Question 1

What is the EU AI Act?

Accepted Answer

The EU AI Act (Regulation 2024/1689) is the world’s first comprehensive legal framework for artificial intelligence. It establishes harmonised rules for the development, marketing, and use of AI systems within the European Union. The regulation takes a risk-based approach: the higher the risk an AI system poses, the stricter the obligations.

Question 2

When does the EU AI Act take effect?

Accepted Answer

The AI Act entered into force on 1 August 2024, but its requirements apply in phases. Prohibited AI practices became enforceable on 2 February 2025, alongside the AI literacy duty. GPAI obligations apply from 2 August 2025 and transparency obligations under Article 50 from 2 August 2026. After the AI Omnibus, the Annex III high-risk requirements apply from 2 December 2027, and Annex I high-risk systems built into regulated products from 2 August 2028.

Question 3

Who does the EU AI Act apply to?

Accepted Answer

The AI Act applies to providers (developers), deployers (users), importers, distributors, and product manufacturers of AI systems, regardless of where they are based, if their AI system is placed on the EU market or its output is used in the EU. This means non-EU companies serving EU customers are also covered.

Question 4

Does the AI Act apply to companies outside the EU?

Accepted Answer

Yes. If a company provides or deploys an AI system that is placed on the EU market, or if the output of its AI system is used within the EU, the AI Act applies. This extraterritorial scope is similar to the GDPR.

Question 5

What types of AI systems are covered?

Accepted Answer

The AI Act covers AI systems as defined in Article 3(1): software that generates outputs such as predictions, recommendations, decisions, or content. This includes machine learning models, deep learning, logic-based, and statistical approaches. It does not cover traditional software that operates on purely pre-defined rules without adaptive or generative capabilities.

Question 6

What are the four risk levels in the AI Act?

Accepted Answer

The AI Act classifies AI systems into four risk tiers. Unacceptable risk: prohibited outright (e.g., social scoring, manipulative AI). High risk: subject to strict requirements before market placement (e.g., AI in recruitment, credit scoring, critical infrastructure). Limited risk: transparency obligations only (e.g., chatbots, deepfakes). Minimal risk: no specific obligations (e.g., spam filters, AI in games).

Question 7

How do I determine if my AI system is high-risk?

Accepted Answer

Check two things. First, is your system listed in Annex III of the AI Act? This covers areas like biometrics, critical infrastructure, employment, education, law enforcement, and public services. Second, is your AI system a safety component of a product covered by Annex I EU legislation (e.g., machinery, medical devices, vehicles)? If yes to either, your system is likely high-risk. AI and Shine’s platform automates this classification for you.

Question 8

What AI practices are prohibited?

Accepted Answer

The AI Act bans: social scoring by governments, real-time remote biometric identification in public spaces (with narrow exceptions for law enforcement), AI that exploits vulnerabilities of specific groups (age, disability), subliminal manipulation causing harm, emotion recognition in workplaces and educational institutions, untargeted scraping of facial images for facial recognition databases, and biometric categorisation to infer sensitive attributes.

Question 9

What is a General-Purpose AI (GPAI) model?

Accepted Answer

A GPAI model is an AI model trained on broad data at scale that can perform a wide range of tasks (e.g., GPT-4, Claude, Gemini). GPAI providers must provide technical documentation, comply with EU copyright law, and publish a training content summary. Models posing systemic risk (trained with compute >10²⁵ FLOPs) face additional obligations including adversarial testing and incident reporting.

Question 10

What is the difference between a provider and a deployer?

Accepted Answer

A provider develops or commissions an AI system and places it on the market under its own name. A deployer uses an AI system under its authority in a professional capacity. Most companies buying and using AI tools are deployers. Both have obligations, but provider obligations are more extensive (conformity assessment, CE marking, technical documentation). Deployer obligations focus on oversight, risk assessment, and transparency.

Question 11

What are the main obligations for deployers of high-risk AI?

