eu ai act

A framework, a certifiable standard and a law. They overlap heavily and substitute for each other not at all.

Tiers are decided by use, not by model. And for high-risk providers, Article 15 makes AI security a legal requirement.

Two layers: documentation, copyright and transparency for every GPAI model provider, then evaluation, incident reporting and cybersecurity once a model crosses into systemic risk.

Location of the office is not the test. Where the system is placed, used, or where its output is used, is.

A policy saying humans review decisions proves nothing. The scored answer specifies the logs, metrics and tests that show reviewers can and do change outcomes.

The obligations most consumer AI products meet first. The scored answer separates provider and deployer duties, gives the dates, and turns each into a product requirement.

Regulatory reporting has to plug into ordinary incident response. The scored answer knows who reports what to whom and by when, and is honest about the open question on timing.

Regulation does not tell you how to red-team, but it decides what you must be able to show. The scored answer maps programme outputs to the evidence each framework expects.

The one governance answer that goes stale. The scored answer gives the timeline as amended in 2026, the fine tiers, and a process for tracking changes rather than memorised certainty.

Signed provenance and invisible watermarks are often lumped together as 'AI detection'. They prove different things and fail in different ways, which is the whole answer.