Frequently asked questions

The Act can apply if your organisation places an AI system on the EU market, puts it into service or uses it in the EU, or is established outside the EU but the system's output is used in the EU. Headquarters alone do not decide scope, so the market, users, output and role must be assessed for each system.

The Act defines an AI system broadly: any machine-based system that, for explicit or implicit objectives, infers from input how to generate outputs like predictions, recommendations, or decisions. This includes traditional ML models, LLM-based products, rule-based expert systems with inference, and hybrid approaches.

The Act is phased. Prohibited-practice and AI-literacy provisions have applied since February 2025, and obligations for providers of general-purpose AI models began in August 2025. Article 50 transparency duties apply from August 2026. Following the 2026 AI Omnibus, Annex III high-risk rules apply from 2 December 2027 and high-risk rules for AI embedded in regulated products apply from 2 August 2028. Your duties also depend on whether you are a provider, deployer, importer, or distributor.

Fines range up to €35 million or 7% of global annual turnover (whichever is higher) for prohibited practices, up to €15 million or 3% for other violations, and up to €7.5 million or 1% for providing incorrect information. SMEs and startups face proportionate amounts based on turnover.

Start with our free exposure check. It highlights obvious high-risk, prohibited-practice, and transparency triggers, but it is not a definitive classification. Pilot customers receive a fuller, source-linked assessment reviewed with a qualified compliance professional.

Probably not, unless you're using it in a way that affects employment decisions, access to essential services, or other Annex III areas. Internal knowledge management, drafting, and brainstorming with a general-purpose AI tool typically fall into the minimal or limited-risk category. Transparency obligations may still apply.

Yes. The risk classification is based on the intended purpose and use case, not the technology alone. If you expand a recommendation engine into a credit-scoring tool, it may move from minimal to high-risk. You should reclassify whenever the intended purpose changes materially.

No. The public exposure screen and the workspace answer guidance use defined rules, not a generative AI model. Workspace prompts are versioned and based on structured answers. They do not read supplier documents, infer missing facts or make legal decisions for you.

Record it as unknown rather than guess. The workspace explains what to investigate, why it matters, useful evidence and a suggested colleague to consult. You can save the uncertainty for follow-up. Missing information alone is neither a confirmed risk nor proof of safety, and a suggested contact is not an automatic assignment or email.

The workspace flags selected inconsistencies, such as a material decision about people alongside an answer saying nobody is affected. A detected conflict requires a corrected assessment before map approval; earlier versions remain in history. These checks are not exhaustive and do not replace careful human review.

Contributors can prepare and save the record. An Owner or Administrator must review findings and approve the exposure map. My work shows the outstanding evidence or review step. Approving the map does not approve the regulatory role or classification; those are separate decisions, with role approval required before classification.

No. The free check is an initial screen for one AI use. The workspace adds a deeper assessment, evidence prompts for unknown answers, selected consistency checks, retained versions and controlled reviewer decisions. Neither route certifies compliance or guarantees that every risk has been identified.

A clear system can usually be screened in 10–15 minutes, but a defensible classification may require product, legal, privacy, and technical input. During the pilot we help customers build the inventory, resolve missing facts, and prepare a reviewable evidence pack.

GDPR is separate from the AI Act but often overlaps, especially around automated decision-making, lawful processing, impact assessment, and transparency. The pilot flags areas for specialist review; it does not replace a GDPR assessment.

The UK has its own sector-based legal and regulatory framework rather than the EU's single horizontal AI Act. UK organisations may still fall within the EU AI Act's territorial scope, and should assess UK GDPR, equality, consumer, employment, product-safety and sector-specific duties separately.