Does the EU AI Act Apply to Your Company? A Free Video Series
This free English-language video series works through Regulation (EU) 2024/1689, the EU Artificial Intelligence Act, article by article, in the version amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026. It is written for executives and in-house legal and compliance teams at US technology companies whose AI systems, or the output of those systems, reach the European Union. The legal position is stated as at September 2026.
The first nine episodes set out why the EU AI Act is built as product safety law rather than data protection law, and then work through the connecting factors in Art. 2, including the rule that reaches a provider or deployer in a third country where the output of the system is used in the Union. They cover the exclusions for national security, sole-purpose scientific research, pre-market development and free and open-source releases, each of which is narrower than it is commonly assumed to be, and the definition of an AI system in Art. 3(1). The operator roles follow, because every obligation in the Regulation is addressed to a role and not to a company; Art. 25 is treated in detail, since rebranding, a substantial modification or a change of intended purpose can turn a deployer into the provider of a high-risk system. Three episodes work through the ten prohibited practices in Art. 5, and Band 1 closes with the AI literacy duty in Art. 4, which has applied since 2 February 2025. Band 2 then takes the high-risk regime of Chapter III from the two classification routes through the requirements of Art. 8 to 15 and the provider and deployer obligations to conformity assessment, CE marking and registration, against the deferred dates of 2 December 2027 and 2 August 2028. Band 3 covers what binds already: the transparency duties in Art. 50, the Chapter V track for general-purpose AI models with the four duties of Art. 53 and the additional obligations in Art. 55, and then supervision by the national authorities and the AI Office, the fine tiers of Art. 99 to 101 and the individual rights in Art. 85 to 87. Throughout, the series separates what already applies from what the Digital Omnibus deferred; descriptions of the timetable published before July 2026 no longer reflect the text.
The episodes last roughly ten to fifteen minutes, can be watched in any order, and each one names the provisions it discusses, so a single article can be found directly; no prior knowledge of European product safety law is assumed. The videos are free; no registration, account or email address is required. After the closing knowledge check a confirmation of participation can be generated; it is not a certificate in the sense of an accreditation, because Article 4 of the EU AI Act provides for none. The videos are in English, and the German terms of the Regulation are given where they diverge.
Article 4 of the EU AI Act — the duty to support AI literacy — is the subject of episode 9 and the provision most often asked about. It has applied since 2 February 2025, the digital omnibus did not defer it, and it appears in no penalty tier of Article 99.
- Which connecting factor in Art. 2(1) reaches you, including the output rule in point (c)
- Whether your own software is an AI system under Art. 3(1) and where Chapter V applies as well
- Whether you act as provider or deployer, and when Art. 25 makes a customer the provider of a high-risk system
- Which of the ten prohibitions in Art. 5 a bought-in system can trigger, not only one you built
- Which duties bind you today under Art. 4 and Art. 5, and which begin in December 2026, 2027 and 2028
This series is general information on Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 and does not constitute advice on an individual matter. Advice is given on the law of the European Union and on German law, on the basis of admission to the German bar. There is no admission to practice in any jurisdiction of the United States.
Series completed 2026-09-20 · Rechtsanwalt Theo Funk, Rechtsanwaltskammer Bamberg
The narration of this series was produced with a voice model trained on the speaker's own voice. The script, the slides and every legal statement are his own.
EU AI Act Article Index: Which Episode Covers Which Article
The table lists the provisions discussed in each episode. It follows the order of Regulation (EU) 2024/1689 and includes the amending provisions of Regulation (EU) 2026/1744 where an episode depends on them, so a single article can be found without watching the series in sequence.
The EU AI Act Explained on Video
A free English-language series on Regulation (EU) 2024/1689 for executives and in-house teams at US companies, in the order of the articles.
26 episodes · 5h 20min · no sign-up · law as at 09/2026
Tick a box once you have worked through an episode. The state stays in this browser and is not transmitted.
This browser stores nothing (private window or blocked site data). Your progress therefore applies to this visit only.
