EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules

Question 1

When did the EU AI Act enter into force?

Accepted Answer

Answer. 1 August 2024, twenty days after publication in the Official Journal. Most duties did not apply immediately; the Act uses a phased timetable.

Source: European Commission implementation timeline. Retrieved 2026-08-26.

Question 2

When can the EU AI Act apply to a provider outside the EU?

Accepted Answer

Answer. When the provider places an AI system or GPAI model on the EU market, puts an AI system into service in the EU, or when the output of its AI system is used in the EU. The exact facts still matter.

Source: Regulation (EU) 2024/1689, Article 2. Retrieved 2026-08-26.

Question 3

Who is a provider under the EU AI Act?

Accepted Answer

Answer. A person, public authority, agency, or other body that develops an AI system or GPAI model, or has one developed, and places it on the market or puts the system into service under its own name or trademark, whether paid or free.

Source: Regulation (EU) 2024/1689, Article 3(3). Retrieved 2026-08-26.

Question 4

What is a general-purpose AI model?

Accepted Answer

Answer. An AI model with significant generality that can competently perform a wide range of distinct tasks and can be integrated into many downstream systems or applications. Models used only for research, development, or prototyping before market placement are excluded from this definition.

Source: Regulation (EU) 2024/1689, Article 3(63). Retrieved 2026-08-26.

Question 5

When must people be told they are interacting with AI?

Accepted Answer

Answer. Providers must design direct-interaction AI systems so people are informed that they are interacting with AI, unless this is obvious to a reasonably well-informed, observant, and circumspect person in the circumstances.

Source: Regulation (EU) 2024/1689, Article 50(1). Retrieved 2026-08-26.

Question 6

What is the core purpose of high-risk AI risk management?

Accepted Answer

Answer. To establish a continuous, iterative lifecycle process that identifies, analyses, evaluates, and treats known and reasonably foreseeable risks to health, safety, and fundamental rights, then tests whether controls work.

Source: Regulation (EU) 2024/1689, Article 9. Retrieved 2026-08-26.

Question 7

Who enforces most EU AI Act rules?

Accepted Answer

Answer. National competent authorities, including market-surveillance authorities, enforce most AI-system rules in Member States. The Commission’s AI Office has central responsibilities, especially for GPAI.

Source: European Commission enforcement framework. Retrieved 2026-08-26.

Question 8

Which EU AI Act rules began applying on 2 February 2025?

Accepted Answer

Answer. The AI-system definition and scope-related provisions, AI-literacy duty, and most original prohibited-practice rules began applying on 2 February 2025.

Source: European Commission implementation timeline. Retrieved 2026-08-26.

Question 9

Does the EU AI Act apply to an EU-based deployer?

Accepted Answer

Answer. Yes. The Act applies to deployers that have their place of establishment or are located in the EU, subject to the Act’s specific exclusions and transitions.

Source: Regulation (EU) 2024/1689, Article 2(1)(b). Retrieved 2026-08-26.

Question 10

Who is a deployer under the EU AI Act?

Accepted Answer

Answer. A person, public authority, agency, or other body using an AI system under its authority, except where the system is used in a personal, non-professional activity.

Source: Regulation (EU) 2024/1689, Article 3(4). Retrieved 2026-08-26.

Question 11

Which baseline duties apply to all GPAI-model providers?

Accepted Answer

Answer. Keep technical documentation current, give downstream providers information needed for integration and compliance, maintain an EU-copyright-compliance policy, publish a sufficiently detailed training-content summary, and cooperate with authorities.

Source: Regulation (EU) 2024/1689, Article 53. Retrieved 2026-08-26.

Question 12

Who must machine-mark AI-generated content under Article 50?

Accepted Answer

Answer. Providers of AI systems that generate synthetic audio, image, video, or text content must ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated.

Source: Regulation (EU) 2024/1689, Article 50(2). Retrieved 2026-08-26.

Question 13

What data quality does Article 10 require for high-risk AI?

Accepted Answer

Answer. Training, validation, and testing datasets must be governed appropriately and, for their intended purpose, be relevant, sufficiently representative, and as far as possible free of errors and complete, with suitable statistical properties.

Source: Regulation (EU) 2024/1689, Article 10. Retrieved 2026-08-26.

Question 14

What is the European AI Office’s main EU AI Act role?

Accepted Answer

Answer. It supports implementation and enforcement at EU level, including central supervision of GPAI obligations and coordination, guidance, evaluations, and investigations within its legal remit.

Source: European Commission enforcement framework. Retrieved 2026-08-26.

