AI-drafted from cited sources and checked against our publishing rules. Not every change is reviewed by a person before it goes live.
Legal lines are paraphrased from the cited official text, checked 25 October 2026. Where a term has no legal definition, there is no citation. The EU AI Act text below is the European Commission AI Act Service Desk explorer. Article 22 of the GDPR is the original adopted text on legislation.gov.uk, because EUR-Lex did not return the regulation on that check.
- AI system
- A machine-based system that can work with some independence. It takes input and produces outputs such as predictions, content, recommendations or decisions that can affect the physical world or a digital one.
- Article 3(1) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Foundation model
- A large model trained on broad data so it can be adapted to many tasks. The EU AI Act does not use this name. Its legal term for this kind of model is a general-purpose AI model.
- General-purpose AI model (GPAI)
- An AI model that can do a wide range of different tasks well, including one trained on a large amount of data at scale, and that can be built into many other systems. Models still only in research, development or prototyping, and not yet placed on the market, are left out.
- Article 3(63) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- General-purpose AI system
- An AI system built on a general-purpose AI model that can be used for many purposes, either directly or inside other AI systems.
- Article 3(66) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- GPAI model with systemic risk
- A general-purpose model treated as carrying systemic risk. That happens if it has high-impact capabilities, judged with technical tools and benchmarks, or if the Commission decides it has an equivalent impact. A training-compute figure in Article 51(2) creates a presumption of high-impact capabilities. The Service Desk’s article text and its summary do not print that figure the same way, so the number is not repeated here.
- Article 3(65) and Article 51 of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Systemic risk
- A risk tied to the high-impact capabilities of general-purpose models. It has a significant effect on the EU market because of the model’s reach, or because of actual or reasonably foreseeable harm to public health, safety, public security, fundamental rights, or society as a whole, and it can spread at scale along the value chain.
- Article 3(65) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- High-risk AI system
- An AI system the Act treats as high-risk in either of two ways. One is a system that is a product, or a safety component of a product, covered by the laws in Annex I, where that product must have a third-party conformity assessment. The other is a system listed in Annex III, unless a listed exception applies. An Annex III system that profiles people is always high-risk.
- Article 6 of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Conformity assessment
- The process of showing whether a high-risk AI system meets the requirements in Chapter III, Section 2 of the Act.
- Article 3(20) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Notified body
- An independent organisation that a country has notified to carry out conformity assessment under the AI Act and other EU product laws.
- Article 3(22) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- CE marking
- A mark the provider puts on an AI system to say it meets the high-risk requirements in Chapter III, Section 2, and any other EU product law that requires the mark.
- Article 3(24) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Provider
- A person, company or public body that develops an AI system or a general-purpose model, or has it developed, and places it on the market or puts the system into service under its own name or trademark, whether paid or free.
- Article 3(3) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Deployer
- A person, company or public body that uses an AI system under its authority. Personal, non-professional use is not included.
- Article 3(4) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Downstream provider
- A provider of an AI system, including a general-purpose system, that integrates an AI model. The model may be its own or come from someone else under a contract.
- Article 3(68) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Intended purpose
- The use the provider says the AI system is for, including the context and conditions of use, as set out in the instructions, sales material, statements and technical documentation.
- Article 3(12) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Prohibited AI practice
- A use of AI that Article 5 bans. The list includes manipulative or deceptive techniques that materially distort behaviour and cause significant harm, exploiting people’s vulnerabilities, some non-consensual intimate deepfakes, some child sexual abuse material, and social scoring. Other bans are in the rest of the article.
- Article 5 of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Transparency obligation
- A duty to tell people what they are dealing with. People must be told when they are interacting with an AI system, unless that is obvious. Synthetic audio, image, video or text must be marked in a machine-readable way. Deepfakes, and some AI text published to inform the public, must be disclosed.
- Article 50 of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Deep fake
- AI-generated or AI-altered image, audio or video that resembles a real person, object, place, entity or event and would falsely look or sound authentic.
- Article 3(60) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Human oversight
- Design and tools that let a person effectively supervise a high-risk AI system while it is in use, so they can reduce risks to health, safety or fundamental rights.
- Article 14 of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- AI Office
- The European Commission’s role in implementing, monitoring and supervising AI systems and general-purpose models, and in AI governance. In the Act, a reference to the AI Office means the Commission. It was set up by a Commission decision of 24 January 2024.
- Article 3(47) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- AI regulatory sandbox
- A controlled scheme run by a competent authority. It lets providers, or would-be providers, develop, train, validate and test an innovative AI system for a limited time under supervision, sometimes in real-world conditions, under a sandbox plan.
- Article 3(55) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- AI literacy
- The skills, knowledge and understanding that let providers, deployers and affected people make an informed use of AI systems, and know the opportunities, risks and possible harm.
- Article 3(56) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Training data
- Data used to train an AI system by fitting the parameters it can learn.
- Article 3(29) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Biometric identification
- Automated recognition of a person’s physical, physiological, behavioural or psychological features, by comparing that person’s biometric data with biometric data stored in a database, in order to establish who they are.
- Article 3(35) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Serious incident
- An incident or malfunction of an AI system that directly or indirectly causes any of these: a person’s death or serious harm to their health; a serious and irreversible disruption of critical infrastructure; a breach of EU law meant to protect fundamental rights; or serious harm to property or the environment.
- Article 3(49) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Post-market monitoring
- What providers do to collect and review experience from AI systems they have placed on the market or put into service, so they can spot when they need to take corrective or preventive action at once.
- Article 3(25) of Regulation (EU) 2024/1689. European Commission AI Act Service Desk
- Frontier model
- A loose industry name for the most capable general-purpose models at a given time, often those with the strongest results on hard tasks and the tightest safety controls. It is not a defined term in the EU AI Act. The Act’s nearest legal categories are a general-purpose AI model and a general-purpose AI model with systemic risk.
- Hallucination
- A confident answer from a model that is false or not supported by the source it was given. The model presents it as if it were a fact.
- Retrieval-augmented generation (RAG)
- A setup that searches a store of documents, then gives the relevant passages to the model so the answer can be grounded in those passages instead of memory alone.
- Open weights
- The model’s learned parameters are published so others can download and run them, usually under a stated licence. Open weights are not the same as open source: the training data, code and licence terms may still be restricted.
- Context window
- How much text, or other input, a model can take in at once, usually counted in tokens. A longer window can hold a longer prompt, but it does not by itself make the answer more accurate.
- Token
- A small chunk of text a model reads or writes. A token may be a word, part of a word, a number or a punctuation mark. API prices are often quoted per million tokens.
- Fine-tuning
- Further training of an existing model on a narrower set of examples so it follows a particular task, style or domain more closely.
- Inference
- Using a trained model to produce an output, as opposed to training it. The per-token prices in the model table are inference prices.
- Red teaming
- A structured attempt to make a model fail, by probing it for harmful, unsafe or policy-breaking behaviour before or after release.
- Model card
- A short document from the maker describing a model: what it is for, how it was evaluated, its limits, and the safety measures around it.
- Automated decision-making
- A decision made by a computer alone, including profiling, that has a legal effect on a person or a similarly serious effect. EU data-protection law gives a person the right not to be subject to that kind of decision, with exceptions such as a contract or a law that includes safeguards.
- Article 22 of Regulation (EU) 2016/679, text as originally adopted. legislation.gov.uk, original EU text