What is AMLEGALS AI Law Practice?

AMLEGALS is India's leading AI and technology law firm specializing in EU AI Act compliance, India DPDPA, AI governance, data privacy, and technology contracts. We have expert AI lawyers across 6 offices in India serving clients globally.

How can AMLEGALS help with EU AI Act compliance?

Our AI lawyers provide comprehensive EU AI Act compliance services including risk classification, conformity assessments, documentation requirements, and ongoing compliance monitoring for businesses deploying AI systems in or serving the European Union.

Does AMLEGALS handle India DPDPA compliance?

Yes, AMLEGALS is a leading law firm for India's Digital Personal Data Protection Act (DPDPA) compliance. We help businesses implement data protection frameworks, draft privacy policies, conduct DPIAs, and ensure regulatory compliance.

Where are AMLEGALS offices located?

AMLEGALS has 6 offices across India: Ahmedabad (Head Office), Mumbai, Bengaluru, New Delhi, Kolkata, and Chennai. We serve clients pan-India and globally for AI and technology law matters.

What is the primary objective of the EU AI Act?

To ensure AI systems are safe, respect fundamental rights and Union values, and stimulate investment and innovation in AI within the EU. (Reference: Art. 1, Category: General Provisions)

Does the Act apply to non-EU providers?

Yes, it applies to providers regardless of location if the system's output is used in the EU (the 'Brussels Effect'). (Reference: Art. 2(1)(c), Category: General Provisions)

Is AI for military use covered?

No, systems developed exclusively for military, defense, or national security purposes are exempt. (Reference: Art. 2(3), Category: General Provisions)

How is an 'AI system' legally defined?

A machine-based system designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment. (Reference: Art. 3(1), Category: General Provisions)

What is the role of Article 4 regarding literacy?

It mandates that providers and deployers take measures to ensure a sufficient level of AI literacy among their staff. (Reference: Art. 4, Category: General Provisions)

Are personal, non-professional AI uses covered?

No, the Act does not apply to AI systems used by natural persons for purely personal, non-professional activities. (Reference: Art. 2(5), Category: General Provisions)

What constitutes 'placing on the market'?

The first making available of an AI system on the Union market. (Reference: Art. 3(7), Category: General Provisions)

Who is defined as a 'Provider'?

Any entity that develops an AI system or has it developed with a view to placing it on the market under its own name. (Reference: Art. 3(2), Category: General Provisions)

Who is defined as a 'Deployer'?

Any entity using an AI system under its authority in the course of a professional activity. (Reference: Art. 3(4), Category: General Provisions)

What is the 'Substantial Modification' rule?

Any change to the AI system that affects its compliance or its intended purpose, potentially triggering new assessments. (Reference: Art. 3(23), Category: General Provisions)

Is social scoring prohibited?

Yes, systems that classify natural persons based on social behavior leading to detrimental treatment are banned. (Reference: Art. 5(1)(c), Category: Prohibited Practices)

Can AI be used for emotion recognition in the workplace?

No, AI used to infer emotions in workplaces and educational institutions is prohibited. (Reference: Art. 5(1)(f), Category: Prohibited Practices)

What are the limits on biometric identification?

Real-time biometric ID in public spaces for law enforcement is banned with very narrow judicial exceptions. (Reference: Art. 5(1)(h), Category: Prohibited Practices)

Is subliminal manipulation banned?

Yes, AI practices that deploy subliminal techniques to distort behavior and cause physical or psychological harm are prohibited. (Reference: Art. 5(1)(a), Category: Prohibited Practices)

Is predictive policing permitted?

It is prohibited if based solely on profiling or personality traits to assess a person's risk of offending. (Reference: Art. 5(1)(d), Category: Prohibited Practices)

Can AI exploit vulnerable groups?

No, systems that exploit vulnerabilities of a specific group due to age or disability to distort behavior are banned. (Reference: Art. 5(1)(b), Category: Prohibited Practices)

Is untargeted scraping of facial images allowed?

No, building or expanding facial recognition databases through untargeted scraping is a prohibited practice. (Reference: Art. 5(1)(e), Category: Prohibited Practices)

Are there exceptions for missing children searches?

Yes, 'Real-time' RBI may be permitted for the search for targeted victims of abduction or human trafficking. (Reference: Art. 5(2)(a), Category: Prohibited Practices)

Does the ban apply to 'Post' biometric ID?

No, Article 5 primarily targets 'Real-time' systems; 'Post' identification is regulated under High-Risk rules. (Reference: Art. 5(1), Category: Prohibited Practices)

What is the penalty for violating Article 5?

Fines up to €35M or 7% of worldwide annual turnover, whichever is higher. (Reference: Art. 99(3), Category: Prohibited Practices)

Which AI systems are classified as 'High-Risk'?