Question 15

Which EU AI Act rules began applying on 2 August 2025?

Accepted Answer

Answer. The GPAI obligations and much of the governance framework began applying on 2 August 2025, alongside Member State penalty-notification and authority-designation steps.

Source: European Commission implementation timeline. Retrieved 2026-08-26.

Question 16

When can EU output-use bring a non-EU actor into scope?

Accepted Answer

Answer. When a provider or deployer is outside the EU but the output produced by its AI system is used in the EU. This is a territorial hook, not an automatic conclusion about every remote service.

Source: Regulation (EU) 2024/1689, Article 2(1)(c). Retrieved 2026-08-26.

Question 17

Who is an importer under the EU AI Act?

Accepted Answer

Answer. An EU-located or EU-established person that places on the market an AI system bearing the name or trademark of a person established outside the EU.

Source: Regulation (EU) 2024/1689, Article 3(6). Retrieved 2026-08-26.

Question 18

When is a GPAI model presumed to have systemic risk?

Accepted Answer

Answer. When cumulative training compute exceeds 10^25 floating-point operations, the model is presumed to have high-impact capabilities and therefore systemic risk, unless the legal classification is successfully rebutted.

Source: Regulation (EU) 2024/1689, Articles 51–52. Retrieved 2026-08-26.

Question 19

How strong must Article 50 machine marking be?

Accepted Answer

Answer. The technical solution must be effective, interoperable, robust, and reliable as far as technically feasible, considering the content’s nature, implementation costs, and generally acknowledged state of the art.

Source: Regulation (EU) 2024/1689, Article 50(2). Retrieved 2026-08-26.

Question 20

When must high-risk technical documentation exist?

Accepted Answer

Answer. It must be drawn up before the high-risk system is placed on the market or put into service and kept up to date throughout the relevant lifecycle.

Source: Regulation (EU) 2024/1689, Article 11. Retrieved 2026-08-26.

Question 21

What does the European AI Board do?

Accepted Answer

Answer. It advises and assists the Commission and Member States to support consistent and effective application of the Act, including coordination among national authorities and sharing technical and regulatory expertise.

Source: Regulation (EU) 2024/1689, Articles 65–66. Retrieved 2026-08-26.

Question 22

What was the EU AI Act’s general applicability date?

Accepted Answer

Answer. 2 August 2026. Important exceptions and later dates remain, especially for certain prohibitions, high-risk categories, and legacy GPAI models.

Source: European Commission implementation timeline. Retrieved 2026-08-26.

Question 23

Which national-security activity is outside the EU AI Act?

Accepted Answer

Answer. The Act does not apply to areas outside EU law and does not affect Member State competences concerning national security, regardless of the entity carrying out the national-security tasks.

Source: Regulation (EU) 2024/1689, Article 2(3). Retrieved 2026-08-26.

Question 24

Who is a distributor under the EU AI Act?

Accepted Answer

Answer. A supply-chain person, other than the provider or importer, that makes an AI system available on the EU market.

Source: Regulation (EU) 2024/1689, Article 3(7). Retrieved 2026-08-26.

Question 25

Can the Commission classify a GPAI model as systemic risk below 10^25 FLOPs?

Accepted Answer

Answer. Yes. The Commission may designate a model when it has high-impact capabilities evaluated through appropriate technical tools and criteria, even without crossing the compute presumption.

Source: Regulation (EU) 2024/1689, Article 51. Retrieved 2026-08-26.

Question 26

Who must disclose AI-generated deepfakes?

Accepted Answer

Answer. Deployers of AI systems that generate or manipulate image, audio, or video content constituting a deepfake must disclose that the content was artificially generated or manipulated.

Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.

Question 27

What logging capability must a high-risk AI system have?

Accepted Answer

Answer. It must technically allow automatic recording of events over its lifetime to support traceability, monitoring, post-market work, and investigation appropriate to the system’s purpose.

Source: Regulation (EU) 2024/1689, Article 12. Retrieved 2026-08-26.

Question 28

What is the Scientific Panel’s governance role?

Accepted Answer

Answer. The independent Scientific Panel supports enforcement with technical expertise, including alerts and advice on GPAI models, systemic risks, evaluations, and other technically complex matters.

Source: Regulation (EU) 2024/1689, Articles 68 and 90. Retrieved 2026-08-26.

Question 29

What did Regulation (EU) 2026/1744 do to the AI Act timetable?

Accepted Answer

Answer. It amended Regulation (EU) 2024/1689, including deferred dates for Annex III and Annex I high-risk obligations and targeted Article 50 and prohibited-practice transitions.