Band 1: Foundations, Scope, Roles and Prohibited Practices (Episodes 1 to 9)
Episodes 1 to 9 cover the architecture of Regulation (EU) 2024/1689 as European product safety law, the seven categories of addressee in Art. 2(1), the definition of an AI system in Art. 3(1) together with the four categories of software that the Commission guidelines place outside it, and the operator roles in Art. 3, including the change of role under Art. 25. Episode 5 takes the Union-facing chain of authorised representative, importer and distributor and separates the two written mandates: the one in Art. 54 for providers of general-purpose AI models, which has applied since 2 August 2025, and the one in Art. 22 for high-risk systems, which follows the deferred high-risk timetable. Episodes 6 to 8 work through the ten prohibited practices in Art. 5, including the two inserted in July 2026, which apply from 2 December 2026, and Episode 9 closes the band with the AI literacy duty in Art. 4.
This episode introduces the EU AI Act as Regulation (EU) 2024/1689: product safety law rather than GDPR for AI. It separates the Article 5 prohibitions, the Annex I and Annex III high-risk tiers and Article 50 transparency from the parallel Chapter V track for general-purpose AI models, then sets out what Regulation (EU) 2026/1744 deferred in July 2026 — Annex III duties to 2 December 2027, Annex I duties to 2 August 2028 — and what binds a compliance team today.
This episode examines Article 2 of the EU AI Act: the seven addressee categories in Article 2(1) and the three connecting factors that reach a US company, including the Article 2(1)(c) rule that applies the Regulation where a system's output is used in the Union. It tests the exclusions in Article 2(3) to (12) for military, research, open-source and personal use, the Annex I Section B partial regime, and the five-step sequence for recording a scope decision per system.
This episode applies the EU AI Act definition of an AI system in Article 3(1) to a company's own software, using the seven elements in the Commission's guidelines and the four categories the guidelines place outside it. It then separates that term from the general-purpose AI model in Article 3(63), the general-purpose AI system in Article 3(66) and the systemic-risk presumption in Article 51(2), as both regimes can bind the same company.
This episode examines the operator roles in Article 3(3) to (8) of the EU AI Act and compares the provider duties in Article 16 with the lighter deployer duties in Article 26. It then works through Article 25: branding, substantial modification or a changed intended purpose can make a customer the provider of a high-risk system, and Article 99(4)(da) now fines breach of the Article 25(2) and (4) cooperation duties. Decide your role before white-labelling or fine-tuning.
This episode examines the EU AI Act's two authorised representative regimes for third-country providers: Article 54 for general-purpose AI models, since 2 August 2025, and Article 22 for high-risk systems, from 2 December 2027 or 2 August 2028. It covers the written mandate, ten-year retention, the duty to terminate and report, Article 54(6)'s exemption for open-source models without systemic risk, importer verification under Article 23, distributor duties under Article 24 and fines under Articles 99(4) and 101.
This episode covers four of the ten prohibitions in Article 5(1) of the EU AI Act, points (a), (b), (c) and (d): subliminal, manipulative or deceptive techniques, exploitation of age, disability or socio-economic vulnerability, social scoring, and criminal risk prediction based solely on profiling. Drawing on Commission Guidelines C(2025) 5052 final of 29 July 2025, it distinguishes the conduct each point prohibits and shows how to screen built and procured systems against Article 5.
This episode examines the four biometric prohibitions of the EU AI Act in Article 5(1)(e) to (h): untargeted scraping of facial images, emotion inference at work and in education, biometric categorisation by sensitive attributes, and real-time remote biometric identification in publicly accessible spaces for law enforcement. It explains why sentiment analysis of employee communications can fall under point (f), how narrow the medical-or-safety exception is, and why real-time use depends on national law.
This episode examines the two prohibitions added to Article 5(1) of the EU AI Act by the Digital Omnibus: point (ba) on non-consensual intimate imagery and point (bb) on AI-generated child sexual abuse material. It explains the scoping tests in Article 5(1a) and (1b), which decide whether a capable generative system may be placed on the Union market, the 2 December 2026 application date in Article 113, and the penalty position under Article 99.
