EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules
A 140-card, source-linked review of the amended EU AI Act timeline, roles, risk structure, GPAI, transparency, high-risk duties, and enforcement.
Tentang dek ini
EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules
Build reliable recall of the amended EU AI Act with 140 focused, source-linked cards. The deck covers implementation dates, scope and exclusions, prohibited practices, provider and deployer roles, GPAI, Article 50 transparency, high-risk duties, governance, and penalty ceilings.
What you will practise
- Separate entry into force, general applicability, and later high-risk dates.
- Distinguish providers, deployers, importers, distributors, authorised representatives, and affected persons.
- Recall the risk gateways, prohibited practices, GPAI duties, and Article 50 disclosure rules.
- Recognise when a fact needs a fresh official-source check or fact-specific legal analysis.
Recall map and exclusions
The deck practises milestone → date and selected date → milestone recall, term or role → definition or duty, and rule or fact pattern → legal status, exception, or consequence. Composite prompts are limited to tests whose parts work together, including the Article 6 high-risk gateways and the role-specific triggers for the two 2026 prohibitions. Mechanical reversals of every definition, citation, exception, penalty ceiling, and multi-answer duty list are excluded because they would duplicate existing prompts or allow several correct answers.
Freshness
Official sources were checked on 26 August 2026. The deck incorporates Regulation (EU) 2026/1744 and the amended implementation timeline. Every card links to an official EU source and carries its retrieval date. Recheck EUR-Lex and the Commission timeline for later changes.
Important boundary
This deck is educational material, not legal advice. It does not classify any real AI system, decide whether an exception applies, or resolve a fact-specific compliance question. Consult qualified counsel and the competent authority for an actual system.
Sources and method
The primary source is the 27 July 2026 consolidated text of Regulation (EU) 2024/1689, read with Regulation (EU) 2026/1744. Commission timeline, FAQ, regulatory-framework, enforcement, GPAI, prohibited-practice, and Article 50 pages provide current implementation context. Commission guidance is useful but non-binding; courts and competent authorities give authoritative interpretations.
Cards use one root tag, EU AI Act, plus one learning group. The final order rotates across groups so related rules and exceptions are separated for stronger retrieval practice.
Independent study aid
This independently authored deck is unofficial. It is not affiliated with, endorsed by, or official material from the European Union, the European Commission, or any other EU institution.
Kad dalam dek ini
Kad 1
Soalan
When did the EU AI Act enter into force?
Jawapan
Answer. 1 August 2024, twenty days after publication in the Official Journal. Most duties did not apply immediately; the Act uses a phased timetable.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Kad 2
Soalan
When can the EU AI Act apply to a provider outside the EU?
Jawapan
Answer. When the provider places an AI system or GPAI model on the EU market, puts an AI system into service in the EU, or when the output of its AI system is used in the EU. The exact facts still matter.
Source: Regulation (EU) 2024/1689, Article 2. Retrieved 2026-08-26.
Kad 3
Soalan
Who is a provider under the EU AI Act?
Jawapan
Answer. A person, public authority, agency, or other body that develops an AI system or GPAI model, or has one developed, and places it on the market or puts the system into service under its own name or trademark, whether paid or free.
Source: Regulation (EU) 2024/1689, Article 3(3). Retrieved 2026-08-26.
Kad 4
Soalan
What is a general-purpose AI model?
Jawapan
Answer. An AI model with significant generality that can competently perform a wide range of distinct tasks and can be integrated into many downstream systems or applications. Models used only for research, development, or prototyping before market placement are excluded from this definition.
Source: Regulation (EU) 2024/1689, Article 3(63). Retrieved 2026-08-26.
Kad 5
Soalan
When must people be told they are interacting with AI?
Jawapan
Answer. Providers must design direct-interaction AI systems so people are informed that they are interacting with AI, unless this is obvious to a reasonably well-informed, observant, and circumspect person in the circumstances.
Source: Regulation (EU) 2024/1689, Article 50(1). Retrieved 2026-08-26.
Kad 6
Soalan
What is the core purpose of high-risk AI risk management?
Jawapan
Answer. To establish a continuous, iterative lifecycle process that identifies, analyses, evaluates, and treats known and reasonably foreseeable risks to health, safety, and fundamental rights, then tests whether controls work.
Source: Regulation (EU) 2024/1689, Article 9. Retrieved 2026-08-26.
Kad 7
Soalan
Who enforces most EU AI Act rules?
Jawapan
Answer. National competent authorities, including market-surveillance authorities, enforce most AI-system rules in Member States. The Commission’s AI Office has central responsibilities, especially for GPAI.
Source: European Commission enforcement framework. Retrieved 2026-08-26.
Kad 8
Soalan
Which EU AI Act rules began applying on 2 February 2025?
Jawapan
Answer. The AI-system definition and scope-related provisions, AI-literacy duty, and most original prohibited-practice rules began applying on 2 February 2025.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Kad 9
Soalan
Does the EU AI Act apply to an EU-based deployer?
Jawapan
Answer. Yes. The Act applies to deployers that have their place of establishment or are located in the EU, subject to the Act’s specific exclusions and transitions.
Source: Regulation (EU) 2024/1689, Article 2(1)(b). Retrieved 2026-08-26.
Kad 10
Soalan
Who is a deployer under the EU AI Act?
Jawapan
Answer. A person, public authority, agency, or other body using an AI system under its authority, except where the system is used in a personal, non-professional activity.
Source: Regulation (EU) 2024/1689, Article 3(4). Retrieved 2026-08-26.
Kad 11
Soalan
Which baseline duties apply to all GPAI-model providers?
Jawapan
Answer. Keep technical documentation current, give downstream providers information needed for integration and compliance, maintain an EU-copyright-compliance policy, publish a sufficiently detailed training-content summary, and cooperate with authorities.
Source: Regulation (EU) 2024/1689, Article 53. Retrieved 2026-08-26.
Kad 12
Soalan
Who must machine-mark AI-generated content under Article 50?
Jawapan
Answer. Providers of AI systems that generate synthetic audio, image, video, or text content must ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated.
Source: Regulation (EU) 2024/1689, Article 50(2). Retrieved 2026-08-26.
Kad 13
Soalan
What data quality does Article 10 require for high-risk AI?
Jawapan
Answer. Training, validation, and testing datasets must be governed appropriately and, for their intended purpose, be relevant, sufficiently representative, and as far as possible free of errors and complete, with suitable statistical properties.
Source: Regulation (EU) 2024/1689, Article 10. Retrieved 2026-08-26.
Kad 14
Soalan
What is the European AI Office’s main EU AI Act role?