Systems listed in Annex III, including critical infra, education, HR, law enforcement, and migration. (Reference: Art. 6(2), Category: High-Risk AI)

What is a Conformity Assessment?

A mandatory internal or third-party check to ensure the system meets all safety and documentation standards. (Reference: Art. 43, Category: High-Risk AI)

Is a Risk Management System mandatory?

Yes, for all high-risk systems, a continuous iterative process must be established throughout the lifecycle. (Reference: Art. 9, Category: High-Risk AI)

What are the data governance requirements?

Training, validation, and testing sets must be representative, free of errors, and relevant. (Reference: Art. 10, Category: High-Risk AI)

What must technical documentation include?

Architecture, logic, training process, and results of validation tests. (Reference: Art. 11, Category: High-Risk AI)

How is Human Oversight enforced?

Systems must be designed so natural persons can oversee, intervene, or override outputs. (Reference: Art. 14, Category: High-Risk AI)

What is Post-Market Monitoring (PMM)?

A plan to proactively collect and review data on the performance of high-risk AI after deployment. (Reference: Art. 61, Category: High-Risk AI)

Who is responsible for the Declaration of Conformity?

The provider must draw up the EU declaration of conformity and keep it for 10 years. (Reference: Art. 47, Category: High-Risk AI)

Is AI in recruitment high-risk?

Yes, AI used for recruitment, screening, and evaluation of candidates is listed in Annex III. (Reference: Annex III(4)(a), Category: High-Risk AI)

What about critical infrastructure?

AI used as safety components in water, gas, heating, and electricity management is high-risk. (Reference: Annex III(2), Category: High-Risk AI)

Is AI for credit scoring regulated?

Yes, AI used to evaluate creditworthiness or credit scores is classified as high-risk. (Reference: Annex III(5)(b), Category: High-Risk AI)

Must high-risk systems keep logs?

Yes, they must automatically record events ('logs') to ensure traceability throughout the lifecycle. (Reference: Art. 12, Category: High-Risk AI)

What is the 'Accuracy' requirement?

High-risk systems must achieve appropriate levels of accuracy, robustness, and cybersecurity. (Reference: Art. 15, Category: High-Risk AI)

What is an Article 25 Authorised Representative?

Non-EU providers must appoint an EU-based representative to ensure compliance. (Reference: Art. 25, Category: High-Risk AI)

What is the 'Fundamental Rights Impact Assessment' (FRIA)?

Certain deployers (public bodies, banks) must conduct an assessment of the system's impact on fundamental rights. (Reference: Art. 27, Category: High-Risk AI)

Does AI in education require transparency?

Yes, especially if used for determining access or assessing learning outcomes. (Reference: Annex III(3), Category: High-Risk AI)

Is AI in law enforcement always high-risk?

Generally yes, if used for risk assessments, polygraphs, or evidence evaluation. (Reference: Annex III(6), Category: High-Risk AI)

Can a high-risk system be self-assessed?

For some Annex III systems, yes. For others (biometrics), a Notified Body is required. (Reference: Art. 43, Category: High-Risk AI)

What is a 'Notified Body'?

A third-party conformity assessment body designated by a Member State. (Reference: Art. 3(22), Category: High-Risk AI)

What is the CE marking for AI?

A visible sign that a high-risk AI system complies with the Act's requirements. (Reference: Art. 48, Category: High-Risk AI)

Are deepfakes regulated?

Yes, providers must ensure that AI-generated or manipulated content is clearly labeled. (Reference: Art. 50(4), Category: Transparency)

Do chatbots need to identify themselves?

Yes, providers must ensure users are informed they are interacting with an AI system. (Reference: Art. 50(1), Category: Transparency)

What are the rules for emotion recognition?

Deployers must inform people when they are exposed to such a system. (Reference: Art. 50(3), Category: Transparency)

Is labeling mandatory for AI-generated text?

Yes, if the text is published for the purpose of informing the public on matters of public interest. (Reference: Art. 50(4), Category: Transparency)

Are there exemptions for creative works?

Yes, for works that are evidently part of a creative, satirical, or artistic work. (Reference: Art. 50(4), Category: Transparency)

Must AI images be watermarked?

They must be marked in a machine-readable format as being artificially generated. (Reference: Art. 50(2), Category: Transparency)

What is the 'Provenance' requirement?