Source: Regulation (EU) 2026/1744. Retrieved 2026-08-26.

Question 30

Are exclusively military or defence AI systems covered?

Accepted Answer

Answer. No. The Act excludes AI systems placed on the market, put into service, or used exclusively for military, defence, or national-security purposes, regardless of the actor. Mixed or changed uses need separate analysis.

Source: Regulation (EU) 2024/1689, Article 2(3). Retrieved 2026-08-26.

Question 31

Who is an authorised representative under the EU AI Act?

Accepted Answer

Answer. An EU-located or EU-established person that receives and accepts a written mandate from a provider to perform specified obligations and procedures on the provider’s behalf.

Source: Regulation (EU) 2024/1689, Article 3(5). Retrieved 2026-08-26.

Question 32

When must a GPAI provider notify the Commission of a systemic-risk threshold?

Accepted Answer

Answer. Without delay and, in any event, within two weeks after the provider knows or has reasonable grounds to believe the model meets the systemic-risk condition.

Source: Regulation (EU) 2024/1689, Article 52(1). Retrieved 2026-08-26.

Question 33

How does Article 50 treat artistic deepfakes?

Accepted Answer

Answer. For evidently artistic, creative, satirical, fictional, or analogous works, disclosure may be made in an appropriate way that does not hamper display or enjoyment of the work. The disclosure duty still exists.

Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.

Question 34

What information must accompany a high-risk AI system?

Accepted Answer

Answer. Concise, complete, correct, and clear instructions for use with the provider’s identity, capabilities and limits, intended purpose, performance, risks, human-oversight measures, input-data specifications, logging, maintenance, and other legally required details.

Source: Regulation (EU) 2024/1689, Article 13. Retrieved 2026-08-26.

Question 35

What is the Advisory Forum’s role?

Accepted Answer

Answer. It supplies stakeholder expertise and advice to the AI Board and Commission through a balanced group representing industry, startups, civil society, academia, and other affected interests.

Source: Regulation (EU) 2024/1689, Article 67. Retrieved 2026-08-26.

Question 36

When did Regulation (EU) 2026/1744 enter into force?

Accepted Answer

Answer. 27 July 2026. The amendment changed the then-current consolidated AI Act and must be considered when studying implementation dates.

Source: Regulation (EU) 2026/1744, Article 4. Retrieved 2026-08-26.

Question 37

Is pure scientific research and development covered?

Accepted Answer

Answer. The Act does not apply to AI systems or models, including outputs, specifically developed and put into service for the sole purpose of scientific research and development. Other uses need separate analysis.

Source: Regulation (EU) 2024/1689, Article 2(6). Retrieved 2026-08-26.

Question 38

Which actors count as operators under the EU AI Act?

Accepted Answer

Answer. Providers, product manufacturers, deployers, authorised representatives, importers, and distributors. “Operator” is the Act’s umbrella term for these value-chain roles.

Source: Regulation (EU) 2024/1689, Article 3(8). Retrieved 2026-08-26.

Question 39

Can a GPAI provider challenge the systemic-risk presumption?

Accepted Answer

Answer. Yes. With the threshold notification, the provider may present sufficiently substantiated arguments that the model exceptionally does not present systemic risks despite meeting the compute presumption. The Commission decides.

Source: Regulation (EU) 2024/1689, Article 52(2). Retrieved 2026-08-26.

Question 40

When must AI-generated public-interest text be disclosed?

Accepted Answer

Answer. A deployer must disclose artificial generation or manipulation when publishing AI-generated or manipulated text to inform the public on matters of public interest, unless a stated exception applies.

Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.

Question 41

What must human oversight enable for high-risk AI?

Accepted Answer

Answer. Effective oversight by competent people who can understand capabilities and limits, detect anomalies and automation bias, interpret outputs, decide not to use or override them, and safely interrupt the system where appropriate.

Source: Regulation (EU) 2024/1689, Article 14. Retrieved 2026-08-26.

Question 42

Can a person complain about an alleged AI Act infringement?

Accepted Answer

Answer. Yes. Any natural or legal person with grounds to consider that the Act was infringed may lodge a complaint with the relevant market-surveillance authority, without prejudice to other remedies.

Source: Regulation (EU) 2024/1689, Article 85. Retrieved 2026-08-26.

Question 43

When do the two new 2026 prohibited practices begin applying?

Accepted Answer

Answer. 2 December 2026. They concern specified non-consensual intimate or sexually explicit deepfakes and specified child-sexual-abuse material or performances.

Source: Regulation (EU) 2026/1744, Article 1 and transition provisions. Retrieved 2026-08-26.