Jawapan
Answer. It supports implementation and enforcement at EU level, including central supervision of GPAI obligations and coordination, guidance, evaluations, and investigations within its legal remit.
Source: European Commission enforcement framework. Retrieved 2026-08-26.
Kad 15
Soalan
Which EU AI Act rules began applying on 2 August 2025?
Jawapan
Answer. The GPAI obligations and much of the governance framework began applying on 2 August 2025, alongside Member State penalty-notification and authority-designation steps.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Kad 16
Soalan
When can EU output-use bring a non-EU actor into scope?
Jawapan
Answer. When a provider or deployer is outside the EU but the output produced by its AI system is used in the EU. This is a territorial hook, not an automatic conclusion about every remote service.
Source: Regulation (EU) 2024/1689, Article 2(1)(c). Retrieved 2026-08-26.
Kad 17
Soalan
Who is an importer under the EU AI Act?
Jawapan
Answer. An EU-located or EU-established person that places on the market an AI system bearing the name or trademark of a person established outside the EU.
Source: Regulation (EU) 2024/1689, Article 3(6). Retrieved 2026-08-26.
Kad 18
Soalan
When is a GPAI model presumed to have systemic risk?
Jawapan
Answer. When cumulative training compute exceeds 10^25 floating-point operations, the model is presumed to have high-impact capabilities and therefore systemic risk, unless the legal classification is successfully rebutted.
Source: Regulation (EU) 2024/1689, Articles 51–52. Retrieved 2026-08-26.
Kad 19
Soalan
How strong must Article 50 machine marking be?
Jawapan
Answer. The technical solution must be effective, interoperable, robust, and reliable as far as technically feasible, considering the content’s nature, implementation costs, and generally acknowledged state of the art.
Source: Regulation (EU) 2024/1689, Article 50(2). Retrieved 2026-08-26.
Kad 20
Soalan
When must high-risk technical documentation exist?
Jawapan
Answer. It must be drawn up before the high-risk system is placed on the market or put into service and kept up to date throughout the relevant lifecycle.
Source: Regulation (EU) 2024/1689, Article 11. Retrieved 2026-08-26.
Kad 21
Soalan
What does the European AI Board do?
Jawapan
Answer. It advises and assists the Commission and Member States to support consistent and effective application of the Act, including coordination among national authorities and sharing technical and regulatory expertise.
Source: Regulation (EU) 2024/1689, Articles 65–66. Retrieved 2026-08-26.
Kad 22
Soalan
What was the EU AI Act’s general applicability date?
Jawapan
Answer. 2 August 2026. Important exceptions and later dates remain, especially for certain prohibitions, high-risk categories, and legacy GPAI models.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Kad 23
Soalan
Which national-security activity is outside the EU AI Act?
Jawapan
Answer. The Act does not apply to areas outside EU law and does not affect Member State competences concerning national security, regardless of the entity carrying out the national-security tasks.
Source: Regulation (EU) 2024/1689, Article 2(3). Retrieved 2026-08-26.
Kad 24
Soalan
Who is a distributor under the EU AI Act?
Jawapan
Answer. A supply-chain person, other than the provider or importer, that makes an AI system available on the EU market.
Source: Regulation (EU) 2024/1689, Article 3(7). Retrieved 2026-08-26.
Kad 25
Soalan
Can the Commission classify a GPAI model as systemic risk below 10^25 FLOPs?
Jawapan
Answer. Yes. The Commission may designate a model when it has high-impact capabilities evaluated through appropriate technical tools and criteria, even without crossing the compute presumption.
Source: Regulation (EU) 2024/1689, Article 51. Retrieved 2026-08-26.
Kad 26
Soalan
Who must disclose AI-generated deepfakes?
Jawapan
Answer. Deployers of AI systems that generate or manipulate image, audio, or video content constituting a deepfake must disclose that the content was artificially generated or manipulated.
Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.
Kad 27
Soalan
What logging capability must a high-risk AI system have?
Jawapan
Answer. It must technically allow automatic recording of events over its lifetime to support traceability, monitoring, post-market work, and investigation appropriate to the system’s purpose.
Source: Regulation (EU) 2024/1689, Article 12. Retrieved 2026-08-26.
Kad 28
Soalan
What is the Scientific Panel’s governance role?
Jawapan
Answer. The independent Scientific Panel supports enforcement with technical expertise, including alerts and advice on GPAI models, systemic risks, evaluations, and other technically complex matters.
Source: Regulation (EU) 2024/1689, Articles 68 and 90. Retrieved 2026-08-26.
Kad 29
Soalan
What did Regulation (EU) 2026/1744 do to the AI Act timetable?
Jawapan
Answer. It amended Regulation (EU) 2024/1689, including deferred dates for Annex III and Annex I high-risk obligations and targeted Article 50 and prohibited-practice transitions.
Source: Regulation (EU) 2026/1744. Retrieved 2026-08-26.
Kad 30
Soalan
Are exclusively military or defence AI systems covered?
Jawapan
Answer. No. The Act excludes AI systems placed on the market, put into service, or used exclusively for military, defence, or national-security purposes, regardless of the actor. Mixed or changed uses need separate analysis.
Source: Regulation (EU) 2024/1689, Article 2(3). Retrieved 2026-08-26.
Kad 31
Soalan
Who is an authorised representative under the EU AI Act?
Jawapan
Answer. An EU-located or EU-established person that receives and accepts a written mandate from a provider to perform specified obligations and procedures on the provider’s behalf.
Source: Regulation (EU) 2024/1689, Article 3(5). Retrieved 2026-08-26.
Kad 32
Soalan
When must a GPAI provider notify the Commission of a systemic-risk threshold?
Jawapan
Answer. Without delay and, in any event, within two weeks after the provider knows or has reasonable grounds to believe the model meets the systemic-risk condition.
Source: Regulation (EU) 2024/1689, Article 52(1). Retrieved 2026-08-26.
Kad 33
Soalan
How does Article 50 treat artistic deepfakes?
Jawapan
Answer. For evidently artistic, creative, satirical, fictional, or analogous works, disclosure may be made in an appropriate way that does not hamper display or enjoyment of the work. The disclosure duty still exists.
Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.
Kad 34
Soalan
What information must accompany a high-risk AI system?
Jawapan
Answer. Concise, complete, correct, and clear instructions for use with the provider’s identity, capabilities and limits, intended purpose, performance, risks, human-oversight measures, input-data specifications, logging, maintenance, and other legally required details.
Source: Regulation (EU) 2024/1689, Article 13. Retrieved 2026-08-26.
Kad 35
Soalan
What is the Advisory Forum’s role?
