regulatory framework. Retrieved 2026-08-26.
Tarjeta 98
Pregunta
Is criminal-risk prediction based solely on profiling allowed?
Respuesta
Answer. No. Article 5 prohibits assessing or predicting an individual’s risk of committing an offence solely from profiling or personality traits. AI may support a human assessment already based on objective, verifiable facts linked to criminal activity.
Source: Regulation (EU) 2024/1689, Article 5(1)(d). Retrieved 2026-08-26.
Tarjeta 99
Pregunta
What identity information must a high-risk importer provide?
Respuesta
Answer. Its name, registered trade name or trademark, and contact address. The importer must put them on the high-risk AI system and, where applicable, on its packaging or accompanying documentation.
Source: Regulation (EU) 2024/1689, Article 23(3). Retrieved 2026-08-26.
Tarjeta 100
Pregunta
Which systemic risks must GPAI providers assess and mitigate?
Respuesta
Answer. EU-level risks arising from the model’s development, market placement, or use, including sources and propagation pathways. Measures must be proportionate, documented, and kept current.
Source: Regulation (EU) 2024/1689, Article 55(1)(b). Retrieved 2026-08-26.
Tarjeta 101
Pregunta
Does Article 50 machine marking apply to ordinary editing?
Respuesta
Answer. Not when the AI performs an assistive function for standard editing or does not substantially alter input data or its semantics. The exception is narrow and depends on what the system actually does.
Source: Regulation (EU) 2024/1689, Article 50(2). Retrieved 2026-08-26.
Tarjeta 102
Pregunta
What must a high-risk distributor check before availability?
Respuesta
Answer. The distributor must verify the required CE marking; a copy of the EU declaration and instructions for use; the provider’s Article 16(b) identity marking and Article 16(c) quality-management system; and, where applicable, the importer’s Article 23(3) identity marking.
Source: Regulation (EU) 2024/1689, Article 24(1). Retrieved 2026-08-26.
Tarjeta 103
Pregunta
Which official text should be the default legal source for this deck?
Respuesta
Answer. The EUR-Lex consolidated Regulation (EU) 2024/1689 version dated 27 July 2026, read together with Regulation (EU) 2026/1744 and later official updates. Consolidation is a study aid; the Official Journal acts remain legally authoritative.
Source: EUR-Lex consolidated Regulation (EU) 2024/1689. Retrieved 2026-08-26.
Tarjeta 104
Pregunta
Is untargeted facial-image scraping for a recognition database allowed?
Respuesta
Answer. No. Article 5 prohibits creating or expanding facial-recognition databases through untargeted scraping of facial images from the internet or CCTV footage.
Source: Regulation (EU) 2024/1689, Article 5(1)(e). Retrieved 2026-08-26.
Tarjeta 105
Pregunta
What must an importer do if it suspects high-risk non-conformity?
Respuesta
Answer. If the system is non-conforming, falsified, or accompanied by falsified documentation, the importer must not place it on the market until conformity is restored. Separately, if the system presents an Article 79(1) risk, the importer must inform the provider, authorised representative, and market-surveillance authorities.
Source: Regulation (EU) 2024/1689, Article 23(2). Retrieved 2026-08-26.
Tarjeta 106
Pregunta
What serious incidents must systemic-risk GPAI providers report?
Respuesta
Answer. Relevant serious incidents and possible corrective measures must be tracked, documented, and reported without undue delay to the AI Office and, where appropriate, national competent authorities.
Source: Regulation (EU) 2024/1689, Article 55(1)(c). Retrieved 2026-08-26.
Tarjeta 107
Pregunta
Does authorised law-enforcement use remove machine-marking duties?
Respuesta
Answer. Article 50(2) does not require synthetic-content marking where the AI system is authorised by law to detect, prevent, investigate, or prosecute criminal offences. The authorising law and its conditions still control the use.
Source: Regulation (EU) 2024/1689, Article 50(2). Retrieved 2026-08-26.
Tarjeta 108
Pregunta
What storage and transport duties apply to high-risk importers?
Respuesta
Answer. While responsible for the system, an importer must ensure storage and transport conditions do not jeopardise compliance with high-risk-system requirements.
Source: Regulation (EU) 2024/1689, Article 23(4). Retrieved 2026-08-26.
Tarjeta 109
Pregunta
What does 2 August 2028 mark, and which Article 111 transitions come later?
