The AI Act, explained simply

The official terms from the regulation, kept exactly as you'll encounter them everywhere — but explained in plain language, in enough depth to actually understand them, not just recognise them.

AI Act#: A European Union regulation governing how AI systems must be developed and used so they don't harm people. Entering into force in stages from 2024 to 2027, with different obligations becoming applicable on different dates depending on risk severity. Unlike many other regulations, it applies directly across all member states, without needing a separate national law.
AI System#: Software that, based on the input it receives, produces outputs such as predictions, recommendations, or decisions affecting a real environment — from a chatbot to a credit-scoring system. The definition is deliberately broad and covers far more tools than people usually associate with "artificial intelligence."
Provider#: The company or person that develops an AI system or places it on the market under its own name. Carries the heaviest obligations under the regulation — including full technical documentation, conformity assessment, and ongoing post-market monitoring.
Deployer#: The company that uses an already-built AI system in its operations without having developed it itself — e.g. a company that buys AI software for candidate screening. Has its own, lighter but real obligations — including informing affected individuals and maintaining human oversight of the system's decisions.
Risk Level#: The AI Act divides systems into four levels: unacceptable risk (prohibited practices), high risk (strict documentation and oversight requirements), limited risk (mainly transparency obligations), and minimal risk (almost no obligations). The classification determines the entire scope of obligations you must meet.
Prohibited Practices#: AI applications the regulation bans outright, no exceptions — for example social scoring of citizens, manipulative techniques that bypass a person's conscious choice, or emotion recognition in the workplace in certain contexts.
Technical Documentation (Annex IV)#: The package of documents required for high-risk systems — description of the architecture, training data, risk management measures, and testing evidence. Must be kept up to date throughout the system's lifecycle, not just produced once at launch.
Conformity Assessment#: The process by which a provider proves its high-risk AI system meets all regulatory requirements before placing it on the market. Certain cases require the involvement of an independent notified body.
General-Purpose AI (GPAI)#: An AI model capable of performing a wide range of tasks (e.g. large language models). Has its own separate set of obligations under the regulation, including technical documentation and systemic risk assessment for the most capable models.
Fundamental Rights Impact Assessment (FRIA)#: A mandatory analysis for certain deployers of high-risk systems — assesses how the system may affect real people's rights before it's put into use. Particularly applicable to public bodies and certain financial institutions.
ISO/IEC 42001#: An international standard for AI management systems — a voluntary framework our own ATC Trust Standard is built on top of. Provides a structured process for managing AI risk within an organisation, independent of any specific regulatory regime.
GEO (Generative Engine Optimization)#: The practice of structuring your content so AI systems (ChatGPT, Gemini, Perplexity) discover and represent you accurately in their generated answers. A new discipline following the logic of classic SEO, but with different technical requirements.
Agentic AI#: An autonomous AI system capable of taking action on a user's behalf — searching, comparing, and even completing a purchase or booking without direct human involvement at every step. A fast-growing category raising new technical and regulatory questions.
AI Content Labelling#: The obligation to clearly indicate that certain content (text, image, audio, video) has been wholly or partly generated by artificial intelligence — so users aren't misled into thinking they're viewing authentic, unedited material.
Penalties under the AI Act#: Fines for breaches reach up to €35 million or 7% of the company's global annual turnover — whichever is higher, depending on the severity of the breach. Even lighter breaches of transparency requirements carry their own, though lower, penalties.
Notified Body#: An independent organisation authorised to assess the conformity of certain high-risk AI systems before they're placed on the market — playing a role similar to certification bodies in other industries.
AI Literacy#: An obligation on companies to ensure staff working with AI systems understand enough about how they function and what their risks are — no technical expertise required, but a basic, documented understanding is.
Deployer Liability for Unauthorized Use#: A legal principle independent of management's internal awareness: if an employee uses AI in a way that breaches the AI Act, responsibility before the regulator remains with the company as deployer, not with the employee. Management's ignorance does not exempt the company from a penalty.