It is important that you understand how the Act defines “AI” for the purpose of regulating it, especially given that the term still lacks a universally accepted definition. You can then locate the compliance obligations for your business at the intersections of your role in the AI value chain and the risk levels of your AI system.

Step 1: Determine whether what you are providing or deploying in the EU market is AI - and if so - it falls under which category, under the Act.

The Act defines an AI system as “A machine-based system designed to operate with varying levels of autonomy that may exhibit adaptiveness after deployment and that, for explicit or implicit objectives, infers from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.” Note that this definition aligns with OECD's latest definition and the definition used in the White House Executive Order 14110 on Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence.

The Act defines a GPAI model as "an AI model, including where such an AI model is trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications, except AI models that are used for research, development or prototyping activities before they are released on the market."

The Act also makes a distinction between GPAI models and GPAI systems. Under the Act, a GPAI system is an AI system that is built on top of a GPAI model; therefore, if such a system would meet the criteria for “high-risk” AI systems as laid down under the Act, the corresponding obligations will apply to your business, as stipulated under Article 16 and Article 26 of the Act (refer to Step 3.2 in this section).

Step 2: Determine what role your business plays in the AI value chain. Amongst the several roles that the Act defines in Article 3, the following key roles should cover the wide gamut of functions carried out by most businesses operating in the EU market:

1. Providers. If your business develops an AI system or a GPAI model and/or supplies it in the EU market for distribution or use (for payment or free of charge), the Act will deem you a “provider” of that AI system. If your business engages in fine-tuning of a pre-existing GPAI model and supplies it in the EU market for distribution or use (for payment or free of charge), the Act will deem you a “provider” of that model.
2. Deployers. If your business is using an AI system for any purpose in the EU market, the Act will deem you a “deployer” of that AI system.

Note: Even if your business is established or located outside of the EU, you as a provider or deployer of an AI system or GPAI model will attract the provisions of the Act if the outputs generated by your system or model are used within the EU.

Step 3: Determine where your AI system sits on the risk spectrum. The Act lays down four risk levels depending (a) on the sensitivity of the data used for developing the AI system, and (b) the purported use of the AI system.

1. Unacceptable risk. The Act prohibits your business from providing or deploying an AI system in the EU market that does any one or more of the following:
   1. manipulates a person's behaviour using subliminal techniques
   2. exploits a person's vulnerabilities
   3. rates individuals based on their personal characteristics
   4. enables real-time biometric identification in public places for law enforcement (except for a pre-defined purpose with the approval from an EU court)
   5. enables emotion recognition (except where it intended for a safety purpose)
   6. enables prediction of recidivism (or repeat offense) in persons based simply on their personality traits
   7. enables untargeted scraping of facial images from the web or CCTV footage

   You can find the full descriptions of these prohibitions in Article 5 of the Act.

2. High risk. If you provide an AI system in the EU market that (a) poses significant risk to the health, safety, and fundamental rights of people, or (b) serves as a safety component in a product already regulated in the EU, the Act considers such a system as “high-risk” and requires you to comply with the following obligations:
   1. ensure that the AI system passes the conformity assessment before it enters the EU market
   2. maintain comprehensive technical documentation and risk management throughout the lifecycle of the AI system
   3. implement data governance measures to ensure data quality and mitigation of bias in the AI system
   4. ensure transparency and provide instructions for deployers
   5. conduct a fundamental rights impact assessment of the AI system (if the system is used for credit scoring or life and health insurance underwriting or for rendering any public service)
   6. disclose the capabilities and limitations of the AI system, with your contact information and user instructions
   7. ensure post-market monitoring of the AI system, with incident reporting
   8. implement human oversight, accountability, cybersecurity, and other measures to ensure safe and responsible use of the AI system
   9. cooperate with national competent authorities to demonstrate compliance

   You can find the complete list of obligations for providers of high-risk AI systems in Article 16 of the Act.

   If you deploy a high-risk AI system in the EU market, the Act requires you to comply with the following obligations:

   1. follow the user instructions shared by the provider of the AI system
   2. if you control input data, ensure that such data are suitable for the AI system's intended purpose
   3. disclose the use of the AI system to individuals or groups set to be impacted by the system's outputs
   4. implement human oversight to ensure safe and responsible use of the AI system
   5. in sensitive contexts, provide meaningful explanations for decisions augmented by the AI system's outputs

   You can find the complete list of obligations for deployers of high-risk AI systems in Article 26 of the Act.

3. Limited risk. If you provide or deploy an AI system in the EU market which could potentially manipulate or deceit individuals in the absence of adequate transparency measures, the Act considers such a system to pose “limited risk” and requires you to ensure that the system users are made aware that they are interacting with a machine. To this end, your businesses may voluntarily commit to complying with industry codes of conduct.
4. Minimal Risk. If you provide or deploy an AI system that fits into none of the risk categories above, the Act considers such a system to pose “minimal risk” and requires no mandatory compliance.