Respuesta
Answer. It is the selected main application milestone for Chapter III, Sections 1–3 for Article 6(1) high-risk systems tied to Annex I Section A products. It is not the Act’s last operative transition. Article 111 requires providers and deployers of high-risk systems intended to be used by public authorities to comply by 2 August 2030. It also requires AI systems that are components of large-scale IT systems established by the legal acts in Annex X, if placed on the market or put into service before 2 August 2027, to comply by 31 December 2030. Annex I Section B systems remain under Article 2(2)’s limited regime, not the full Chapter III regime.
Sources: Regulation (EU) 2024/1689, Articles 2(2), 111 and 113 and European Commission implementation timeline. Retrieved 2026-08-26.
Tarjeta 110
Pregunta
Is workplace or school emotion inference allowed?
Respuesta
Answer. Generally no. Inferring emotions of natural persons in workplaces or educational institutions is prohibited, except where use is intended for medical or safety reasons.
Source: Regulation (EU) 2024/1689, Article 5(1)(f). Retrieved 2026-08-26.
Tarjeta 111
Pregunta
How long must a high-risk importer keep conformity records?
Respuesta
Answer. For ten years after the system is placed on the market or put into service, the importer must keep a copy of the relevant certificate, where applicable, the instructions, and the EU declaration of conformity.
Source: Regulation (EU) 2024/1689, Article 23(5). Retrieved 2026-08-26.
Tarjeta 112
Pregunta
What cybersecurity duty applies to systemic-risk GPAI models?
Respuesta
Answer. Providers must ensure an adequate level of cybersecurity protection for the model and its physical infrastructure, proportionate to systemic risk and the state of the art.
Source: Regulation (EU) 2024/1689, Article 55(1)(d). Retrieved 2026-08-26.
Tarjeta 113
Pregunta
Is there a law-enforcement exception to deepfake disclosure?
Respuesta
Answer. Yes, for use authorised by law to detect, prevent, investigate, or prosecute criminal offences, with the relevant legal safeguards. The exception should not be generalized to ordinary public communications.
Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.
Tarjeta 114
Pregunta
What must a distributor do if a high-risk system seems non-compliant?
Respuesta
Answer. Withhold it from the market until conformity is restored. Separately, if the system presents an Article 79(1) risk, inform the provider or importer. Article 24(2) does not add an authority-notification duty at this pre-market stage.
Source: Regulation (EU) 2024/1689, Article 24(2). Retrieved 2026-08-26.
Tarjeta 115
Pregunta
What must be rechecked before relying on an AI Act date?
Respuesta
Answer. The current consolidated regulation, any amending regulation, and the Commission implementation timeline. A date in an older course or card set may have been superseded.
Source: European Commission AI Act FAQ. Retrieved 2026-08-26.
Tarjeta 116
Pregunta
Which biometric categorisation is prohibited?
Respuesta
Answer. Biometric categorisation that individually categorises people to deduce or infer race, political opinions, trade-union membership, religious or philosophical beliefs, sex life, or sexual orientation, subject to narrow dataset and law-enforcement carve-outs.
Source: Regulation (EU) 2024/1689, Article 5(1)(g). Retrieved 2026-08-26.
Tarjeta 117
Pregunta
What must a distributor do after a high-risk system is already available?
Respuesta
Answer. If it becomes non-compliant, take or ensure the corrective action needed to bring it into conformity, withdraw it, or recall it. Separately, if the system presents an Article 79(1) risk, immediately inform the provider or importer and competent authorities, with details of the non-compliance and corrective action.
Source: Regulation (EU) 2024/1689, Article 24(4). Retrieved 2026-08-26.
Tarjeta 118
Pregunta
Can a GPAI code of practice demonstrate compliance?
Respuesta
Answer. Yes. Until harmonised standards are available, providers may rely on approved codes of practice to demonstrate compliance. A provider choosing another route must show alternative adequate means of compliance.
Source: Regulation (EU) 2024/1689, Article 56. Retrieved 2026-08-26.
Tarjeta 119
Pregunta
Does Article 50 replace other transparency law?
Respuesta
Answer. No. Article 50 adds AI-specific duties without displacing stricter or overlapping obligations under consumer, media, electoral, platform, accessibility, privacy, or other applicable law.
Source: European Commission Article 50 guidelines. Retrieved 2026-08-26.
Tarjeta 120
Pregunta
What storage and transport duties apply to high-risk distributors?
Respuesta
Answer. While responsible for the system, a distributor must ensure storage and transport conditions do not jeopardise compliance with high-risk-system requirements.
