Although the AI Act is structured as a horizontal legal act—meaning it generally applies to all areas of life—it also incorporates numerous elements of product safety law. In this regard, Annex I of the AI Act refers to the EU’s harmonized product safety regulations, which are sector-specific. The product safety approach incorporates traditional elements such as conformity assessment, market surveillance, and CE marking. 

In addition, the AI Act takes a risk-based approach by linking the obligations for making a specific AI system available to its risk to the health and safety of persons, as well as its suitability for interfering with fundamental and human rights and derives different obligations for the providers and operators of AI systems from this relationship. 

On May 7, 2026, the European Parliament and the Council of the European Union reached a political agreement on targeted amendments to the AI Act as part of the so-called “Digital Omnibus on AI.” The agreement was published in the Official Journal of the European Union as Regulation (EU) 2026/1744 (Digital Omnibus Regulation on AI). The aim of the amendments is to simplify the application and implementation of the AI Act, make it more innovation-friendly, and ensure the intended level of protection 

Persons Subject to the AI Act 

The legal framework applies to public and private actors within the EU as well as outside the EU, provided that an AI system is made available on the EU internal market or is used by individuals within the EU (the so-called “marketplace principle”). The personal scope of application covers in particular: 

Private, non-professional uses are exempt. Similarly, the AI Act does not apply to AI systems or AI models used solely and exclusively for scientific purposes. There are also exemptions from the scope of application for certain open-source AI systems. 

Risk-Based Approach 

 The AI Act distinguishes AI systems according to their risk and links them to various obligations, primarily for providers and deployers of such AI systems. It should be noted, however, that regardless of the risk category, the general provisions of the AI Act apply to all AI systems (such as the  obligation for AI literacy).  

1. Prohibited AI Applications 
 

The AI Act prohibits AI systems that pose an unacceptable risk to society or fundamental rights. These include: 

2. High-Risk AI Systems 

The AI Act defines certain AI applications as “high-risk.” This applies to two main categories: 

Such systems are subject to rigorous testing before and during their use. Providers of such systems must meet a wide range of requirements, for example in the areas of risk management, data governance, technical documentation, human oversight, robustness, and cybersecurity. If the AI systems meet these standards, an EU declaration of conformity is issued. They must then bear a CE marking. However, even after being placed on the market, these systems must continue to be monitored by the provider. 

3. Limited Risk 

AI systems with limited risk, such as simple chatbots, do not require a specific conformity assessment. However, they are subject to specific transparency requirements. These include:  

In addition, AI-generated or modified content (e.g., deepfakes) must be clearly identifiable as such. Sophisticated models that pose potential systemic risks must comply with additional testing and reporting requirements. 

Obligations under the AI Act 

In principle, all AI systems (with the exception of those expressly mentioned in Article 2 of the AI Regulation) fall within the scope of the AI Regulation. However, there are only a few obligations that apply to all AI systems—regardless of risk. One obligation that applies to all providers and operators is that of AI literacy. 

Art. 4, as amended by Regulation (EU) 2026/1744, requires providers and deployers of AI systems to take measures to promote AI literacy among their staff and other individuals who, on their behalf, are involved in the operation or use of AI systems. In particular, this includes the technical knowledge, practical experience, training and continuing education of the individuals concerned, the specific operational context of the AI system, and the individuals or groups of individuals affected. The regulation does not prescribe specific training measures or a specific level of competence. To provide guidance, the European Commission publishes practical examples on its central information platform showing how to fulfill the obligations under Art. 4(1). The AI Panel adopts recommendations, including by setting common goals, to support the promotion of AI literacy. 

To support the implementation of Art. 4 of the AI Act, the AI Office, which is part of the European Commission, has published a list of frequently asked questions on AI literacy and established a continuously expanding repository of practical examples (“Repository of AI Literacy Practices”). It currently comprises more than 40 initiatives from the private and public sectors and is designed to promote the transfer of knowledge and the exchange of best practices among providers, operators, and the general public. 