Article 4 of the EU AI Act has bound providers and deployers since 2 February 2025; the Digital Omnibus recast it from an obligation of result into one of means, not a repeal. The episode sets out a programme that holds up as evidence: roles differentiated, contractors covered by contract, content tied to the AI estate and records. It adds the human oversight competence and training Article 26(2) requires of deployers of high-risk systems, and closes Band 1 in seven steps.
When Rebranding or Modification Changes the Role
Art. 25(1) turns a customer into the provider of a high-risk system in three cases: putting its own name on a system that is already high-risk, substantially modifying one already on the market, or changing the intended purpose of a system so that it becomes high-risk. Only the first case can be allocated differently by contract, and at model level Chapter V applies instead. Where a product plan touches any of the three, the role is better settled before the release than after it.
Request a callBand 2: The High-Risk Regime and Its 2027 and 2028 Deadlines (Episodes 10 to 19)
Episodes 10 to 19 cover Chapter III, Art. 6 to 49 in five sections. Art. 113(3)(c), as amended, applies Sections 1 to 3, with the exception of Art. 6(5), from 2 December 2027 to systems classified under Art. 6(2) and Annex III and from 2 August 2028 to systems classified under Art. 6(1) and Annex I; those are fixed calendar dates, and the co-legislators rejected making them conditional on the availability of harmonised standards. The band opens with classification: the two cumulative conditions of Art. 6(1) and the narrowed safety component definition, the eight areas of Annex III, and the Art. 6(3) derogation, which falls away where the system performs profiling within the meaning of Art. 3(52). The requirements of Art. 8 to 15 follow, from risk management and data governance to technical documentation, logging, instructions for use, human oversight, accuracy and cybersecurity, then the twelve provider obligations in Art. 16 with the quality management system, the three conformity assessment routes in Art. 43 with declaration of conformity, CE marking and registration, and the deployer duties in Art. 26, together with the fundamental rights impact assessment that Art. 27 requires only of the deployers it names.
This episode maps Chapter III of the EU AI Act, Articles 6 to 49 in five sections, against the amended dates in Article 113: Sections 1 to 3 now apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems. It explains why the deferral is only partial, and why biometric providers keep the internal control route under Article 43 only where harmonised standards or common specifications have been applied, and otherwise take the Annex VII route.
This episode works through the first route into the high-risk regime: the two cumulative conditions of Article 6(1) for AI inside an Annex I product. It covers the narrowed safety-component definition in Article 3(14), the non-safety exclusion in Article 6(1a), the endangerment override in 6(1b), the filter in 6(1c) for assessment driven solely by spectrum or interference risk, and Articles 2(13), 42(3) and 43(3). It decides whether embedded AI is in Chapter III at all.
This episode works through the second classification route of the EU AI Act: under Article 6(2) a system listed in Annex III is high-risk by its intended purpose, not by a product, unless the Article 6(3) derogation, taken next time, applies. It covers the eight areas with their carve-outs, the Article 43 notified body point in area 1 and the Article 7 power to extend the list, and places a product, above all in area 4, employment, and area 5, essential services.
This episode works through Article 6(3) of the EU AI Act, under which a provider may conclude that a system listed in Annex III is not high-risk: the chapeau as the real test, the four alternative conditions, and the override that keeps such a system high-risk where it performs profiling as defined in Article 3(52). It adds the Article 6(4) duty to document the assessment before the system is placed on the market or put into service, and registration under Article 49(2).
This episode works through the core of the high-risk regime: the relative standard in Article 8, the continuous lifecycle process of Article 9 with its mandatory input from Article 72 post-market monitoring, and the eight data governance practices in Article 10(2). The new Article 4a permits special categories of personal data to be processed for bias detection only under six cumulative conditions. Build a process, not a one-off assessment, and data lineage records.
This episode works through Articles 11, 12 and 13 of the EU AI Act, the documentation duties of a high-risk system: technical documentation drawn up before market entry and kept up to date, the nine blocks of Annex IV, the simplified form for SMEs and small mid-caps, and logging as an architectural property, with logs kept at least six months by provider and deployer under Articles 19 and 26(6). Article 13 decides what a provider discloses about accuracy and limitations.