Jawapan
Answer. It supplies stakeholder expertise and advice to the AI Board and Commission through a balanced group representing industry, startups, civil society, academia, and other affected interests.
Source: Regulation (EU) 2024/1689, Article 67. Retrieved 2026-08-26.
Kad 36
Soalan
When did Regulation (EU) 2026/1744 enter into force?
Jawapan
Answer. 27 July 2026. The amendment changed the then-current consolidated AI Act and must be considered when studying implementation dates.
Source: Regulation (EU) 2026/1744, Article 4. Retrieved 2026-08-26.
Kad 37
Soalan
Is pure scientific research and development covered?
Jawapan
Answer. The Act does not apply to AI systems or models, including outputs, specifically developed and put into service for the sole purpose of scientific research and development. Other uses need separate analysis.
Source: Regulation (EU) 2024/1689, Article 2(6). Retrieved 2026-08-26.
Kad 38
Soalan
Which actors count as operators under the EU AI Act?
Jawapan
Answer. Providers, product manufacturers, deployers, authorised representatives, importers, and distributors. “Operator” is the Act’s umbrella term for these value-chain roles.
Source: Regulation (EU) 2024/1689, Article 3(8). Retrieved 2026-08-26.
Kad 39
Soalan
Can a GPAI provider challenge the systemic-risk presumption?
Jawapan
Answer. Yes. With the threshold notification, the provider may present sufficiently substantiated arguments that the model exceptionally does not present systemic risks despite meeting the compute presumption. The Commission decides.
Source: Regulation (EU) 2024/1689, Article 52(2). Retrieved 2026-08-26.
Kad 40
Soalan
When must AI-generated public-interest text be disclosed?
Jawapan
Answer. A deployer must disclose artificial generation or manipulation when publishing AI-generated or manipulated text to inform the public on matters of public interest, unless a stated exception applies.
Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.
Kad 41
Soalan
What must human oversight enable for high-risk AI?
Jawapan
Answer. Effective oversight by competent people who can understand capabilities and limits, detect anomalies and automation bias, interpret outputs, decide not to use or override them, and safely interrupt the system where appropriate.
Source: Regulation (EU) 2024/1689, Article 14. Retrieved 2026-08-26.
Kad 42
Soalan
Can a person complain about an alleged AI Act infringement?
Jawapan
Answer. Yes. Any natural or legal person with grounds to consider that the Act was infringed may lodge a complaint with the relevant market-surveillance authority, without prejudice to other remedies.
Source: Regulation (EU) 2024/1689, Article 85. Retrieved 2026-08-26.
Kad 43
Soalan
When do the two new 2026 prohibited practices begin applying?
Jawapan
Answer. 2 December 2026. They concern specified non-consensual intimate or sexually explicit deepfakes and specified child-sexual-abuse material or performances.
Source: Regulation (EU) 2026/1744, Article 1 and transition provisions. Retrieved 2026-08-26.
Kad 44
Soalan
Is pre-market AI research, testing, or development covered?
Jawapan
Answer. Generally no, before placement on the market or putting into service, if the activity respects applicable EU law. Testing in real-world conditions is not part of this exclusion.
Source: Regulation (EU) 2024/1689, Article 2(8). Retrieved 2026-08-26.
Kad 45
Soalan
Is an affected person an operator?
Jawapan
Answer. No. “Operator” covers specified supply-chain and use roles. An affected person is someone in the EU affected by an AI system and may hold rights such as complaint or explanation rights where their conditions are met.
Source: Regulation (EU) 2024/1689, Articles 2, 3(8), 85–86. Retrieved 2026-08-26.
Kad 46
Soalan
What must GPAI technical documentation cover?
Jawapan
Answer. The model’s development, training, testing, evaluation, architecture, design specifications, capabilities, limitations, and other information required by Annex XI, kept current and available to the AI Office and national authorities on request.
Source: Regulation (EU) 2024/1689, Article 53(1)(a) and Annex XI. Retrieved 2026-08-26.
Kad 47
Soalan
What is the public-interest text disclosure exception for human review?
Jawapan
Answer. Disclosure is not required when the AI-generated content underwent human review or editorial control and a natural or legal person holds editorial responsibility for publication.
Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.
Kad 48
Soalan
Which performance qualities must high-risk AI maintain?
Jawapan
Answer. An appropriate level of accuracy, robustness, and cybersecurity throughout the lifecycle, consistent with the system’s intended purpose and the acknowledged state of the art.
Source: Regulation (EU) 2024/1689, Article 15. Retrieved 2026-08-26.
Kad 49
Soalan
When does Article 86 give an explanation right?
Jawapan
Answer. When a deployer takes a decision about an affected person on the basis of output from an Annex III high-risk system, except point 2 systems, and the decision produces legal effects or similarly significantly affects that person in a way they consider adverse to their health, safety, or fundamental rights, subject to the Article’s conditions and exceptions.
Source: Regulation (EU) 2024/1689, Article 86. Retrieved 2026-08-26.
Kad 50
Soalan
What is the Article 50 transition for older synthetic-content systems?
Jawapan
Answer. A system placed on the market before 2 August 2026 that generates or manipulates synthetic content has until 2 December 2026 to comply with Article 50(2)’s machine-readable marking duty.
Source: Regulation (EU) 2026/1744, Article 1 transition amendment. Retrieved 2026-08-26.
Kad 51
Soalan
Does personal non-professional AI use fall under deployer duties?
Jawapan
Answer. No. A natural person using AI in a purely personal, non-professional activity is excluded from the deployer definition and the Act does not apply to that use. Other applicable law can still matter.
Source: Regulation (EU) 2024/1689, Articles 2(10) and 3(4). Retrieved 2026-08-26.
Kad 52
Soalan
When does a downstream actor become the provider of an AI system?
Jawapan
Answer. If it places its name or trademark on a high-risk system, makes a substantial modification, or changes the intended purpose so a previously non-high-risk system becomes high-risk.
Source: Regulation (EU) 2024/1689, Article 25. Retrieved 2026-08-26.
Kad 53
Soalan
What must GPAI providers tell downstream system providers?
Jawapan
Answer. They must provide and maintain information and documentation enabling downstream providers to understand the model’s capabilities and limitations and comply with the Act, without disclosing protected intellectual property unnecessarily.
Source: Regulation (EU) 2024/1689, Article 53(1)(b) and Annex XII. Retrieved 2026-08-26.
Kad 54
Soalan
Who must be informed about emotion-recognition use?
Jawapan
Answer. Deployers of emotion-recognition systems must inform the natural persons exposed to the system and process personal data consistently with EU data-protection law.
