AI Act glossary — key terms in plain language

The EU AI Act (Regulation 2024/1689) brings its own vocabulary: four risk levels, the provider and deployer roles, and transparency and oversight obligations. Below are the key terms in one sentence each — no bureaucratic jargon. Most provisions apply from 2 August 2026; some prohibitions have applied since February 2025, while full duties for selected high-risk systems fall in 2027 or 2028.

Risk levels

AI system (Art. 3) — software that, from input data, generates outputs (predictions, content, recommendations, decisions) with some autonomy. A plain rule-based script is not an AI system.
Prohibited practices (Art. 5) — banned uses (e.g. social scoring, manipulation exploiting vulnerabilities, emotion recognition at work and in education); the ban has applied since February 2025.
High-risk system — a system under Annex III (e.g. recruitment, scoring, education, biometrics) or a safety component of a product (Annex I); full duties fall on 2 December 2027 and 2 August 2028 respectively.
Transparency obligations (Art. 50) — a chatbot must disclose it is AI, and AI-generated content (including deepfakes) must be labelled; this is the limited-risk level.
Minimal risk — most business uses (search, summaries, document assistants); no legal obligations under the AI Act.
GPAI (general-purpose AI model) — a foundation model (e.g. a large language model) with a separate layer of obligations, mostly on the model provider, in force since 2 August 2025.

Roles and obligations

Provider — whoever develops a system or model and places it on the market under their own name (including when the build is outsourced).
Deployer — a company that uses an AI system under its own control; most companies that “just use” off-the-shelf tools are deployers and have their own obligations.
AI literacy (Art. 4) — the duty to ensure that the people operating AI have a practical understanding of where it helps and where it errs; it is not a prompt-writing course.
Human oversight (Art. 14) — for high-risk systems there must be a person who understands the system, can challenge its output and stop it before it causes harm.

Operational terms

Shadow AI — AI tools used by employees outside the company’s knowledge and control; they raise the risk of data leaks and make compliance harder.
KRiBSI — the national supervisory body provided for by Poland’s Act on AI systems. The Act was published on 27 July 2026 as Journal of Laws 2026, item 1003: Article 125(4) applies from 28 July 2026, most remaining provisions from 11 August 2026, and Articles 8–18 plus Chapters 3–5, 8 and 9 from 28 October 2026.

What next

How to use these terms in practice — to walk system by system and assign each to a risk level — is in our AI Act risk-classification method. How to keep compliance over time is in governance for regulated industries. For a diagnosis of your own company, start with an EU AI Act compliance audit.