Source: Regulation (EU) 2024/1689, Article 24(3). Retrieved 2026-08-26.
Tarjeta 121
Pregunta
When is an Annex I product-linked AI system high-risk?
Respuesta
Answer. Only when the Article 6(1) gateway remains satisfied after paragraphs 1a–1c: the AI is a safety component of an Annex I product, is itself such a product, or its failure or malfunction would endanger health and safety; and the product must undergo third-party conformity assessment before market placement or service. AI used solely for non-safety assistance, optimisation, efficiency, automation, convenience, or quality control is not a safety component unless its failure or malfunction would endanger health or safety. An assessment required solely for non-health-and-safety risks does not satisfy the second condition.
Source: Regulation (EU) 2024/1689, Article 6(1)–(1c). Retrieved 2026-08-26.
Tarjeta 122
Pregunta
How must high-risk distributors cooperate with authorities?
Respuesta
Answer. They must provide relevant information and documentation on a reasoned request and cooperate in actions concerning the high-risk system, including measures to reduce or mitigate risks.
Source: Regulation (EU) 2024/1689, Article 24(5)–(6). Retrieved 2026-08-26.
Tarjeta 123
Pregunta
Are the Commission’s Article 50 guidelines legally binding?
Respuesta
Answer. No. They are practical interpretive guidance. The AI Act’s text is binding, and authoritative interpretation belongs to competent authorities and ultimately the Court of Justice of the European Union.
Source: European Commission Article 50 guidelines. Retrieved 2026-08-26.
Tarjeta 124
Pregunta
What input-data duty applies to high-risk deployers?
Respuesta
Answer. When a deployer controls input data, it must ensure that the input is relevant and sufficiently representative for the system’s intended purpose.
Source: Regulation (EU) 2024/1689, Article 26(4). Retrieved 2026-08-26.
Tarjeta 125
Pregunta
Which non-consensual intimate deepfake practice is prohibited?
Respuesta
Answer. For providers, placing the system on the market or putting it into service is prohibited only if generating or manipulating the covered realistic intimate or sexually explicit material of an identifiable person without freely given, specific, informed, unambiguous, and explicit consent is intended, or is reasonably foreseeable and reproducible without significant technical modification and reasonable, adequate safeguards are absent. For deployers, use is prohibited only when they use the system for that purpose. The rule applies from 2 December 2026; manipulation counts only if it increases intimate-part exposure or alters the nature of the sexually explicit activity.
Source: Regulation (EU) 2026/1744, Article 1 (AI Act Article 5(1)(ba) and 5(1a)–(1b)). Retrieved 2026-08-26.
Tarjeta 126
Pregunta
How must a high-risk deployer use the system?
Respuesta
Answer. According to the accompanying instructions, while assigning human oversight to natural persons with the necessary competence, training, authority, and support.
Source: Regulation (EU) 2024/1689, Article 26(1)–(2). Retrieved 2026-08-26.
Tarjeta 127
Pregunta
What is the safest Article 50 disclosure design?
Respuesta
Answer. Put a clear, distinguishable, accessible notice at the first interaction or exposure, close to the relevant AI experience or content, while also meeting any machine-marking duty. Exact design remains context-specific.
Source: European Commission Article 50 FAQ. Retrieved 2026-08-26.
Tarjeta 128
Pregunta
Who must complete a fundamental-rights impact assessment?
Respuesta
Answer. Before first use, deployers that are public bodies, private entities providing public services, and deployers of specified Annex III creditworthiness and life or health-insurance systems, subject to Article 27’s exact scope and exceptions.
Source: Regulation (EU) 2024/1689, Article 27. Retrieved 2026-08-26.
Tarjeta 129
Pregunta
How does Annex III create high-risk status?
Respuesta
Answer. Article 6(2) classifies systems in Annex III’s listed use cases as high-risk, unless Article 6(3)’s limited no-significant-risk conditions apply. A use-case label alone is not the full analysis.
Source: Regulation (EU) 2024/1689, Article 6(2)–(3) and Annex III. Retrieved 2026-08-26.
Tarjeta 130
Pregunta
What must a deployer do when high-risk use may create a risk?
Respuesta
Answer. If use in accordance with the instructions may present an Article 79(1) risk, the deployer must, without undue delay, inform the provider or distributor and the relevant market-surveillance authority, and suspend use. A serious incident triggers a separate immediate chain: inform the provider first, then the importer or distributor and the relevant market-surveillance authorities; if the provider cannot be reached, Article 73 applies mutatis mutandis.