Accepted Answer

Deployers must: use the system according to its instructions, ensure human oversight by trained staff, monitor system operation and report malfunctions, conduct a Fundamental Rights Impact Assessment (FRIA) where required, keep logs generated by the system, inform employees and affected persons about AI use, and register in the EU Database if applicable.

Question 12

What is a Fundamental Rights Impact Assessment (FRIA)?

Accepted Answer

A FRIA is a mandatory assessment for certain deployers of high-risk AI systems. Required for public bodies, banking and insurance, and certain critical infrastructure operators. It evaluates the impact on fundamental rights before the AI system is deployed. The FRIA must describe the deployer’s processes, the period and frequency of use, categories of affected persons, specific risks, and human oversight measures.

Question 13

What is AI Literacy and who needs it?

Accepted Answer

AI Literacy is a requirement under Article 4 of the AI Act, applying from 2 February 2025. All providers and deployers must ensure their staff and anyone operating AI systems on their behalf has sufficient AI literacy, meaning skills and knowledge to make informed decisions about AI, including understanding of opportunities, risks, and potential harms. This is not optional.

Question 14

What are the penalties for non-compliance?

Accepted Answer

Penalties vary by infraction. Prohibited AI practices: up to EUR 35 million or 7% of global annual turnover. High-risk violations: up to EUR 15 million or 3% of global turnover. Supplying incorrect information: up to EUR 7.5 million or 1% of turnover. For each tier, the higher amount applies. National authorities set the exact penalties, which must be effective, proportionate, and dissuasive.

Question 15

Do I need to register my AI system in the EU Database?

Accepted Answer

Yes, if you are a provider of a high-risk AI system listed in Annex III, or a deployer that is a public authority or acts on behalf of one. Registration must happen before the system is placed on the market or put into service. The EU Database is publicly accessible and includes information about the system, its provider, and its conformity assessment.

Question 16

How do I start preparing for the EU AI Act?

Accepted Answer

Step 1: Inventory all AI systems your company uses or provides. Step 2: Classify each system’s risk level. Step 3: Identify your role (provider, deployer, or both) for each system. Step 4: Map out which obligations apply and their deadlines. Step 5: Implement compliance measures (documentation, risk assessments, human oversight, training). AI and Shine automates steps 1–5 in one platform.

Question 17

What documents do I need for compliance?

Accepted Answer

Depending on your role and risk level, you may need: an AI inventory register, risk classification records, Fundamental Rights Impact Assessment (FRIA), data governance documentation, human oversight procedures, incident reporting procedures, AI literacy training course records, transparency notices for affected persons, post-market monitoring plan, and conformity declaration (providers). AI and Shine generates all required documents automatically.

Question 18

How long does it take to become compliant?

Accepted Answer

With AI and Shine, most companies complete their initial compliance setup in 2–4 weeks. This includes AI inventory, risk classification, generating required documents, and setting up governance procedures. Without a dedicated tool, the process typically takes 3–6 months and requires significant legal resources.

Question 19

Can I use AI and Shine if I’m not a legal expert?

Accepted Answer

Absolutely. AI and Shine is designed specifically for business operators, not lawyers. The platform guides you through each step in plain language, automatically classifies your AI systems, generates compliant documents, and provides clear recommendations. No legal background needed.

Question 20

How does AI and Shine help with AI Act compliance?

Accepted Answer

AI and Shine provides an all-in-one compliance platform: automated AI inventory and risk classification, document generation (FRIA, policies, registers), governance dashboard with deadlines and task tracking, AI literacy training course for your team, continuous monitoring and updates as regulations evolve, and multi-language support (EN, PL, FR).

EU AI Act — Frequently Asked Questions

What is the EU AI Act?

When does the EU AI Act take effect?

Who does the EU AI Act apply to?

Does the AI Act apply to companies outside the EU?

What types of AI systems are covered?