Law explorer
Law explorer: EU AI Act
Key articles of the EU AI Act with plain-language summaries, who each applies to, when, and a link to the official text.
Time: Ongoing · What you will get: Summaries with links to the official text · Works offline in your browser. Nothing is uploaded.
A selection of about 25 key articles, grouped by chapter. It is not the whole Act. Use the official text for the full list. Official text: EU AI Act on EUR-Lex ↗. Look up each article number there; ClearPath does not reproduce the legal text.
Chapter I: General provisions (Articles 1 to 4)
Article 1: Subject matter
Sets the Act's purpose: common rules for AI in the EU that support human-centric, trustworthy AI while protecting health, safety and fundamental rights.
Applies to: everyone · When: In force
Related: EU page
Article 2: Scope
Says who is covered: providers placing AI on the EU market, deployers in the EU, and providers and deployers elsewhere whose system outputs are used in the EU. It also lists exclusions, such as military and defence uses.
Applies to: provider, deployer, everyone · When: In force
Related: Applicability checker
Article 3: Definitions
Defines the terms the Act uses, such as AI system, provider, deployer, importer, distributor, serious incident and general-purpose AI model.
Applies to: everyone · When: In force
Related: Glossary
Article 4: AI literacy
Providers and deployers must take measures to support the AI literacy of their staff and others who use AI for them. After the Digital Omnibus the duty is reported to be to take measures to support literacy, not to guarantee a specific level.
Applies to: provider, deployer · When: In force
Not settledReportedly softened by Regulation (EU) 2026/1744. Check the current text.
Related: Learning paths
Chapter II: Prohibited AI practices (Article 5)
Article 5: Prohibited AI practices
Bans certain uses outright, including harmful manipulation, exploiting vulnerabilities, social scoring, some predictive policing based on profiling, untargeted scraping of faces, emotion recognition at work or school, and some biometric uses. Two more prohibitions apply from 2 December 2026: AI that generates non-consensual intimate imagery of identifiable people, and child sexual abuse material.
Applies to: provider, deployer · When: Since 2 Feb 2025; two additions from 2 Dec 2026
Not settledTwo prohibitions added by Regulation (EU) 2026/1744.
Related: EU risk screening
Chapter III: High-risk AI systems (Articles 6 to 49)
Article 6: Classification of high-risk systems
Explains when a system is high-risk: as a safety component of a regulated product (Annex I) or when used in the areas listed in Annex III, such as employment, credit and education. There are limited exceptions where a system poses no significant risk.
Applies to: provider, deployer · When: Annex III: 2 Dec 2027. Products: 2 Aug 2028 (reported)
Not settledDates moved by Regulation (EU) 2026/1744.
Related: EU risk screening
Article 9: Risk management system
Providers of high-risk systems must run a continuous risk management process through the system's life: identify risks, evaluate them, treat them and test the system.
Applies to: provider · When: With the high-risk dates
Related: Risk register
Article 10: Data and data governance
Training, validation and testing data must be relevant, representative as far as possible, and examined for bias, with documented data practices.
Applies to: provider · When: With the high-risk dates
Related: Data lineage mapper
Article 11: Technical documentation
Providers must prepare and keep up-to-date technical documentation showing how the system meets the requirements.
Applies to: provider · When: With the high-risk dates
Related: System card builder
Article 12: Record-keeping
High-risk systems must be able to log events automatically so that their operation can be traced.
Applies to: provider · When: With the high-risk dates
Related: Controls tracker
Article 13: Transparency and information to deployers
High-risk systems must come with clear instructions so deployers can understand and use them properly, including limits and the level of accuracy.
Applies to: provider, deployer · When: With the high-risk dates
Related: System card builder
Article 14: Human oversight
High-risk systems must be designed so people can oversee them effectively, understand their output and intervene or stop them.
Applies to: provider, deployer · When: With the high-risk dates
Related: Oversight lesson
Article 15: Accuracy, robustness and cybersecurity
High-risk systems must reach an appropriate level of accuracy, be robust against errors and attempts to manipulate them, and be secure.