Source: Regulation (EU) 2024/1689, Article 50(3). Retrieved 2026-08-26.
Kad 55
Soalan
What is a high-risk provider’s basic compliance duty?
Jawapan
Answer. Ensure the system complies with the Chapter III Section 2 requirements, identify itself, operate quality and documentation controls, complete conformity steps, register where required, take corrective action, and cooperate with authorities.
Source: Regulation (EU) 2024/1689, Article 16. Retrieved 2026-08-26.
Kad 56
Soalan
What must an Article 86 explanation contain?
Jawapan
Answer. Clear and meaningful explanations of the AI system’s role in the decision-making procedure and the main elements of the decision taken. It is not a general right to source code or every model detail.
Source: Regulation (EU) 2024/1689, Article 86. Retrieved 2026-08-26.
Kad 57
Soalan
When do Annex III high-risk duties begin applying after the 2026 amendment?
Jawapan
Answer. 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, subject to the Act’s detailed transitions and any applicable exceptions.
Source: Regulation (EU) 2026/1744. Retrieved 2026-08-26.
Kad 58
Soalan
Does open-source release create a blanket EU AI Act exemption?
Jawapan
Answer. No. The free-and-open-source exception does not cover systems placed on the market or put into service as high-risk systems or systems falling under Article 5 or Article 50. Other conditions also matter.
Source: Regulation (EU) 2024/1689, Article 2(12). Retrieved 2026-08-26.
Kad 59
Soalan
What happens to the original provider after a downstream actor becomes provider?
Jawapan
Answer. For that specific system, the original provider is no longer treated as provider under Article 25, but must cooperate and supply reasonably expected technical access and information unless it clearly prohibited the conversion into a high-risk system.
Source: Regulation (EU) 2024/1689, Article 25. Retrieved 2026-08-26.
Kad 60
Soalan
What copyright policy must a GPAI provider maintain?
Jawapan
Answer. A policy to comply with EU copyright and related-rights law, including identifying and respecting rights reservations expressed under Article 4(3) of the Digital Single Market Copyright Directive.
Source: Regulation (EU) 2024/1689, Article 53(1)(c). Retrieved 2026-08-26.
Kad 61
Soalan
Who must be informed about biometric-categorisation use?
Jawapan
Answer. Deployers of biometric-categorisation systems must inform the natural persons exposed to the system and process personal data under applicable EU data-protection rules. Article 5 separately prohibits certain sensitive-trait categorisation.
Source: Regulation (EU) 2024/1689, Article 50(3). Retrieved 2026-08-26.
Kad 62
Soalan
What must a high-risk provider’s quality-management system cover?
Jawapan
Answer. A documented, proportionate system covering compliance strategy, design and development, testing, data, technical specifications, verification, records, accountability, post-market monitoring, incident reporting, communications, and continuous improvement.
Source: Regulation (EU) 2024/1689, Article 17. Retrieved 2026-08-26.
Kad 63
Soalan
What is the top fine tier for prohibited AI practices?
Jawapan
Answer. Up to €35 million or, for undertakings, up to 7% of total worldwide annual turnover for the preceding financial year, whichever is higher, subject to the Act’s penalty rules and case-specific assessment.
Source: Regulation (EU) 2024/1689, Article 99(3). Retrieved 2026-08-26.
Kad 64
Soalan
How do the AI Act’s application rules differ for Annex I Section A and Section B high-risk systems?
Jawapan
Answer. Section A systems enter the Chapter III, Sections 1–3 regime on 2 August 2028. Section B systems do not take on that full regime: Article 2(2) limits the AI Act to Articles 6(1), 60a, and 102–112, with Articles 57–59 applying only when high-risk requirements are integrated into the relevant sectoral law. Articles 102–110 have applied since 27 July 2026.
Source: Regulation (EU) 2024/1689, Articles 2(2) and 113. Retrieved 2026-08-26.
Kad 65
Soalan
Does the EU AI Act replace privacy law?
Jawapan
Answer. No. EU data-protection, privacy, communications-confidentiality, and consumer-protection law continue to apply. AI Act compliance does not by itself establish compliance with those rules.
Source: Regulation (EU) 2024/1689, Article 2 and recitals. Retrieved 2026-08-26.
Kad 66
Soalan
When is a product manufacturer treated as an AI-system provider?
Jawapan
Answer. For a high-risk AI system that is a safety component of a product covered by Section A of Annex I, the product manufacturer becomes the provider and takes on Article 16 duties if either: (1) the system is placed on the market together with the product under the manufacturer’s name or trademark; or (2) the system is put into service under that name or trademark after the product has already been placed on the market.
Source: Regulation (EU) 2024/1689, Article 25(3). Retrieved 2026-08-26.
Kad 67
Soalan
What training-content disclosure must a GPAI provider publish?
Jawapan
Answer. A sufficiently detailed summary of the content used to train the model, using the template provided by the AI Office. It is a public transparency duty, not a requirement to publish every training item.
Source: Regulation (EU) 2024/1689, Article 53(1)(d). Retrieved 2026-08-26.
Kad 68
Soalan
When must an Article 50 disclosure be presented?
Jawapan
Answer. In a clear and distinguishable manner no later than the first interaction with or exposure to the AI system or its output, while satisfying applicable accessibility requirements.
Source: Regulation (EU) 2024/1689, Article 50(5). Retrieved 2026-08-26.
Kad 69
Soalan
How long must high-risk providers keep core compliance documents?
Jawapan
Answer. Generally ten years after the AI system is placed on the market or put into service, including technical documentation, quality-system documentation, changes approved by notified bodies, notified-body decisions, and the EU declaration of conformity.
Source: Regulation (EU) 2024/1689, Article 18. Retrieved 2026-08-26.
Kad 70
Soalan
What is the main fine tier for listed operator and Article 50 violations?
Jawapan
Answer. Up to €15 million or, for undertakings, up to 3% of total worldwide annual turnover for the preceding year, whichever is higher, subject to the exact provision and case-specific penalty assessment.
Source: Regulation (EU) 2024/1689, Article 99(4). Retrieved 2026-08-26.
140 kad
EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules
Ulang kaji dek ini secara percumaNibomo akan dibuka supaya anda boleh mula mengulang kaji.
Kad 71
Soalan
When must Member States have at least one AI regulatory sandbox operational?
Jawapan
Answer. By 2 August 2027, either nationally or through joint participation with other Member States, according to the Commission’s current implementation timeline.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Kad 72
Soalan
What makes software an AI system under the Act?