Obligations for Providers of High-Risk AI Systems 

Providers of high-risk AI systems, in particular, are subject to extensive obligations that begin as early as the development phase of the high-risk AI system. These obligations include, in particular, the following points: 

These obligations extend across the entire lifecycle of the high-risk AI system—from development through placing on the market to use and, finally, decommissioning. In addition to the obligations mentioned above, the provider must subject the high-risk AI system to an appropriate conformity assessment procedure in accordance with Art. 43 of the AI Act, issue a declaration of conformity in accordance with Art. 47 of the AI Act, and affix the CE marking in accordance with Art. 48 of the AI Act. 

Furthermore, automatically generated logs must also be retained for at least six months in accordance with Art. 12 of the AI Act, provided they are under the provider’s control (Art. 19 AI Act). If it turns out that a system does not comply with the Regulation, providers must immediately take appropriate corrective measures, withdraw the system from the market if necessary, and inform the relevant stakeholders (Art. 20 AI Act).  

In addition, there is a comprehensive obligation to cooperate with the competent authorities. Upon request, all information must be provided, including access to relevant logs—while complying with applicable confidentiality requirements (Art. 21 AI Act). Providers based outside the EU must also designate an authorized representative established within the Union who, among other things, maintains the conformity documentation, responds to inquiries from authorities, and ensures compliance with registration requirements (Art. 22 AI Act). 

Obligations for Deployers of High-Risk AI Systems (Art. 26 AI Act) 

Deployers of high-risk AI systems are also subject to comprehensive obligations designed to ensure the safe, legally compliant, and responsible use of the systems. These include, among others, the following obligations: 

Transparency and Information Requirements (Art. 50 AI Act) 

For AI systems with limited risk, transparency and information obligations are primarily prescribed. Thus, Art. 50 of the AI Act requires providers and deployers to implement specific transparency measures with respect to affected natural persons. AI systems intended to interact with humans must be designed in such a way that users are informed that they are interacting with an AI system (para. 1). Providers of AI systems that generate synthetic or manipulated content (e.g., text, images, audio, or video) must clearly label such content, unless a legal exception applies (paragraphs 2, 4). Operators of emotion or biometric categorization systems must inform data subjects and comply with the data protection requirements of the GDPR or Directive (EU) 2016/680 (para. 3). 

This information must be provided no later than the first interaction and must be accessible without barriers (para. 5). The European Commission will issue guidelines and supplementary implementing regulations to support the implementation of these obligations. 

General-Purpose AI (GPAI) 

According to Article 3 No. 63 of the AI Act, a general-purpose AI model— such as large language models (LLMs), is a model that—for example, through training with large amounts of data under comprehensive self-monitoring—exhibits significant general-purpose capability. It is capable of competently performing a broad spectrum of different tasks, regardless of how it is placed on the market, and can be integrated into a wide variety of downstream systems or applications. Excluded are models used exclusively for research and development purposes or as prototypes.  

General-purpose AI models, such as large language models (LLMs), must, in accordance with Art. 53 of the AI Act: 

AI models posing systemic risks are subject to additional obligations, such as risk analyses and reporting requirements. 

A systemic risk exists when a general-purpose AI model, due to its high impact and widespread use, can have significant effects on public health, safety, fundamental rights, or society as a whole. According to Art. 51 of the AI Act, such a model is considered to pose a systemic risk if it either a) is particularly powerful —that is, it has a demonstrably high impact, as measured against technical benchmarks—or b) there is a qualified scientific warning or the criteria set forth in Annex XIII of the AI Act are met.  

The classification procedure is governed by Art. 52 of the AI Act: providers must inform the Commission of a potential classification. At the same time, they may provide a reasoned explanation as to why no systemic risks exist. The Commission reviews this and may classify models accordingly or, at the provider’s request, conduct a reassessment. A public list of systemic models is maintained—while respecting trade secrets and intellectual property rights. 

The European Commission may consider additional criteria such as model capabilities, number of users, scalability, or accessibility (see Annex XIII of the AI Act) and may adjust thresholds in the future. The AI Office established by the AI Act within the European Commission is directly responsible for overseeing GPAI. 

Promoting Innovation – AI Regulatory Sandboxes  

To promote innovation and competitiveness, the AI Act provides for so-called “regulatory sandboxes”. These test environments enable companies—particularly startups and SMEs—to develop and test new AI applications under real-world conditions. In these environments, the regulatory framework is simulated while support is provided by the relevant authorities. The goal is to bring innovative AI solutions to market more quickly and safely, while also facilitating compliance with legal requirements.