EU AI Act

Prohibited AI Practices

Banned from August 2025: social scoring by public authorities, real-time remote biometric identification in public (with exceptions), manipulation exploiting vulnerabilities, subliminal techniques.

High-Risk AI Classification (Annex III)

AI systems in: biometric identification, critical infrastructure, education (grading), employment (CV screening, promotion), essential services (credit, insurance), law enforcement, migration, justice.

High-Risk Obligations — Risk Management System

Implement an ongoing AI risk management system covering the full AI lifecycle — risk identification, evaluation, mitigation, and residual risk documentation.

High-Risk Obligations — Data Governance

Training, validation, and testing datasets must meet quality criteria — relevance, representativeness, completeness, and absence of errors and biases.

High-Risk Obligations — Technical Documentation

Maintain comprehensive technical documentation covering AI system design, development process, testing, capabilities, limitations, and conformity assessment evidence.

High-Risk Obligations — Transparency & Instructions

Provide clear instructions for use, including system capabilities, limitations, performance metrics across demographic groups, and human oversight requirements.

High-Risk Obligations — Human Oversight

Design AI systems to allow human oversight — ability to monitor, intervene, interrupt, and override AI-generated decisions in High-Risk contexts.

GPAI Model Obligations (Providers)

GPAI model providers (LLM/foundation model): technical documentation, copyright compliance policy, training data summary. Systemic risk models: adversarial testing, incident reporting, cybersecurity measures.