How the EU AI Act is built: scope, roles and risk tiers

0:00 Same model, different rules

Imagine two companies using exactly the same AI model. One uses it to write product descriptions. The other uses it to rank job applicants. Under the EU AI Act, the first has almost no specific obligations. The second is running a high-risk AI system. Same model, completely different rules. By the end of this lesson, you will be able to work out whether the Act applies to you, which role you play, and which risk tier each of your AI uses falls into.

0:36 The AI Act in one breath

Start with the big picture. The AI Act, formally Regulation twenty twenty-four slash sixteen eighty-nine, works like product safety law for AI. It sets rules for placing AI systems and general-purpose models on the EU market, putting them into service, and using them. It bans a short list of practices, puts heavy duties on high-risk systems, adds transparency duties for things like chatbots and deepfakes, and has a separate track for general-purpose models. In twenty twenty-six it was amended by the Digital Omnibus on AI, which moved some deadlines. We'll cover those dates in the next module.

1:18 Analogy: road rules

Here's an analogy for the whole structure. Think of the AI Act like road rules for vehicles. Some vehicles are banned outright from public roads. Heavy trucks, the high-risk category, need inspections, logbooks and licensed drivers. Ordinary cars need lights and number plates so others can see and identify them, that's the transparency layer. And bicycles in your own garden face almost no rules at all. Crucially, the rules depend on how and where you drive, not just what you bought. A van used for deliveries and the same van used as a school bus are treated differently.

2:01 Who is in scope

Now, scope. The Act reaches well beyond Europe. It applies to providers placing AI on the EU market wherever they are based, to deployers in the EU, and even to providers and deployers outside the EU when the output of the AI system is used in the EU. So a software house in Lahore selling an AI recruitment tool to a company in Ireland is in scope as a provider. A brand in Riyadh running a chatbot for customers in France should assume the chatbot rules apply. There are exclusions: military and national security uses, scientific research as such, and purely personal use.

2:46 Operators

Next, roles. The Act calls them operators. The provider develops the system and puts it on the market under its own name. The deployer uses it professionally. Importers and distributors move it through the supply chain, and an authorized representative acts in the EU for a non-EU provider. Here is the trap. Under Article twenty-five, you can become the provider of a high-risk system without building anything. If you put your brand on it, substantially modify it, or change its purpose so it becomes high-risk, the provider duties land on you. Buying a general chatbot and repurposing it to screen job applicants is the classic example.

3:32 The risk pyramid

Now the risk pyramid. At the top, unacceptable risk: prohibited practices such as social scoring or emotion recognition in workplaces. Below that, high risk: AI in regulated products like medical devices and machinery, and AI in sensitive areas listed in Annex three, such as employment, education, credit scoring and access to essential services. Then transparency risk: chatbots, synthetic content, deepfakes, emotion recognition and biometric categorization carry disclosure duties. And at the base, minimal risk, which is most AI. One product can sit in two layers at once. A recruitment chatbot is both high-risk and subject to chatbot disclosure.

4:15 Enforcement

Who enforces all this? The AI Office inside the European Commission supervises general-purpose models and coordinates everything. The European AI Board brings Member States together, with a scientific panel and an advisory forum. National market surveillance authorities enforce the rules on AI systems in each country. And your data protection authority still enforces GDPR in parallel. That last point matters. Even minimal-risk AI can breach privacy, consumer or advertising law.

4:45 Worked example: UK retailer

Let's classify five uses at a UK retailer that sells into the EU. The product description generator is minimal risk. The customer chatbot carries transparency duties. The CV screening tool for warehouse jobs is high risk, because employment is in Annex three. The dynamic pricing model is usually minimal risk under the AI Act, although consumer and competition law still bite. And the webcam tool that detects staff emotions is prohibited. In the lesson text you'll find a seven-step decision tree. Run every tool in your inventory through it, and write down your reasoning, because the reasoning is what clients and auditors will ask for.

5:31 Example 2: Karachi designer, French client

Now a simpler example. A freelance designer in Karachi uses an image generator to create illustrations for a French client's brochure. Is she in scope? Her output is used in the EU, so the Act can reach her work. But what applies? She's a deployer of a general-purpose image tool. The illustrations are stylized, not realistic depictions of real people or events, so they aren't deepfakes. Her main practical duties come from the client contract, copyright and the tool's terms. The lesson: scope doesn't automatically mean heavy obligations. Classification tells you how much actually applies.

6:12 Common mistakes

Three mistakes come up again and again. First, assuming we're not in the EU, so it doesn't apply, while serving EU customers or sending outputs into the EU. Second, classifying the vendor's product instead of your use of it. The vendor's marketing page might say low risk, but if you use the tool to rank job applicants, you're in high-risk territory. Third, forgetting that everything else still applies. Even minimal-risk AI must respect GDPR, consumer protection and advertising law. Classification under the AI Act is one question, not the only question.

6:52 Watch me do it: classify rows

Watch me do it. I'm taking the register from the last lesson and adding three columns: In scope, Role, and Tier, plus a Reasoning column. Row one, the chat assistant used for drafting. Is it an AI system? Yes. Is output used in the EU? Yes, we have a German client. Role: deployer, because we use it under our authority and haven't rebranded it. Prohibited? No. Annex three use? No, it's drafting marketing copy. Interacts with the public? No, staff only. So tier: minimal, reasoning: internal drafting, AI literacy applies. Row two, the help desk reply suggestions. Deployer again. Customers don't talk to it directly, agents do, so minimal, but I note: if we ever switch on auto-replies to customers, Article fifty disclosure applies. Row three, a new pilot: a CV screening add-on in our HR tool. Employment is Annex three, so tier: high-risk candidate. I check Article six three: it ranks candidates, which is profiling, so no exemption. I mark it amber and write escalate before rollout. Notice what just happened: three minutes of structured questions turned a vague worry into one clear decision for leadership.

8:13 Recap and next step

Recap. The AI Act regulates uses, not models, so classify what you do with a tool, not the tool itself. It reaches outside the EU whenever your AI or its output touches the EU. Know your role, and watch for Article twenty-five, which can turn a deployer into a provider. Your next step: take the AI tool list you started last lesson and run each entry through the decision tree in the lesson text. Mark each one prohibited, high-risk candidate, transparency, or minimal, and note why.