This episode treats Articles 14 and 15 of the EU AI Act as design, not documentation, requirements for high-risk systems: oversight built into the product, the deployer's own duty in Article 26(2), the four-eyes rule Article 14(5) imposes only for Annex III point 1(a) remote biometric identification, logged under Article 12(3), and the accuracy metric declared under Article 15(3). New Article 42(3) deems only the cybersecurity limb met within the Cyber Resilience Act's scope.
This episode works through the twelve obligations of providers of high-risk AI systems in Article 16 of the EU AI Act and Articles 17 to 21: the quality management system and its thirteen elements, where the Article 17(4) relief for financial institutions leaves the Article 9, 72 and 73 elements intact, ten-year retention under Article 18, the six-month floor for logs under the provider's control in Article 19, corrective action and cooperation. Build against EN 18286 now.
This episode works through the EU AI Act's market-entry gate for high-risk systems: the three Article 43 routes — internal control for seven of the eight Annex III areas, the Annex VII notified body route for biometrics unless harmonised standards or common specifications have been applied, the sectoral procedure for Annex I — then the Article 47 declaration, the Article 48 digital CE mark and four Article 49 registration duties that the Article 71 database cannot yet take.
This episode covers the deployer side of the EU AI Act: the Article 26 duties on high-risk systems — instructions-based use, competent and authorised oversight, worker information, and the Article 26(5) duty to suspend a system that may present a risk and notify the market surveillance authority. An Article 27 fundamental rights impact assessment is owed and filed only on Annex III systems, by public bodies, public-service providers and deployers under points 5(b) and (c).
Planning Ahead of the 2027 and 2028 Dates
What those two dates leave is less than it looks: classification under Art. 6, the quality management system, the technical documentation and the conformity assessment have to be in place on the day, not started on it. Companies that expect a classification under Annex III or Annex I therefore tend to begin well before them.
Arrange a conversationBand 3: Transparency, General-Purpose AI Models and Enforcement (Episodes 20 to 26)
Episodes 20 to 26 cover the duties that already bind. Art. 50 has been enforceable since 2 August 2026: disclosure of interaction with an AI system, machine-readable marking of synthetic audio, image, video and text, and the deployer duties for deep fakes and for text published on matters of public interest without editorial control; Art. 111(4) gives systems already on the market until 2 December 2026 to implement the Art. 50(2) marking, and that transitional period covers nothing else. Chapter V has applied since 2 August 2025 and is treated in three steps: the two compute thresholds that decide whether a model falls under the chapter at all and whether systemic risk is presumed, the four duties of Art. 53 including the copyright policy and the public summary of the training content, and, for models with systemic risk, the additional duties of Art. 55, for which the Code of Practice of 10 July 2025 is one route while no harmonised standard exists, not the only one. The band closes with the division of competence between the national market surveillance authorities and the AI Office, the three fine tiers of Art. 99 and the separate Commission fines on model providers under Art. 101, the individual rights in Art. 85 to 87, and a final episode that assembles the series into one programme along the dates in Art. 113.
This episode works through Article 50 of the EU AI Act, enforceable since 2 August 2026: the provider duties to disclose human-AI interaction and to mark synthetic audio, image, video and text in machine-readable form, and the deployer duties for deep fakes and public-interest text. Article 111(4) gives only earlier systems until 2 December 2026 to implement marking, and the editorial-control exception decides whether published text must be labelled.
This episode separates the two compute thresholds of the EU AI Act that decide whether Chapter V applies to a model and whether it carries systemic risk. Ten to the twenty-third floating point operations is one limb of the Commission's indicative criterion for a general-purpose AI model under Article 3(63); ten to the twenty-fifth is the rebuttable presumption in Article 51(2). The Annex XIII criteria and the two-week notification clock in Article 52 follow.
This episode covers the four obligations Article 53(1) of the EU AI Act places on every provider of a general-purpose AI model: Annex XI technical documentation, Annex XII downstream information, a copyright policy honouring Article 4(3) reservations under Directive (EU) 2019/790, and a public training-content summary with no trade-secret exception. Article 53(2) waives (a) and (b) only for open-source models without systemic risk; Article 54 binds third-country providers.