Source: Regulation (EU) 2024/1689, Article 26(5). Retrieved 2026-08-26.
Tarjeta 131
Pregunta
Can a high-risk FRIA reuse a data-protection impact assessment?
Respuesta
Answer. Yes. If a DPIA already addresses relevant elements, the deployer should complement it with the additional Article 27 information rather than duplicate the work.
Source: Regulation (EU) 2024/1689, Article 27(4). Retrieved 2026-08-26.
Tarjeta 132
Pregunta
When may law enforcement use real-time remote biometric identification in public?
Respuesta
Answer. Only for narrow listed objectives and under strict necessity, proportionality, temporal, geographic, and personal limits, generally with prior judicial or independent administrative authorisation. The default rule is prohibition.
Source: Regulation (EU) 2024/1689, Article 5(1)(h) and 5(2)–(7). Retrieved 2026-08-26.
Tarjeta 133
Pregunta
How long must a high-risk deployer keep logs under its control?
Respuesta
Answer. For a period appropriate to the intended purpose and generally at least six months, unless applicable EU or national law provides otherwise, particularly on personal-data protection.
Source: Regulation (EU) 2024/1689, Article 26(6). Retrieved 2026-08-26.
Tarjeta 134
Pregunta
What conformity steps precede high-risk market placement?
Respuesta
Answer. The provider must complete the applicable conformity assessment, draw up the EU declaration of conformity, affix CE marking, and register the system where required before placement or service. The exact route depends on the system.
Source: Regulation (EU) 2024/1689, Articles 43, 47–49. Retrieved 2026-08-26.
Tarjeta 135
Pregunta
When can an Annex III system be treated as not high-risk?
Respuesta
Answer. Only when both parts of Article 6(3) are met: it poses no significant risk of harm to health, safety, or fundamental rights—including, for example, by not materially influencing decision-making—and it satisfies at least one listed task condition: a narrow procedural task; improvement of the result of a previously completed human activity; detection of decision-making patterns or deviations without being meant to replace or influence the previously completed human assessment without proper human review; or a preparatory task for an Annex III assessment. Profiling systems remain high-risk, and the provider must document the assessment.
Source: Regulation (EU) 2024/1689, Article 6(3)–(4). Retrieved 2026-08-26.
Tarjeta 136
Pregunta
When must workers be told about workplace high-risk AI?
Respuesta
Answer. Before putting the system into service or using it at work, the deployer that is an employer must inform worker representatives and affected workers that they will be subject to the system, following applicable information rules.
Source: Regulation (EU) 2024/1689, Article 26(7). Retrieved 2026-08-26.
Tarjeta 137
Pregunta
What ongoing monitoring must high-risk providers run?
Respuesta
Answer. A documented post-market monitoring system proportionate to the technology and risks, actively collecting and analysing performance data throughout the system’s lifetime to evaluate continuous compliance.
Source: Regulation (EU) 2024/1689, Article 72. Retrieved 2026-08-26.
Tarjeta 138
Pregunta
Which child-sexual-abuse AI practice is prohibited from 2 December 2026?
Respuesta
Answer. From 2 December 2026, providers may not place the system on the market or put it into service if generating or manipulating the covered child-sexual-abuse material or performances is intended, or is reasonably foreseeable and reproducible without significant technical modification and reasonable, adequate safeguards are absent. Deployers are prohibited only when they use the system for that purpose. A ‘without right’ defence under national law remains possible.
Source: Regulation (EU) 2026/1744, Article 1 (AI Act Article 5(1)(bb) and 5(1a)). Retrieved 2026-08-26.
Tarjeta 139
Pregunta
Who must be told when high-risk AI informs a decision about them?
Respuesta
Answer. The deployer must inform the affected natural person that the relevant Annex III high-risk system is being used, where Article 26’s notice condition applies. Other explanation and data-protection rights may also be relevant.
Source: Regulation (EU) 2024/1689, Article 26(11). Retrieved 2026-08-26.
Tarjeta 140
Pregunta
Does Article 6(3) ever exclude profiling systems from high-risk status?
Respuesta
Answer. No. An Annex III system that performs profiling of natural persons is always considered high-risk, even if another Article 6(3) task description might appear narrow.
Source: Regulation (EU) 2024/1689, Article 6(3). Retrieved 2026-08-26.
140 tarjetas
EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules
Flashcards se abrirá para que puedas empezar a estudiar.