Jawapan
Answer. It must be machine-based, operate with varying autonomy, possibly adapt after deployment, infer from inputs how to generate outputs such as predictions, content, recommendations, or decisions, and influence physical or virtual environments.
Source: Regulation (EU) 2024/1689, Article 3(1). Retrieved 2026-08-26.
Kad 73
Soalan
Must a provider’s identity be visible on a high-risk AI system?
Jawapan
Answer. Yes. The provider must place its name, registered trade name or trademark, and contact address on the system or, when that is not possible, on packaging or accompanying documentation.
Source: Regulation (EU) 2024/1689, Article 16(b). Retrieved 2026-08-26.
Kad 74
Soalan
Which GPAI duties may an open-source provider avoid?
Jawapan
Answer. If the model meets the qualifying free-and-open-source conditions and is not systemic-risk, Article 53(1)(a) and (b) technical and downstream documentation duties do not apply. Copyright policy, training summary, and cooperation duties remain.
Source: Regulation (EU) 2024/1689, Article 53(2). Retrieved 2026-08-26.
Kad 75
Soalan
Must Article 50 disclosures be accessible?
Jawapan
Answer. Yes. The information must meet applicable accessibility requirements in addition to being clear, distinguishable, and timely. The right format depends on the surface and audience.
Source: Regulation (EU) 2024/1689, Article 50(5). Retrieved 2026-08-26.
Kad 76
Soalan
Must high-risk providers keep automatically generated logs?
Jawapan
Answer. Yes, when the logs are under their control. Providers must retain them for a period appropriate to the system’s intended purpose and generally at least six months unless other law provides otherwise.
Source: Regulation (EU) 2024/1689, Article 19. Retrieved 2026-08-26.
Kad 77
Soalan
What is the fine tier for misleading information to authorities?
Jawapan
Answer. Up to €7.5 million or, for undertakings, up to 1% of total worldwide annual turnover for the preceding year, whichever is higher, for supplying incorrect, incomplete, or misleading information to notified bodies or authorities in response to a request.
Source: Regulation (EU) 2024/1689, Article 99(5). Retrieved 2026-08-26.
Kad 78
Soalan
When did most AI Act enforcement powers start operating?
Jawapan
Answer. 2 August 2026 for the provisions applicable then. Later-applying obligations cannot be enforced as if already in force, and transitions must be checked provision by provision.
Source: European Commission implementation timeline. Retrieved 2026-08-26.
Kad 79
Soalan
Which manipulation practice does Article 5 prohibit?
Jawapan
Answer. Placing on the market, putting into service, or using AI that deploys subliminal, purposefully manipulative, or deceptive techniques with the objective or effect of materially distorting a person’s or group’s behaviour by appreciably impairing informed decision-making, thereby causing a decision they would not otherwise have taken in a manner that causes, or is reasonably likely to cause, significant harm to that person or another person or group.
Source: Regulation (EU) 2024/1689, Article 5(1)(a). Retrieved 2026-08-26.
Kad 80
Soalan
What must a provider do after discovering high-risk non-conformity?
Jawapan
Answer. Immediately take corrective action to bring the system into conformity, withdraw it, disable it, or recall it as appropriate, inform relevant downstream actors, and notify authorities when the risk conditions are met.
Source: Regulation (EU) 2024/1689, Article 20. Retrieved 2026-08-26.
Kad 81
Soalan
What qualifies a model as open source for the GPAI documentation exception?
Jawapan
Answer. Its parameters, including weights, architecture information, and information on model usage, must be publicly accessible under a free-and-open-source licence that permits access, use, modification, and distribution.
Source: Regulation (EU) 2024/1689, Article 53(2). Retrieved 2026-08-26.
Kad 82
Soalan
Does obvious AI interaction remove every Article 50 duty?
Jawapan
Answer. No. Obviousness is specific to the direct-interaction notice in Article 50(1). Separate marking and deployer-disclosure duties can still apply to synthetic content, deepfakes, public-interest text, or covered biometric uses.
Source: Regulation (EU) 2024/1689, Article 50. Retrieved 2026-08-26.
Kad 83
Soalan
How must high-risk providers cooperate with authorities?
Jawapan
Answer. On a reasoned request, provide information and documentation necessary to demonstrate conformity, grant access to automatically generated logs under their control, and otherwise cooperate in actions concerning the system.
Source: Regulation (EU) 2024/1689, Article 21. Retrieved 2026-08-26.
Kad 84
Soalan
How are SME fines treated under the AI Act?
Jawapan
Answer. For undertakings that are SMEs, each Article 99 fine must not exceed the lower of the stated percentage or fixed amount. Penalties must still be effective, proportionate, and dissuasive.
Source: Regulation (EU) 2024/1689, Article 99(6). Retrieved 2026-08-26.
Kad 85
Soalan
By when must legacy GPAI models comply with GPAI duties?
Jawapan
Answer. Providers of GPAI models placed on the market before 2 August 2025 must comply with the applicable GPAI obligations by 2 August 2027.
Source: European Commission GPAI provider guidelines. Retrieved 2026-08-26.
Kad 86
Soalan
Which vulnerability exploitation does Article 5 prohibit?
Jawapan
Answer. AI that exploits vulnerability due to age, disability, or a specific social or economic situation to materially distort behaviour in a way causing, or reasonably likely to cause, significant harm.
Source: Regulation (EU) 2024/1689, Article 5(1)(b). Retrieved 2026-08-26.
Kad 87
Soalan
When must a non-EU high-risk provider appoint an authorised representative?
Jawapan
Answer. Before making the high-risk AI system available in the EU, when the provider is established outside the EU, it must appoint an EU-established authorised representative by written mandate.
Source: Regulation (EU) 2024/1689, Article 22. Retrieved 2026-08-26.
Kad 88
Soalan
Do systemic-risk GPAI models receive the open-source documentation exception?
Jawapan
Answer. No. A GPAI model with systemic risk remains subject to the full applicable Article 53 baseline and Article 55 systemic-risk duties even if released under an open-source licence.
Source: Regulation (EU) 2024/1689, Articles 53(2) and 55. Retrieved 2026-08-26.
Kad 89
Soalan
Is the direct-interaction notice required when AI use is obvious?
Jawapan
Answer. Not under Article 50(1), if AI interaction is obvious to a reasonably well-informed, observant, and circumspect person, considering the circumstances and context. This is a contextual test, not a broad product label.
Source: European Commission Article 50 FAQ. Retrieved 2026-08-26.
Kad 90
Soalan
What must an authorised representative verify for high-risk AI?
Jawapan
Answer. That the EU declaration of conformity and technical documentation exist and that an appropriate conformity-assessment procedure was completed, then retain specified documents and support authority access and cooperation.