Applies to: provider · When: With the high-risk dates
Related: Testing plan
Article 16: Obligations of providers of high-risk systems
Lists what providers must do: meet the requirements, run a quality management system, keep documentation and logs, carry out conformity assessment, register the system and take corrective action.
Applies to: provider · When: With the high-risk dates
Related: Controls tracker
Article 17: Quality management system
Providers must have a documented quality management system covering compliance strategy, design, testing, data, risk, monitoring and incident reporting.
Applies to: provider · When: With the high-risk dates
Related: ISO/IEC 42001 gap analysis
Article 25: Responsibilities along the AI value chain
Explains when a distributor, importer, deployer or other party becomes the provider, for example by putting their name on a system or substantially changing it, and what suppliers must share.
Applies to: provider, deployer, importer · When: With the high-risk dates
Related: Vendor due diligence
Article 26: Obligations of deployers of high-risk systems
Deployers must use the system as instructed, assign trained human oversight, monitor operation, keep the logs they control, inform workers and affected people and report serious incidents.
Applies to: deployer · When: With the high-risk dates
Related: Controls tracker
Article 27: Fundamental rights impact assessment
Certain deployers, such as public bodies and some private bodies providing public services, must assess the impact on fundamental rights before first use of a high-risk system.
Applies to: deployer · When: With the high-risk dates
Related: Impact assessment builder
Article 43: Conformity assessment
Sets the procedures a provider follows to show a high-risk system meets the requirements before it is placed on the market.
Applies to: provider · When: With the high-risk dates
Related: Glossary: conformity assessment
Article 49: Registration
Providers (and in some cases deployers) must register certain high-risk systems in the EU database before placing them on the market or using them.
Applies to: provider, deployer · When: With the high-risk dates
Related: AI register
Chapter IV: Transparency obligations (Article 50)
Article 50: Transparency obligations for certain AI systems
People must be told when they interact with an AI system, AI-generated or manipulated audio, image, video and text must be marked in a machine-readable way and deepfakes disclosed, and people exposed to emotion recognition or biometric categorization must be informed. Generative systems already on the market before 2 August 2026 have until 2 December 2026 for marking.
Applies to: provider, deployer · When: 2 Aug 2026; marking for existing systems by 2 Dec 2026
Not settledMarking transition set by Regulation (EU) 2026/1744.
Related: AI content label tool, Transparency notice template
Chapter V: General-purpose AI models (Articles 51 to 56)
Article 53: Obligations for providers of general-purpose AI models
Providers of general-purpose models must keep technical documentation, give information to downstream providers, have a copyright policy and publish a summary of training content.
Applies to: gpai · When: Since 2 Aug 2025
Related: EU page
Article 55: Obligations for models with systemic risk
Providers of the most capable general-purpose models carry extra duties, such as model evaluation, risk mitigation, incident reporting and cybersecurity.
Applies to: gpai · When: Since 2 Aug 2025
Related: EU page
Chapter IX: Post-market monitoring, information sharing and market surveillance (Articles 72 to 94)
Article 72: Post-market monitoring by providers
Providers of high-risk systems must set up a system that collects and reviews data on performance after release, and act on what it shows.
Applies to: provider · When: With the high-risk dates
Related: Testing and monitoring plan
Article 73: Reporting of serious incidents
Providers of high-risk systems must report serious incidents to the market surveillance authorities within set deadlines, with shorter deadlines for the most severe cases.
Applies to: provider · When: With the high-risk dates
Related: Incident toolkit
Chapter XII: Penalties (Articles 99 to 101)
Article 99: Penalties
Member states set penalties, including administrative fines, for breaches. Amounts are not stated here because they have not been verified from the primary source.
Applies to: everyone · When: Phased
Related: EU page
Chapter XIII: Final provisions (Articles 102 to 113)
Article 113: Entry into force and application
Sets when the Act and its parts apply. Application is phased, and the Digital Omnibus on AI moved some dates in 2026.
Applies to: everyone · When: See key dates
Not settledDates changed by Regulation (EU) 2026/1744.
Related: Key dates
For reference purposes only. Not legal advice. Screening results are for review, never a statement that something is compliant. Rules change often; check the primary sources and qualified counsel before you act.
Was this page useful? Tell us what is missing or wrong ↗ · Report a correction