Question 44

Is pre-market AI research, testing, or development covered?

Accepted Answer

Answer. Generally no, before placement on the market or putting into service, if the activity respects applicable EU law. Testing in real-world conditions is not part of this exclusion.

Source: Regulation (EU) 2024/1689, Article 2(8). Retrieved 2026-08-26.

Question 45

Is an affected person an operator?

Accepted Answer

Answer. No. “Operator” covers specified supply-chain and use roles. An affected person is someone in the EU affected by an AI system and may hold rights such as complaint or explanation rights where their conditions are met.

Source: Regulation (EU) 2024/1689, Articles 2, 3(8), 85–86. Retrieved 2026-08-26.

Question 46

What must GPAI technical documentation cover?

Accepted Answer

Answer. The model’s development, training, testing, evaluation, architecture, design specifications, capabilities, limitations, and other information required by Annex XI, kept current and available to the AI Office and national authorities on request.

Source: Regulation (EU) 2024/1689, Article 53(1)(a) and Annex XI. Retrieved 2026-08-26.

Question 47

What is the public-interest text disclosure exception for human review?

Accepted Answer

Answer. Disclosure is not required when the AI-generated content underwent human review or editorial control and a natural or legal person holds editorial responsibility for publication.

Source: Regulation (EU) 2024/1689, Article 50(4). Retrieved 2026-08-26.

Question 48

Which performance qualities must high-risk AI maintain?

Accepted Answer

Answer. An appropriate level of accuracy, robustness, and cybersecurity throughout the lifecycle, consistent with the system’s intended purpose and the acknowledged state of the art.

Source: Regulation (EU) 2024/1689, Article 15. Retrieved 2026-08-26.

Question 49

When does Article 86 give an explanation right?

Accepted Answer

Answer. When a deployer takes a decision about an affected person on the basis of output from an Annex III high-risk system, except point 2 systems, and the decision produces legal effects or similarly significantly affects that person in a way they consider adverse to their health, safety, or fundamental rights, subject to the Article’s conditions and exceptions.

Source: Regulation (EU) 2024/1689, Article 86. Retrieved 2026-08-26.

Question 50

What is the Article 50 transition for older synthetic-content systems?

Accepted Answer

Answer. A system placed on the market before 2 August 2026 that generates or manipulates synthetic content has until 2 December 2026 to comply with Article 50(2)’s machine-readable marking duty.

Source: Regulation (EU) 2026/1744, Article 1 transition amendment. Retrieved 2026-08-26.

Question 51

Does personal non-professional AI use fall under deployer duties?

Accepted Answer

Answer. No. A natural person using AI in a purely personal, non-professional activity is excluded from the deployer definition and the Act does not apply to that use. Other applicable law can still matter.

Source: Regulation (EU) 2024/1689, Articles 2(10) and 3(4). Retrieved 2026-08-26.

Question 52

When does a downstream actor become the provider of an AI system?

Accepted Answer

Answer. If it places its name or trademark on a high-risk system, makes a substantial modification, or changes the intended purpose so a previously non-high-risk system becomes high-risk.

Source: Regulation (EU) 2024/1689, Article 25. Retrieved 2026-08-26.

Question 53

What must GPAI providers tell downstream system providers?

Accepted Answer

Answer. They must provide and maintain information and documentation enabling downstream providers to understand the model’s capabilities and limitations and comply with the Act, without disclosing protected intellectual property unnecessarily.

Source: Regulation (EU) 2024/1689, Article 53(1)(b) and Annex XII. Retrieved 2026-08-26.

Question 54

Who must be informed about emotion-recognition use?

Accepted Answer

Answer. Deployers of emotion-recognition systems must inform the natural persons exposed to the system and process personal data consistently with EU data-protection law.

Source: Regulation (EU) 2024/1689, Article 50(3). Retrieved 2026-08-26.

Question 55

What is a high-risk provider’s basic compliance duty?

Accepted Answer

Answer. Ensure the system complies with the Chapter III Section 2 requirements, identify itself, operate quality and documentation controls, complete conformity steps, register where required, take corrective action, and cooperate with authorities.

Source: Regulation (EU) 2024/1689, Article 16. Retrieved 2026-08-26.

Question 56

What must an Article 86 explanation contain?

Accepted Answer

Answer. Clear and meaningful explanations of the AI system’s role in the decision-making procedure and the main elements of the decision taken. It is not a general right to source code or every model detail.

Source: Regulation (EU) 2024/1689, Article 86. Retrieved 2026-08-26.

Question 57

When do Annex III high-risk duties begin applying after the 2026 amendment?