Source: Regulation (EU) 2024/1689, Article 22. Retrieved 2026-08-26.
Kad 91
Soalan
When did Article 50’s transparency duties begin applying?
Jawapan
Answer. 2 August 2026, with a targeted transition to 2 December 2026 for Article 50(2) marking by qualifying synthetic-content systems already on the market before that date.
Source: European Commission Article 50 guidelines. Retrieved 2026-08-26.
Kad 92
Soalan
Which social-scoring practice is prohibited?
Jawapan
Answer. Evaluating or classifying people over time by social behaviour or known, inferred, or predicted traits when this causes detrimental treatment in unrelated contexts or unjustified or disproportionate treatment.
Source: Regulation (EU) 2024/1689, Article 5(1)(c). Retrieved 2026-08-26.
Kad 93
Soalan
When must an authorised representative end its mandate?
Jawapan
Answer. If it considers or has reason to consider the provider is acting contrary to the Act, it must terminate the mandate and immediately inform the relevant market-surveillance authority and, where applicable, the notified body.
Source: Regulation (EU) 2024/1689, Article 22(4). Retrieved 2026-08-26.
Kad 94
Soalan
What evaluations must systemic-risk GPAI providers perform?
Jawapan
Answer. State-of-the-art model evaluations, including documented adversarial testing, to identify and mitigate systemic risks. The evaluations must follow standardised protocols and reflect the model’s capabilities and risks.
Source: Regulation (EU) 2024/1689, Article 55(1)(a). Retrieved 2026-08-26.
Kad 95
Soalan
What is Article 50’s law-enforcement exception for interaction notices?
Jawapan
Answer. Systems authorised by law to detect, prevent, investigate, or prosecute criminal offences can be exempt from the notice when appropriate safeguards protect third-party rights and freedoms. Systems available for public crime reporting remain subject to the notice.
Source: Regulation (EU) 2024/1689, Article 50(1). Retrieved 2026-08-26.
Kad 96
Soalan
What must a high-risk importer verify before market placement?
Jawapan
Answer. That the provider completed the correct conformity assessment, drew up technical documentation, affixed required CE marking, supplied the EU declaration and instructions, and appointed an authorised representative where required.
Source: Regulation (EU) 2024/1689, Article 23. Retrieved 2026-08-26.
Kad 97
Soalan
What date should this deck’s legal summaries be checked against?
Jawapan
Answer. 26 August 2026. Later amendments, delegated acts, standards, court decisions, or guidance can change how the rules should be understood.
Source: European Commission AI regulatory framework. Retrieved 2026-08-26.
Kad 98
Soalan
Is criminal-risk prediction based solely on profiling allowed?
Jawapan
Answer. No. Article 5 prohibits assessing or predicting an individual’s risk of committing an offence solely from profiling or personality traits. AI may support a human assessment already based on objective, verifiable facts linked to criminal activity.
Source: Regulation (EU) 2024/1689, Article 5(1)(d). Retrieved 2026-08-26.
Kad 99
Soalan
What identity information must a high-risk importer provide?
Jawapan
Answer. Its name, registered trade name or trademark, and contact address. The importer must put them on the high-risk AI system and, where applicable, on its packaging or accompanying documentation.
Source: Regulation (EU) 2024/1689, Article 23(3). Retrieved 2026-08-26.
Kad 100
Soalan
Which systemic risks must GPAI providers assess and mitigate?
Jawapan
Answer. EU-level risks arising from the model’s development, market placement, or use, including sources and propagation pathways. Measures must be proportionate, documented, and kept current.
Source: Regulation (EU) 2024/1689, Article 55(1)(b). Retrieved 2026-08-26.
Kad 101
Soalan
Does Article 50 machine marking apply to ordinary editing?
Jawapan
Answer. Not when the AI performs an assistive function for standard editing or does not substantially alter input data or its semantics. The exception is narrow and depends on what the system actually does.
Source: Regulation (EU) 2024/1689, Article 50(2). Retrieved 2026-08-26.
Kad 102
Soalan
What must a high-risk distributor check before availability?
Jawapan
Answer. The distributor must verify the required CE marking; a copy of the EU declaration and instructions for use; the provider’s Article 16(b) identity marking and Article 16(c) quality-management system; and, where applicable, the importer’s Article 23(3) identity marking.
Source: Regulation (EU) 2024/1689, Article 24(1). Retrieved 2026-08-26.
Kad 103
Soalan
Which official text should be the default legal source for this deck?
Jawapan
Answer. The EUR-Lex consolidated Regulation (EU) 2024/1689 version dated 27 July 2026, read together with Regulation (EU) 2026/1744 and later official updates. Consolidation is a study aid; the Official Journal acts remain legally authoritative.
Source: EUR-Lex consolidated Regulation (EU) 2024/1689. Retrieved 2026-08-26.
Kad 104
Soalan
Is untargeted facial-image scraping for a recognition database allowed?
Jawapan
Answer. No. Article 5 prohibits creating or expanding facial-recognition databases through untargeted scraping of facial images from the internet or CCTV footage.
Source: Regulation (EU) 2024/1689, Article 5(1)(e). Retrieved 2026-08-26.
Kad 105
Soalan
What must an importer do if it suspects high-risk non-conformity?
Jawapan
Answer. If the system is non-conforming, falsified, or accompanied by falsified documentation, the importer must not place it on the market until conformity is restored. Separately, if the system presents an Article 79(1) risk, the importer must inform the provider, authorised representative, and market-surveillance authorities.
Source: Regulation (EU) 2024/1689, Article 23(2). Retrieved 2026-08-26.
Kad 106
Soalan
What serious incidents must systemic-risk GPAI providers report?
Jawapan
Answer. Relevant serious incidents and possible corrective measures must be tracked, documented, and reported without undue delay to the AI Office and, where appropriate, national competent authorities.
Source: Regulation (EU) 2024/1689, Article 55(1)(c). Retrieved 2026-08-26.
Kad 107
Soalan
Does authorised law-enforcement use remove machine-marking duties?
Jawapan
Answer. Article 50(2) does not require synthetic-content marking where the AI system is authorised by law to detect, prevent, investigate, or prosecute criminal offences. The authorising law and its conditions still control the use.
Source: Regulation (EU) 2024/1689, Article 50(2). Retrieved 2026-08-26.
Kad 108
Soalan
What storage and transport duties apply to high-risk importers?
Jawapan
Answer. While responsible for the system, an importer must ensure storage and transport conditions do not jeopardise compliance with high-risk-system requirements.
