What Is the EU AI Act? – Definition and How It Works

Learn how the EU AI Act's risk tiers work, what its transparency duties require, and how training data is affected.

The EU AI Act is the European Union's regulation on artificial intelligence. It classifies AI systems by risk and imposes obligations accordingly. This page is a general explanation, not legal advice.

1. The Risk Tiers

Obligations attach to the use case, not the technology. The same model can be minimal risk in one application and high risk in another, which is why classification starts with what the system does.

2. Prohibited Practices

The banned list includes untargeted scraping of facial images to build facial recognition databases, social scoring by public authorities, certain manipulative techniques, and specified biometric categorisation.

The first of those is directly relevant here: indiscriminate collection of facial images from the web or CCTV to populate a facial recognition database is prohibited. That is a named prohibition, not an inference from general principles, and it is the clearest line the Act draws around data collection.

3. High-Risk Obligations

Systems used in areas such as employment, education, credit, essential services, and law enforcement carry the heaviest duties, including:

• A risk management system across the lifecycle.
• Data governance — relevance, representativeness, and examination for bias in training data.
• Technical documentation and record-keeping.
• Human oversight provisions.
• Accuracy, robustness, and cybersecurity requirements.
• Conformity assessment before market placement.

The data governance requirement is the one that reaches back into collection: if a dataset trains a high-risk system, its provenance, composition, and bias characteristics must be documented.

4. General-Purpose AI and Training Data

For general-purpose models the Act adds obligations including technical documentation, a policy for respecting EU copyright law, and — notably — publishing a sufficiently detailed summary of the training data.

That transparency duty has a direct practical consequence for anyone assembling training corpora: the composition must be describable. A corpus with no provenance records cannot be summarised, and provenance cannot be reconstructed after the fact.

The copyright policy requirement connects to the EU's text-and-data-mining framework and its machine-readable opt-out mechanism, which is what publishers use to reserve rights.

5. Transparency for Limited-Risk Systems

Obligations aimed at people knowing what they are dealing with:

• Disclose when a person is interacting with an AI system.
• Label AI-generated or manipulated content.
• Disclose emotion recognition and biometric categorisation where used.

6. What This Means for Data Collection

1. Never build facial recognition databases from untargeted scraping. Explicitly prohibited.
2. Record provenance during collection. The training-data summary duty cannot be satisfied retroactively.
3. Honour machine-readable rights reservations — the TDM opt-out mechanism is how publishers express them.
4. Document dataset composition and bias examination if the data may feed a high-risk system.
5. Keep raw payloads with source and timestamp, which is what makes any later documentation possible.
6. Treat biometric data as a category apart, subject to stricter rules than ordinary personal data.

7. Extraterritorial Reach

Like GDPR, the Act reaches providers placing systems on the EU market or whose output is used in the EU, regardless of where they are established.

So a model trained and hosted outside the EU can be in scope if its output is used there — which means the collection practices behind it are in scope too.

8. Summary

The EU AI Act regulates AI by risk tier, prohibiting a defined set of practices — including untargeted scraping of facial images for facial recognition databases — and imposing substantial data governance and documentation duties on high-risk systems.

Its general-purpose AI provisions require publishing a sufficiently detailed training-data summary and a copyright compliance policy, which makes provenance recorded during collection a prerequisite rather than an afterthought, since it cannot be reconstructed later.

Potential Related Glossary

• Web Crawling
• Unstructured Data
• Data Fusion
• Data Wrangling