EU AI Act, one question at a time

Every EU AI Act deadline from entry into force on 1 August 2024 to the 31 December 2030 transitional cut-off, with the article behind each date.

The ten AI practices banned outright by Article 5 — eight since 2 February 2025, two more from 2 December 2026 — who they bind, and which six realistically apply to a B2B software company.

The general-purpose AI (GPAI) regime has applied since 2 August 2025: the four Article 53 duties, the 10^25 FLOP systemic-risk tier, the open-source carve-out, and the fines.

The high-risk regime applies from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems: Articles 8–15, 16 and 26 — and where the gaps usually are.

Article 111's transitional rules: the cut-off is now a moving reference to the Chapter III dates, what a 'significant change' triggers, and the 2026, 2027 and 2030 deadlines.

Every EU AI Act deadline from publication on 12 July 2024 to the 31 December 2030 transitional cut-off, each with the provision that sets it — including the four dates that moved or arrived in July 2026.

A five-step method to classify an AI system under the EU AI Act: the Article 5 gate, both routes to high-risk, the Article 6(3) exemption, and the paper trail.

All eight Annex III high-risk areas — every point and letter with examples, the two express carve-outs, and how Article 7 lets the list change.

The four Article 50 transparency duties — chatbot disclosure, content marking, emotion-recognition notice, deepfake labels — live since 2 August 2026, with Article 111(4) giving pre-existing synthetic-content systems until 2 December 2026 for 50(2).

Minimal risk is the AI Act's residual, not a category: the Article 4 AI literacy duty, Article 95 voluntary codes, and the Article 6(4) paper trail.

Five yes/no questions to classify an AI system under the EU AI Act: the Article 5 gate, both high-risk routes, the Article 6(3) exemption, Article 50.

The Article 6(3) exemption in full: the general test, the four exhaustive conditions, the profiling override that voids all of them, and the Article 6(4) documentation and Article 49(2) registration a claim creates.

The qualifying test in Article 3, point (1), limb by limb — including the two limbs that die in every summary — and the separate question the Regulation never answers: how many AI systems you have.

We ran the sharpest question a technical buyer asks — against Article 3, point (1), recital 12's own words, and our own engine's verdict on itself, published verbatim including what it got wrong.

We answered our own engine's six questions about the engine and the draft generator, ran the real classify(), and published the outputs verbatim — including the sentence it got wrong about itself.

The Regulation defines what an AI system is and never counts them — the seam the law is sensitive to is intended purpose, and the counting rule we use says plainly which limb is convention, not law.

Article 5(1) point by point — the eight original prohibitions, the two added by Regulation (EU) 2026/1744, and the paragraphs that narrow the new ones before they reach anyone.

The Article 3 definitions of provider and deployer in plain language, the practical test between them, and the Article 16 vs Article 26 obligations each role carries.

The Article 3 tests for importer and distributor, the Article 23 and 24 verification and stop-and-inform duties, and when either role becomes the provider.

The three Article 25(1) triggers that make a deployer the provider — re-badging, substantial modification, repurposing — and what the switch costs.

The Article 22 written mandate a third-country provider must give before its high-risk system reaches the Union, the five tasks it has to empower, and the separate Article 54 regime for general-purpose AI models.

Article 9's risk management system for high-risk AI: the four lifecycle steps, the residual-risk acceptability test, testing rules, and reuse of existing procedures.

Article 10 sets quality criteria for training, validation and testing data: eight governance practices, a representativeness standard, a strict bias pathway.

Article 11(1) requires Annex IV technical documentation before market placement. All nine points, the SME simplified form, and the Article 18(1) ten-year keeping duty.

Article 12's automatic logging duty for high-risk AI, the minimum log set for remote biometric identification, and the six-month retention floors under Article 19 and Article 26(6).

Article 13's provider-to-deployer transparency for high-risk AI: interpretable operation by design, the instructions-for-use quality standard, and the minimum content list.

Article 14's human oversight design duty for high-risk AI: the five overseer capabilities, proportionate measures, the two-person biometric rule, and the deployer's Article 26(2) assignment duty.

Article 15's accuracy, robustness and cybersecurity duties for high-risk AI: declared accuracy metrics, feedback-loop controls, AI-specific attack defences, and the cybersecurity-certification presumption.

Article 4 binds every provider and deployer of AI systems at any risk level. The 2026 rewrite turned a duty to ensure a level into a duty to support development — the standard moved, the date did not.

Which HR tools are high-risk under point 4 of Annex III, why interview emotion analysis is banned, and what vendors and HR buyers owe before the 2 December 2027 deadline.

Credit scoring is high-risk under point 5(b) of Annex III, life and health insurance pricing under 5 (c) — and collections targeting can cross into a ban.

Triage and public-healthcare eligibility AI under Annex III is high-risk from 2 December 2027; device AI needing a notified body under Article 6(1) from 2 August 2028.

GDPR regulates personal-data processing; the AI Act is risk-tiered product regulation for AI systems. Article 2(7) makes both apply at once.

All five EU AI Act fine tiers — from €35M/7% for prohibited practices to the €750k EDPS floor — who imposes each, the caps for SMEs and small mid-caps, and what cuts a fine.