EU AI Act

The map

Five minutes, once. Rate each pillar before you start and the cards you are shakiest on come first. Skipping it costs you nothing but the ordering.

1. The risk tiers

   Four tiers, and the tier is decided by use, not by the technology.

   • Four tiers, decided by use
   • The banned practices
   • High risk arrives by two routes

2. Provider, deployer, and the flip between them

   Obligations attach to a role, and the role can change under your feet.

   • Provider and deployer
   • How a deployer becomes a provider
   • What the deployer still owes

3. What high risk actually obliges

   A management system, data governance, human oversight, logs and a declaration.

   • A risk management system that runs for the lifetime
   • Data governance, and the article that permits special-category data
   • Human oversight is designed in, not added on

4. General-purpose AI models

   A separate chapter for models rather than systems, with a compute threshold.

   • General-purpose models have their own chapter
   • The systemic-risk threshold
   • Telling people they are talking to a machine

5. Dates, penalties, and literacy

   The regulation applies in stages, and the first stage is already behind us.

   • The regulation arrives in stages
   • Three penalty bands
   • The literacy duty nobody budgeted for