Chapter I and Chapter III Section 1: who the AI Act applies to, the defined roles and terms, the AI literacy duty, and the two routes by which an AI system becomes high-risk, plus the Article 6(3) exemption.
Who and what the AI Act covers: providers, deployers, importers, distributors, product manufacturers and authorised representatives, the reach to non-EU firms whose output is used in the EU, and the exclusions for military, research, personal use and open-source systems.
The defined terms that decide who owes what: AI system, provider, deployer, operator, placing on the market, intended purpose, substantial modification and serious incident, plus the Commission's guidelines on the AI system definition.
The duty on every provider and deployer, at any risk level, to take measures supporting the AI literacy of staff and others operating AI on their behalf, as reworded by the 2026 Digital Omnibus, and what the Commission says counts as evidence.
The product route to high-risk status: AI that is a safety component of, or is itself, a product under the Annex I harmonisation legislation and needs third-party conformity assessment, as clarified and moved to 2 August 2028 by the 2026 amendments.
The use-case route to high-risk status: the eight Annex III areas from biometrics and critical infrastructure to employment, credit scoring, law enforcement, migration and justice, how the Commission can amend the list, and when the obligations apply.
The exemption for Annex III systems that pose no significant risk: the four conditions, the profiling override, the documented assessment and registration duties, and how a market surveillance authority can challenge a misclassification.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.