Source: Regulation (EU) 2024/1689, Article 23(4). Retrieved 2026-08-26.
Kad 109
Soalan
What does 2 August 2028 mark, and which Article 111 transitions come later?
Jawapan
Answer. It is the selected main application milestone for Chapter III, Sections 1–3 for Article 6(1) high-risk systems tied to Annex I Section A products. It is not the Act’s last operative transition. Article 111 requires providers and deployers of high-risk systems intended to be used by public authorities to comply by 2 August 2030. It also requires AI systems that are components of large-scale IT systems established by the legal acts in Annex X, if placed on the market or put into service before 2 August 2027, to comply by 31 December 2030. Annex I Section B systems remain under Article 2(2)’s limited regime, not the full Chapter III regime.
Sources: Regulation (EU) 2024/1689, Articles 2(2), 111 and 113 and European Commission implementation timeline. Retrieved 2026-08-26.
Kad 110
Soalan
Is workplace or school emotion inference allowed?
Jawapan
Answer. Generally no. Inferring emotions of natural persons in workplaces or educational institutions is prohibited, except where use is intended for medical or safety reasons.
Source: Regulation (EU) 2024/1689, Article 5(1)(f). Retrieved 2026-08-26.
Kad 111
Soalan
How long must a high-risk importer keep conformity records?
Jawapan
Answer. For ten years after the system is placed on the market or put into service, the importer must keep a copy of the relevant certificate, where applicable, the instructions, and the EU declaration of conformity.
Source: Regulation (EU) 2024/1689, Article 23(5). Retrieved 2026-08-26.
Kad 112
Soalan
What cybersecurity duty applies to systemic-risk GPAI models?
Jawapan
Answer. Providers must ensure an adequate level of cybersecurity protection for the model and its physical infrastructure, proportionate to systemic risk and the state of the art.
Source: Regulation (EU) 2024/1689, Article 55(1)(d). Retrieved 2026-08-26.
Kad 113
Soalan
Is there a law-enforcement exception to deepfake disclosure?
Jawapan
Answer. Yes, for use authorised by law to detect, prevent, investigate, or prosecute criminal offences, with the relevant legal safeguards. The exception should not be generalized to ordinary public communications.
Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.
Kad 114
Soalan
What must a distributor do if a high-risk system seems non-compliant?
Jawapan
Answer. Withhold it from the market until conformity is restored. Separately, if the system presents an Article 79(1) risk, inform the provider or importer. Article 24(2) does not add an authority-notification duty at this pre-market stage.
Source: Regulation (EU) 2024/1689, Article 24(2). Retrieved 2026-08-26.
Kad 115
Soalan
What must be rechecked before relying on an AI Act date?
Jawapan
Answer. The current consolidated regulation, any amending regulation, and the Commission implementation timeline. A date in an older course or card set may have been superseded.
Source: European Commission AI Act FAQ. Retrieved 2026-08-26.
Kad 116
Soalan
Which biometric categorisation is prohibited?
Jawapan
Answer. Biometric categorisation that individually categorises people to deduce or infer race, political opinions, trade-union membership, religious or philosophical beliefs, sex life, or sexual orientation, subject to narrow dataset and law-enforcement carve-outs.
Source: Regulation (EU) 2024/1689, Article 5(1)(g). Retrieved 2026-08-26.
Kad 117
Soalan
What must a distributor do after a high-risk system is already available?
Jawapan
Answer. If it becomes non-compliant, take or ensure the corrective action needed to bring it into conformity, withdraw it, or recall it. Separately, if the system presents an Article 79(1) risk, immediately inform the provider or importer and competent authorities, with details of the non-compliance and corrective action.
Source: Regulation (EU) 2024/1689, Article 24(4). Retrieved 2026-08-26.
Kad 118
Soalan
Can a GPAI code of practice demonstrate compliance?
Jawapan
Answer. Yes. Until harmonised standards are available, providers may rely on approved codes of practice to demonstrate compliance. A provider choosing another route must show alternative adequate means of compliance.
Source: Regulation (EU) 2024/1689, Article 56. Retrieved 2026-08-26.
Kad 119
Soalan
Does Article 50 replace other transparency law?
Jawapan
Answer. No. Article 50 adds AI-specific duties without displacing stricter or overlapping obligations under consumer, media, electoral, platform, accessibility, privacy, or other applicable law.
Source: European Commission Article 50 guidelines. Retrieved 2026-08-26.
Kad 120
Soalan
What storage and transport duties apply to high-risk distributors?
Jawapan
Answer. While responsible for the system, a distributor must ensure storage and transport conditions do not jeopardise compliance with high-risk-system requirements.
Source: Regulation (EU) 2024/1689, Article 24(3). Retrieved 2026-08-26.
Kad 121
Soalan
When is an Annex I product-linked AI system high-risk?
Jawapan
Answer. Only when the Article 6(1) gateway remains satisfied after paragraphs 1a–1c: the AI is a safety component of an Annex I product, is itself such a product, or its failure or malfunction would endanger health and safety; and the product must undergo third-party conformity assessment before market placement or service. AI used solely for non-safety assistance, optimisation, efficiency, automation, convenience, or quality control is not a safety component unless its failure or malfunction would endanger health or safety. An assessment required solely for non-health-and-safety risks does not satisfy the second condition.
Source: Regulation (EU) 2024/1689, Article 6(1)–(1c). Retrieved 2026-08-26.
Kad 122
Soalan
How must high-risk distributors cooperate with authorities?
Jawapan
Answer. They must provide relevant information and documentation on a reasoned request and cooperate in actions concerning the high-risk system, including measures to reduce or mitigate risks.
Source: Regulation (EU) 2024/1689, Article 24(5)–(6). Retrieved 2026-08-26.
Kad 123
Soalan
Are the Commission’s Article 50 guidelines legally binding?
Jawapan
Answer. No. They are practical interpretive guidance. The AI Act’s text is binding, and authoritative interpretation belongs to competent authorities and ultimately the Court of Justice of the European Union.
Source: European Commission Article 50 guidelines. Retrieved 2026-08-26.
Kad 124
Soalan
What input-data duty applies to high-risk deployers?
Jawapan
Answer. When a deployer controls input data, it must ensure that the input is relevant and sufficiently representative for the system’s intended purpose.
Source: Regulation (EU) 2024/1689, Article 26(4). Retrieved 2026-08-26.
Kad 125
Soalan
Which non-consensual intimate deepfake practice is prohibited?