This episode covers the four additional obligations in Article 55(1) of the EU AI Act for providers of general-purpose AI models with systemic risk, and the routes in Article 55(2): rely on the General-Purpose AI Code of Practice of 10 July 2025 until a harmonised standard exists, or demonstrate alternative adequate means to the Commission. It explains the amended Article 56(6) and why failing to answer an Article 91 information request is fineable under Article 101(1)(b).
This episode identifies the regulator for an AI system under the EU AI Act: the national market surveillance authorities of Articles 70 and 74, in Germany the Bundesnetzagentur, and the AI Office's exclusive competence under Article 75, which binds providers of systems built on their own general-purpose models or running inside a very large online platform and reaches deployers only where they are also the provider, with the competition-style powers of Articles 75a to 75d.
This episode sets out the three fine tiers in Article 99 of the EU AI Act, the inverted rule for SMEs and the narrower relief for small mid-caps, the fixed ceilings for Union institutions in Article 100 and the Commission's fines on GPAI model providers in Article 101. It covers the individual rights in Articles 85 to 87 and why strict product liability under Directive (EU) 2024/2853, to be transposed by 9 December 2026, is what a European risk assessment must now cover.
This episode assembles the series into a phased EU AI Act programme on the Article 113 dates: Articles 4, 5, 50 and 53 to 55 bind today, Article 111(4) marking is due on 2 December 2026 only for generative systems already on the market, and the Article 9, 10 and 17 high-risk build runs through 2027. It maps the GDPR, DSA, Cyber Resilience Act and NIS2 overlaps onto one control set and separates the settled from the open: no harmonised standard cited, no Article 71 database.
When the AI Office Makes Contact
Providers of general-purpose AI models have been bound by Chapter V since 2 August 2025, and the Commission, through the AI Office, enforces it itself rather than a national authority. Where a model carries systemic risk under Art. 51, Art. 55(2) leaves the choice between the Code of Practice of 10 July 2025 and demonstrating other adequate means; a request for information under Art. 91 runs on a deadline, and an incorrect, incomplete or absent answer is fineable under Art. 101(1)(b). Where such a letter has arrived, an early look at the procedural position helps.
Get in touchKnowledge check and confirmation of participation
Once all {gesamt} episodes are marked as completed, you can start the knowledge check: {fragen} questions drawn from all three bands, one correct answer each. From {grenze} correct answers onwards you can generate a confirmation of participation. The check runs entirely in your browser; no data is transmitted to the firm.
The name is only placed into the document in your browser. It does not leave your device.
The series is general. The duty in Article 4 of the EU AI Act, by contrast, attaches to the AI systems an organisation actually operates and must be differentiated by role; a general series therefore cannot discharge it. What remains to be done in a particular organisation can only be assessed on its own facts.
The document is generated in your browser and opens the print dialogue, where it can also be saved as a PDF.
The Companion Series on the EU Digital Services Act
A second free series works through Regulation (EU) 2022/2065, the EU Digital Services Act, in the same way and in twenty-six episodes: the categories of intermediary service, hosting service and online platform, the duties that follow from each classification, the additional regime for platforms and search engines designated by the Commission, and supervision, enforcement and remedies. A company that runs a hosting service or an online platform and also deploys AI is frequently within both regimes at once, and the duties under each are assessed separately.
Watch the DSA seriesQuestions About the EU AI Act
Does the EU AI Act apply to US companies with no establishment in the EU?
Yes, where one of the connecting factors in Art. 2(1) is met. The Regulation applies to providers who place an AI system on the Union market or put it into service, expressly irrespective of whether they are established in the Union or in a third country; to deployers established or located in the Union; and to providers and deployers in a third country where the output produced by the system is used in the Union. Incorporation outside the Union is not in itself a defence, and the exclusions in Art. 2 are separate and narrow.
Our AI runs only on US servers. Does the EU AI Act still apply?
It may. Art. 2(1)(c) applies the Regulation to providers and deployers established in a third country where the output produced by the AI system is used in the Union. It requires neither placing the system on the Union market, nor an establishment in Europe, nor any European infrastructure: the connecting factor is where the output is used. A screening model hosted in the United States whose decisions are acted upon in the Union falls within it. Whether a given output is used in the Union is a question of fact, and the provision has not yet been tested in case law.
