Reference

EU AI Act glossary

Key terms from the AI Act, in plain English. Article numbers point to where each term is defined or used.

Search terms

AI Office: The European Commission body that supervises general-purpose AI models, develops guidance and codes of practice, and (since 2026) directly supervises certain AI systems built on GPAI models.
AI literacy: The skills, knowledge and understanding that let people make informed use of AI and be aware of its opportunities, risks and possible harms. Providers and deployers must take measures to support it among their staff (Article 4).
AI regulatory sandbox: A controlled framework set up by an authority where organisations can develop and test innovative AI under supervision before placing it on the market.
AI system: A machine-based system designed to operate with varying levels of autonomy that infers from its inputs how to generate outputs — predictions, content, recommendations or decisions — that can influence physical or virtual environments (Article 3(1)).
Annex I: The list of EU product-safety laws (e.g. medical devices, toys, machinery). AI that is a safety component of, or itself, such a product requiring third-party assessment is high-risk.
Annex III: The list of eight high-risk use-case areas: biometrics; critical infrastructure; education; employment; essential services; law enforcement; migration and border control; justice and democratic processes.
Authorised representative: An EU-based person or organisation mandated in writing by a non-EU provider to carry out certain obligations on its behalf.
CE marking: The mark showing a high-risk AI system conforms with the AI Act's requirements, affixed after a successful conformity assessment.
Conformity assessment: The process of showing that a high-risk AI system meets the Act's requirements — either through internal control or with a third-party notified body (Article 43).
Deep fake: AI-generated or manipulated image, audio or video content that resembles real people, objects, places or events and would falsely appear authentic. Deployers must disclose it (Article 50).
Deployer: A person or organisation using an AI system under its authority, except for personal, non-professional activity.
Digital Omnibus on AI: Regulation (EU) 2026/1744, in force from 27 July 2026. It amended the AI Act — delaying high-risk deadlines, adding prohibitions, softening AI literacy and extending SME relief to small mid-caps.
Distributor: A supply-chain actor, other than the provider or importer, that makes an AI system available on the EU market.
Emotion recognition system: An AI system that identifies or infers people's emotions or intentions from biometric data. Prohibited in workplaces and education (except for medical or safety reasons); high-risk elsewhere.
EU database: The public EU-wide database in which high-risk AI systems (and certain deployers) must be registered (Article 71).
Fundamental rights impact assessment (FRIA): An assessment some deployers of high-risk AI — public bodies, providers of public services, and users of credit-scoring and life/health insurance pricing AI — must carry out before first use (Article 27).
General-purpose AI (GPAI) model: An AI model, typically trained on large data at scale, that displays significant generality and can competently perform a wide range of distinct tasks and be integrated into many downstream systems.
GPAI Code of Practice: A voluntary code published in July 2025, with chapters on transparency, copyright, and safety and security, that GPAI providers can follow to demonstrate compliance.
Harmonised standard: A European standard developed at the Commission's request. Following it gives a presumption of conformity with the requirements it covers.
High-risk AI system: An AI system covered by Annex I (regulated products) or Annex III (sensitive use cases) that must meet strict requirements before and after it is placed on the market.
Human oversight: Measures allowing people to understand, monitor, intervene in and stop a high-risk AI system, and to avoid over-relying on its outputs (Article 14).
Importer: An EU-established actor that places on the market an AI system bearing the name or trademark of a non-EU provider.
Intended purpose: The use for which the provider intends an AI system, including the specific context and conditions, as described in instructions for use, promotional materials and technical documentation.
Market surveillance authority: The national authority that monitors the market, investigates and enforces the Act.
Notified body: An independent organisation designated to carry out third-party conformity assessments.
Placing on the market: The first making available of an AI system or GPAI model on the EU market.
Post-market monitoring: The provider's ongoing collection and review of data on how a high-risk AI system performs after it is on the market (Article 72).
Profiling: Automated processing of personal data to evaluate aspects of a person, such as performance, economic situation, health, preferences, behaviour or location (as defined in the GDPR). Annex III systems that profile are always high-risk.
Provider: A person or organisation that develops an AI system or GPAI model, or has one developed, and places it on the market or puts it into service under its own name or trademark.
Real-time remote biometric identification: Identifying people at a distance by comparing their biometric data with a database, with no significant delay. Prohibited for law enforcement in public spaces except in narrow cases.
Serious incident: An incident or malfunction leading to death or serious harm to health, serious disruption of critical infrastructure, infringement of fundamental-rights obligations, or serious harm to property or the environment. Must be reported (Article 73).
Small mid-cap (SMC): Added in 2026: a company with fewer than 750 employees and turnover up to €150m or a balance sheet up to €129m, which benefits from the SME simplifications.
Substantial modification: A change to an AI system after it is placed on the market that wasn't foreseen in the conformity assessment and affects compliance or the intended purpose.
Systemic risk: A risk specific to the high-impact capabilities of the most advanced GPAI models, with significant effects on the EU market or on public health, safety, security or fundamental rights. Presumed above 10²⁵ FLOPs of training compute.