Glossary term
EU AI Act
Also: AI Act, Regulation (EU) 2024/1689
World's first comprehensive AI law. Four risk classes: prohibited, high-risk, limited (transparency), minimal. Phased application from February 2025 to August 2028.
Entered into force 1 August 2024. Prohibitions (Article 5) apply since 2 February 2025. General-Purpose AI (GPAI) obligations from August 2025. Article 50 transparency obligations from 2 August 2026. Annex III high-risk systems from 2 December 2027, Annex I high-risk in regulated products from 2 August 2028, both postponed by the Digital Omnibus (Regulation (EU) 2026/1744) in July 2026 from the original dates of 2 August 2026 and 2 August 2027.
Provider obligations (Art. 8-22): risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy/robustness/cybersecurity, conformity assessment, CE marking, EU database registration. Deployer obligations (Art. 26): instructions, oversight, suitable input, logging retention >=6 months, information of affected persons.
In practice
Fines up to 35 M EUR or 7% of turnover (prohibited practices), 15 M / 3% (other obligations), 7.5 M / 1% (false info to authorities).
Related terms
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
FRIA
Mandatory assessment under EU AI Act Art. 27 for deployment of specific high-risk AI systems. Required for public bodies and private deployers of essential services before first use.
GPAI / Foundation Models
General-purpose AI models under EU AI Act Art. 51-56. Obligations from August 2025: technical documentation, info for downstream providers, copyright policy, training data summary. Systemic-risk models additionally need model evaluation, adversarial testing, incident tracking.
EDR (Endpoint Detection and Response)
A class of endpoint security tools that continuously records endpoint activity and enables detection, investigation and response to threats that evade traditional antivirus. Most enterprise security incidents today are detected or contained at the EDR layer.
Evidence grade
A grade attached to each claim in a decision memo, showing whether the claim is backed by primary source, vendor-confirmed evidence, independent research, or an assumption. Assumption-heavy memos carry visible warnings rather than quiet confidence.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
BAIT
BaFin circular that concretises IT requirements for credit institutions. Specifies MaRisk AT 7.2 for IT strategy, information security, user permissions, project management, application development, and IT outsourcing.