EU AI Act. Risk tiers, Article 4, and 7% of revenue.

01 / Who's covered

Provider, deployer, importer, distributor, or product manufacturer.

The EU AI Act assigns roles. Your obligations depend on which role you play with respect to a given AI system.

• Provider: a company that develops an AI system or has one developed and places it on the EU market under its own name or trademark.
• Deployer: a company using an AI system under its own authority. (Excluded: personal non-professional use.)
• Importer: a company in the EU that places an AI system from a non-EU provider on the EU market.
• Distributor: a company that makes an AI system available without affecting its properties.
• Product manufacturer: where an AI system is a safety component of a regulated product (machinery, medical devices), the product manufacturer takes on the provider obligations.

The Act is extraterritorial. A non-EU SaaS company whose product is used by an EU enterprise is a provider for that purpose. A US staffing firm whose AI screening tool ranks EU candidates is a deployer. A retailer in Berlin reselling a US-built AI tool is an importer. Headquarters location is not the deciding factor.

02 / The four risk tiers

Unacceptable. High. Limited. Minimal.

The Act sorts AI systems into four tiers based on the risks they pose. Each tier has its own obligations.

Unacceptable risk: banned.

Prohibited under Article 5. The list includes social scoring by public authorities, real-time remote biometric identification in public spaces by law enforcement (with narrow exceptions), exploitation of vulnerabilities, manipulative subliminal techniques, predictive policing based solely on profiling, untargeted scraping of facial images for biometric databases, and emotion recognition in workplace and education contexts (with narrow medical and safety exceptions). These prohibitions took effect on February 2, 2025.

High risk: heaviest obligations.

Two routes lead to high-risk classification. Annex III lists named high-risk uses: biometric identification, critical infrastructure, education, employment, essential services (including credit), law enforcement, migration and border control, administration of justice, and democratic processes. Article 6(1) treats AI systems that are safety components of regulated products (machinery, medical devices, toys, vehicles) as high-risk. High-risk obligations under Annex III applied from February 2, 2026; Article 6(1) obligations follow on August 2, 2026.

Limited risk: transparency duties.

Limited-risk AI systems (chatbots, emotion recognition, biometric categorization, deepfakes, AI-generated content) carry transparency obligations: users must know they are interacting with AI, AI-generated content must be labeled, deepfakes of real people must be disclosed.

Minimal risk: no specific obligation.

Most AI systems fall here: spam filters, recommendation engines, AI-assisted productivity tools without consequential decisions. The Act encourages voluntary codes of conduct but imposes no specific obligation. Article 4 AI literacy still applies.

03 / Article 4 AI literacy

The article almost every company underestimates.

Article 4 is short, plainly written, and broadly applicable. It says providers and deployers of AI systems must take measures to ensure, to the best of their ability, a sufficient level of AI literacy among their staff and other persons dealing with the operation and use of AI on their behalf.

Three things make Article 4 the obligation companies most often miss:

• It applied first. February 2, 2025 was the effective date. By the time you read this, you should have evidence in place.
• It applies to deployers, not just providers. If your team uses ChatGPT in the EU, you're a deployer, and Article 4 applies.
• It is contextual. "Sufficient AI literacy" depends on the technical knowledge, the use context, and the persons affected. There is no certificate or checklist that satisfies it on its own.

Concretely, an Article 4 evidence file usually contains: a written AI literacy program, a record of which employees completed which training, the dated AI policy, the inventory of AI tools the program covers, and the named owner of the program. The Northbeams audit log shows which AI tools were actually used by which employees during the period in question, which is the inventory side of the evidence.

04 / High-risk system obligations

Risk management, data quality, transparency, oversight, accuracy.

High-risk AI systems carry the heaviest obligations under the Act. The list of duties is long; the operational shape is roughly:

• Risk management system (Article 9). Iterative, documented, runs across the system's life cycle.
• Data and data governance (Article 10). Training, validation, and testing data must be relevant, representative, and free of statistical bias. Documentation required.
• Technical documentation (Article 11) and record-keeping (Article 12). Logs of system use sufficient for traceability.
• Transparency and provision of information (Article 13). Instructions for use that allow the deployer to interpret the output and use the system correctly.
• Human oversight (Article 14). Effective oversight by natural persons, including the ability to intervene or override.
• Accuracy, robustness, and cybersecurity (Article 15). Tested, monitored, hardened.
• Conformity assessment before placing on the market (Article 43). For most Annex III systems, this is internal control. For some it is third-party assessment.
• Registration in the EU database (Article 49) for many high-risk systems before deployment.
• Post-market monitoring (Article 72) and incident reporting (Article 73).

Deployers of high-risk AI also have specific duties (Article 26): assign human oversight, ensure input data is relevant, monitor operation, keep logs, inform affected persons in some cases, and conduct fundamental rights impact assessments where the deployer is a public body or provides public services.

05 / Key dates and timeline

Phased applicability through August 2026.

The phased timeline matters because each phase added a new bucket of obligations. The order also reveals the European Commission's priorities: first ban the worst practices and require AI literacy, then govern general-purpose AI models, then enforce the heavy high-risk system stack, then close the loop on regulated products.