Has the EU AI Act been delayed?
In part. Regulation (EU) 2026/1744 deferred Chapter III, Sections 1 to 3 — classification, the high-risk requirements and the operator duties — to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Nothing else moved. The Art. 5 prohibitions and the Art. 4 AI literacy duty have applied since 2 February 2025, except the two inserted in July 2026, Art. 5(1)(ba) and (bb), which apply from 2 December 2026. Chapter V, governance and penalties have applied since 2 August 2025, the Art. 101 fines and the Art. 50 transparency duties since 2 August 2026.
What is the Digital Omnibus on AI, and what did it change?
Regulation (EU) 2026/1744 was adopted on 8 July 2026, published in the Official Journal on 24 July and in force since 27 July 2026. It is an amending regulation, so there is no separate omnibus regime; the EU AI Act now reads differently. Besides the deferral it softened Art. 4 from ensuring a sufficient level of AI literacy to supporting its development, narrowed the safety component definition, inserted two prohibitions on non-consensual intimate imagery and AI-generated child sexual abuse material, which apply from 2 December 2026, not from entry into force, and added proportionality relief for small mid-cap enterprises.
Am I a provider or a deployer under the EU AI Act?
The roles turn on conduct, not on size or sector. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge (Art. 3(3)). A deployer uses a system under its own authority, outside a purely personal, non-professional activity (Art. 3(4)). The obligation sets are asymmetric: for a high-risk system the provider carries the twelve points of Art. 16 and the deployer the narrower duties of Art. 26, in each case from 2 December 2027 or 2 August 2028. One group can hold both roles for different systems.
Can rebranding or modifying someone else's AI system make us the provider?
It can. Under Art. 25(1) a distributor, importer, deployer or third party is considered the provider of a high-risk AI system where it puts its name or trademark on a high-risk system on the market, substantially modifies such a system, or modifies the intended purpose of a system, including a general-purpose AI system, so that it becomes high-risk. The first trigger is subject to contrary contractual allocation. The initial provider then owes the cooperation duties in Art. 25(2) unless it has clearly specified that its system is not to be changed into a high-risk one. At model level the provider question follows Chapter V, not Art. 25.
What counts as an AI system under the EU AI Act?
Art. 3(1) covers a machine-based system designed to operate with varying levels of autonomy, which may exhibit adaptiveness after deployment and which, for explicit or implicit objectives, infers from its input how to generate outputs such as predictions, content, recommendations or decisions influencing physical or virtual environments. Inference is the hinge, and adaptiveness is optional. The Commission guidelines on the definition, C(2025) 5053 final of 29 July 2025, place four categories of software outside it, among them basic data processing and classical heuristics, but state at paragraph 7 that they are not binding.
What are the penalties under the EU AI Act?
Art. 99(3) sets the ceiling for breach of the Art. 5 prohibitions at EUR 35 million or 7 percent of total worldwide annual turnover for the preceding financial year, whichever is higher. Art. 99(4) covers breach of the other operator obligations at EUR 15 million or 3 percent, and Art. 99(5) sets EUR 7.5 million or 1 percent for supplying incorrect, incomplete or misleading information to authorities. For SMEs and start-ups the lower figure applies; for small mid-caps only under Art. 99(4) and (5). Member States set and apply these penalties; Art. 101 reserves separate fines for providers of general-purpose AI models to the Commission.
Does the EU AI Act require AI training for our staff?
Art. 4 binds providers and deployers of AI systems and has applied since 2 February 2025. In the version amended by Regulation (EU) 2026/1744 it requires them to take measures supporting the development of AI literacy among their staff and other persons operating systems on their behalf, taking account of technical knowledge, experience, education and training and the context of use. That recast turns an obligation of result into one of means, not a repeal. With Art. 5 it binds irrespective of risk class. No certificate, external course or fixed number of hours is prescribed, and Art. 4 appears in no penalty tier of Art. 99 — the duty is enforceable nonetheless.