Accepted Answer

Answer. 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, subject to the Act’s detailed transitions and any applicable exceptions.

Source: Regulation (EU) 2026/1744. Retrieved 2026-08-26.

Question 58

Does open-source release create a blanket EU AI Act exemption?

Accepted Answer

Answer. No. The free-and-open-source exception does not cover systems placed on the market or put into service as high-risk systems or systems falling under Article 5 or Article 50. Other conditions also matter.

Source: Regulation (EU) 2024/1689, Article 2(12). Retrieved 2026-08-26.

Question 59

What happens to the original provider after a downstream actor becomes provider?

Accepted Answer

Answer. For that specific system, the original provider is no longer treated as provider under Article 25, but must cooperate and supply reasonably expected technical access and information unless it clearly prohibited the conversion into a high-risk system.

Source: Regulation (EU) 2024/1689, Article 25. Retrieved 2026-08-26.

Question 60

What copyright policy must a GPAI provider maintain?

Accepted Answer

Answer. A policy to comply with EU copyright and related-rights law, including identifying and respecting rights reservations expressed under Article 4(3) of the Digital Single Market Copyright Directive.

Source: Regulation (EU) 2024/1689, Article 53(1)(c). Retrieved 2026-08-26.

Question 61

Who must be informed about biometric-categorisation use?

Accepted Answer

Answer. Deployers of biometric-categorisation systems must inform the natural persons exposed to the system and process personal data under applicable EU data-protection rules. Article 5 separately prohibits certain sensitive-trait categorisation.

Source: Regulation (EU) 2024/1689, Article 50(3). Retrieved 2026-08-26.

Question 62

What must a high-risk provider’s quality-management system cover?

Accepted Answer

Answer. A documented, proportionate system covering compliance strategy, design and development, testing, data, technical specifications, verification, records, accountability, post-market monitoring, incident reporting, communications, and continuous improvement.

Source: Regulation (EU) 2024/1689, Article 17. Retrieved 2026-08-26.

Question 63

What is the top fine tier for prohibited AI practices?

Accepted Answer

Answer. Up to €35 million or, for undertakings, up to 7% of total worldwide annual turnover for the preceding financial year, whichever is higher, subject to the Act’s penalty rules and case-specific assessment.

Source: Regulation (EU) 2024/1689, Article 99(3). Retrieved 2026-08-26.

Question 64

How do the AI Act’s application rules differ for Annex I Section A and Section B high-risk systems?

Accepted Answer

Answer. Section A systems enter the Chapter III, Sections 1–3 regime on 2 August 2028. Section B systems do not take on that full regime: Article 2(2) limits the AI Act to Articles 6(1), 60a, and 102–112, with Articles 57–59 applying only when high-risk requirements are integrated into the relevant sectoral law. Articles 102–110 have applied since 27 July 2026.

Source: Regulation (EU) 2024/1689, Articles 2(2) and 113. Retrieved 2026-08-26.

Về bộ thẻ này

EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules

What you will practise

Recall map and exclusions

Freshness

Important boundary

Sources and method

Independent study aid

Thẻ trong bộ này

Thẻ 1

Thẻ 2

Thẻ 3

Thẻ 4

Thẻ 5

Thẻ 6

Thẻ 7

Thẻ 8

Thẻ 9

Thẻ 10

Thẻ 11

Thẻ 12

Thẻ 13

Thẻ 14

Thẻ 15

Thẻ 16

Thẻ 17

Thẻ 18

Thẻ 19

Thẻ 20

Thẻ 21

Thẻ 22

Thẻ 23

Thẻ 24

Thẻ 25

Thẻ 26

Thẻ 27

Thẻ 28

Thẻ 29

Thẻ 30

Thẻ 31

Thẻ 32

Thẻ 33

Thẻ 34

Thẻ 35

Thẻ 36

Thẻ 37

Thẻ 38

Thẻ 39

Thẻ 40

Thẻ 41

Thẻ 42

Thẻ 43

Thẻ 44

Thẻ 45

Thẻ 46

Thẻ 47

Thẻ 48

Thẻ 49

Thẻ 50

Thẻ 51

Thẻ 52

Thẻ 53

Thẻ 54

Thẻ 55

Thẻ 56

Thẻ 57

Thẻ 58

Thẻ 59

Thẻ 60

Thẻ 61

Thẻ 62

Thẻ 63

Thẻ 64

Thẻ 65

Thẻ 66

Thẻ 67

Thẻ 68

Thẻ 69

Thẻ 70

EU AI Act 2026 Flashcards: Timeline, Roles & Risk Rules