Jawapan
Answer. For providers, placing the system on the market or putting it into service is prohibited only if generating or manipulating the covered realistic intimate or sexually explicit material of an identifiable person without freely given, specific, informed, unambiguous, and explicit consent is intended, or is reasonably foreseeable and reproducible without significant technical modification and reasonable, adequate safeguards are absent. For deployers, use is prohibited only when they use the system for that purpose. The rule applies from 2 December 2026; manipulation counts only if it increases intimate-part exposure or alters the nature of the sexually explicit activity.
Source: Regulation (EU) 2026/1744, Article 1 (AI Act Article 5(1)(ba) and 5(1a)–(1b)). Retrieved 2026-08-26.
Kad 126
Soalan
How must a high-risk deployer use the system?
Jawapan
Answer. According to the accompanying instructions, while assigning human oversight to natural persons with the necessary competence, training, authority, and support.
Source: Regulation (EU) 2024/1689, Article 26(1)–(2). Retrieved 2026-08-26.
Kad 127
Soalan
What is the safest Article 50 disclosure design?
Jawapan
Answer. Put a clear, distinguishable, accessible notice at the first interaction or exposure, close to the relevant AI experience or content, while also meeting any machine-marking duty. Exact design remains context-specific.
Source: European Commission Article 50 FAQ. Retrieved 2026-08-26.
Kad 128
Soalan
Who must complete a fundamental-rights impact assessment?
Jawapan
Answer. Before first use, deployers that are public bodies, private entities providing public services, and deployers of specified Annex III creditworthiness and life or health-insurance systems, subject to Article 27’s exact scope and exceptions.
Source: Regulation (EU) 2024/1689, Article 27. Retrieved 2026-08-26.
Kad 129
Soalan
How does Annex III create high-risk status?
Jawapan
Answer. Article 6(2) classifies systems in Annex III’s listed use cases as high-risk, unless Article 6(3)’s limited no-significant-risk conditions apply. A use-case label alone is not the full analysis.
Source: Regulation (EU) 2024/1689, Article 6(2)–(3) and Annex III. Retrieved 2026-08-26.
Kad 130
Soalan
What must a deployer do when high-risk use may create a risk?
Jawapan
Answer. If use in accordance with the instructions may present an Article 79(1) risk, the deployer must, without undue delay, inform the provider or distributor and the relevant market-surveillance authority, and suspend use. A serious incident triggers a separate immediate chain: inform the provider first, then the importer or distributor and the relevant market-surveillance authorities; if the provider cannot be reached, Article 73 applies mutatis mutandis.
Source: Regulation (EU) 2024/1689, Article 26(5). Retrieved 2026-08-26.
Kad 131
Soalan
Can a high-risk FRIA reuse a data-protection impact assessment?
Jawapan
Answer. Yes. If a DPIA already addresses relevant elements, the deployer should complement it with the additional Article 27 information rather than duplicate the work.
Source: Regulation (EU) 2024/1689, Article 27(4). Retrieved 2026-08-26.
Kad 132
Soalan
When may law enforcement use real-time remote biometric identification in public?
Jawapan
Answer. Only for narrow listed objectives and under strict necessity, proportionality, temporal, geographic, and personal limits, generally with prior judicial or independent administrative authorisation. The default rule is prohibition.
Source: Regulation (EU) 2024/1689, Article 5(1)(h) and 5(2)–(7). Retrieved 2026-08-26.
Kad 133
Soalan
How long must a high-risk deployer keep logs under its control?
Jawapan
Answer. For a period appropriate to the intended purpose and generally at least six months, unless applicable EU or national law provides otherwise, particularly on personal-data protection.
Source: Regulation (EU) 2024/1689, Article 26(6). Retrieved 2026-08-26.
Kad 134
Soalan
What conformity steps precede high-risk market placement?
Jawapan
Answer. The provider must complete the applicable conformity assessment, draw up the EU declaration of conformity, affix CE marking, and register the system where required before placement or service. The exact route depends on the system.
Source: Regulation (EU) 2024/1689, Articles 43, 47–49. Retrieved 2026-08-26.
Kad 135
Soalan
When can an Annex III system be treated as not high-risk?
Jawapan
Answer. Only when both parts of Article 6(3) are met: it poses no significant risk of harm to health, safety, or fundamental rights—including, for example, by not materially influencing decision-making—and it satisfies at least one listed task condition: a narrow procedural task; improvement of the result of a previously completed human activity; detection of decision-making patterns or deviations without being meant to replace or influence the previously completed human assessment without proper human review; or a preparatory task for an Annex III assessment. Profiling systems remain high-risk, and the provider must document the assessment.
Source: Regulation (EU) 2024/1689, Article 6(3)–(4). Retrieved 2026-08-26.
Kad 136
Soalan
When must workers be told about workplace high-risk AI?
Jawapan
Answer. Before putting the system into service or using it at work, the deployer that is an employer must inform worker representatives and affected workers that they will be subject to the system, following applicable information rules.
Source: Regulation (EU) 2024/1689, Article 26(7). Retrieved 2026-08-26.
Kad 137
Soalan
What ongoing monitoring must high-risk providers run?
Jawapan
Answer. A documented post-market monitoring system proportionate to the technology and risks, actively collecting and analysing performance data throughout the system’s lifetime to evaluate continuous compliance.
Source: Regulation (EU) 2024/1689, Article 72. Retrieved 2026-08-26.
Kad 138
Soalan
Which child-sexual-abuse AI practice is prohibited from 2 December 2026?
Jawapan
Answer. From 2 December 2026, providers may not place the system on the market or put it into service if generating or manipulating the covered child-sexual-abuse material or performances is intended, or is reasonably foreseeable and reproducible without significant technical modification and reasonable, adequate safeguards are absent. Deployers are prohibited only when they use the system for that purpose. A ‘without right’ defence under national law remains possible.
Source: Regulation (EU) 2026/1744, Article 1 (AI Act Article 5(1)(bb) and 5(1a)). Retrieved 2026-08-26.
Kad 139
Soalan
Who must be told when high-risk AI informs a decision about them?
Jawapan
Answer. The deployer must inform the affected natural person that the relevant Annex III high-risk system is being used, where Article 26’s notice condition applies. Other explanation and data-protection rights may also be relevant.
Source: Regulation (EU) 2024/1689, Article 26(11). Retrieved 2026-08-26.
Kad 140
Soalan
Does Article 6(3) ever exclude profiling systems from high-risk status?
Jawapan
Answer. No. An Annex III system that performs profiling of natural persons is always considered high-risk, even if another Article 6(3) task description might appear narrow.
Source: Regulation (EU) 2024/1689, Article 6(3). Retrieved 2026-08-26.
140 kad
EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules
Nibomo akan dibuka supaya anda boleh mula mengulang kaji.