Technical solutions must be implemented to allow for the identification of the AI source. (Reference: Art. 50, Category: Transparency)

EU Intelligence Hub

Live

|136 Records

Regulation (EU) 2024/1689→Statutory Intelligence

The Definitive Codex
AI ActIntelligence

Comprehensive article-by-article analysis of the European Union's landmark artificial intelligence regulation framework

136+

Statutory Markers

107+

Articles

17+

Chapters

Quick Search:

Explore Intelligence

Filter by Chapter

Chapter 1

General Provisions

Statutory Records

Chapter 2

Prohibited Practices

Statutory Records

Chapter 3

High-Risk AI

Statutory Records

Chapter 4

Transparency

Statutory Records

Chapter 5

GPAI Models

Statutory Records

Chapter 6

Deployer Obligations

Statutory Records

Chapter 7

Governance

Statutory Records

Chapter 8

Enforcement

Statutory Records

Chapter 9

Innovation

Statutory Records

Chapter 10

Annexes

Statutory Records

Chapter 11

Compliance

Statutory Records

Chapter 12

Privacy

Statutory Records

Chapter 13

Product Safety

Statutory Records

Chapter 14

Special Cases

Statutory Records

Chapter 15

Timeline

Statutory Records

Chapter 16

Data Governance

Statutory Records

Chapter 17

Human Oversight

Statutory Records

Comprehensive Coverage

Intelligence Metrics

Complete article-by-article analysis of the EU AI Act regulation framework

136+

Statutory Markers

Comprehensive Q&A Records

107+

Articles Analyzed

Regulation Coverage

17+

Regulatory Chapters

Thematic Organization

Next Steps

Need Expert Guidance?

Access institutional intelligence dossiers with enforcement precedents, case law analysis, and strategic compliance frameworks

AI Pro Intelligence EU Intelligence Hub

For specialized compliance advisory or institutional intelligence briefings

[email protected]

The Definitive CodexAI ActIntelligence

Filter by Chapter

General Provisions

What is the primary objective of the EU AI Act?

Does the Act apply to non-EU providers?

Is AI for military use covered?

How is an 'AI system' legally defined?

What is the role of Article 4 regarding literacy?

Are personal, non-professional AI uses covered?

What constitutes 'placing on the market'?

Who is defined as a 'Provider'?

Who is defined as a 'Deployer'?

What is the 'Substantial Modification' rule?

Prohibited Practices

Is social scoring prohibited?

Can AI be used for emotion recognition in the workplace?

What are the limits on biometric identification?

Is subliminal manipulation banned?

Is predictive policing permitted?

Can AI exploit vulnerable groups?

Is untargeted scraping of facial images allowed?

Are there exceptions for missing children searches?

Does the ban apply to 'Post' biometric ID?

What is the penalty for violating Article 5?

High-Risk AI

Which AI systems are classified as 'High-Risk'?

What is a Conformity Assessment?

Is a Risk Management System mandatory?

What are the data governance requirements?

What must technical documentation include?

How is Human Oversight enforced?

What is Post-Market Monitoring (PMM)?

Who is responsible for the Declaration of Conformity?

Is AI in recruitment high-risk?

What about critical infrastructure?

Is AI for credit scoring regulated?

Must high-risk systems keep logs?

What is the 'Accuracy' requirement?

What is an Article 25 Authorised Representative?

What is the 'Fundamental Rights Impact Assessment' (FRIA)?

Does AI in education require transparency?

Is AI in law enforcement always high-risk?

Can a high-risk system be self-assessed?

What is a 'Notified Body'?

What is the CE marking for AI?

What are 'Harmonised Standards'?

Can the Commission mandate 'Common Specifications'?

Article 9(2): What is risk identification?

Article 15(1): What is robustness?

Transparency

Are deepfakes regulated?

Do chatbots need to identify themselves?

What are the rules for emotion recognition?

Is labeling mandatory for AI-generated text?

Are there exemptions for creative works?

Must AI images be watermarked?

What is the 'Provenance' requirement?

Does transparency apply to minimal risk AI?

How long do users need to be informed?

What if the AI is used for criminal investigation?

Article 13: Transparency to deployers?

GPAI Models

What is General Purpose AI (GPAI)?

What is a 'Systemic Risk' GPAI model?

Are GPAI providers required to share training data summaries?

Must GPAI models comply with EU Copyright Law?

What are the obligations for Systemic Risk models?

Who monitors GPAI models?

Is open-source GPAI regulated?

Can the Commission change the 10^25 FLOPs threshold?

What is a 'Serious Incident' in GPAI?

Must GPAI providers report energy consumption?

Article 51: GPAI Classification?

Article 52: GPAI transparency?

Article 53(1): Copyright Opt-out?

Article 55: Red teaming Systemic GPAI?

Deployer Obligations

Do deployers need to monitor AI for bias?

What is the 'Instruction for Use' requirement?

Must deployers notify staff about AI in HR?

The Definitive Codex
AI ActIntelligence