EU AI Act Role & Risk Classification Worksheet

Records whether the organisation is provider or deployer and the risk category of each system, with reasoning.

Available soon

Format: Excel
Size: 81 KB
Length: 12 sheets
Version: 1.0
Updated: 9 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.09 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	List the AI uses first. Take the use IDs from the AI System & Use Case Inventory and enter them in column B of the Worksheet sheet. A use that needs this worksheet is one the intake procedure sent here (AI Use Case Intake & Approval Procedure, Tier 3), and any use you want to read against the Act. Gather the supplier's instructions for use and any statement it makes about its role (ST-8).
2	On the Role Reasoning sheet, answer RQ-1 to RQ-7 for each use with Yes or No. The sheet says what the answers point to. It never says what role the organisation holds. A Yes to RQ-1, RQ-2, RQ-3, RQ-6 or RQ-7 sets "Ask Legal now" to Yes, and Legal decides before the use starts (AG-17). Read the note on the word distributor on the Reference sheet before you answer RQ-6.
3	On the Checklists sheet, answer the ten prohibited-practice questions (PP-01 to PP-10) for each use with No, Yes or Unsure. A Yes or an Unsure stops the use and takes it to Legal (AG-05). The Act's prohibitions take no exception under this pack (AG-20). Two of them apply only from 2 Dec 2026, and the Reference sheet shows which apply at the date you set.
4	On the same sheet, answer the Annex III areas (HA-1 to HA-8) you checked: No, Might be in this area, or Unsure. Leave an area blank if you did not check it. A use ticked for an area is a Tier 3 use (AG-06) and goes to Legal. Record your reading of each area you checked in the last column. The Reference sheet holds the Article 6(3) conditions and the profiling rule.
5	Mark the Article 50 duties that might apply (TD-1 to TD-4). Article 50 applies from 2 Aug 2026. The provider carries TD-1 and TD-2. The deployer carries TD-3 and TD-4. For each one, say in your reasoning who tells the people affected, and how you check it.
6	Back on the Worksheet sheet, write your reasoning in your own words against the Act's text, and cite the Articles. Record Legal's confirmation as a name and a date. The Check column tells you what is missing. It reads Recorded when the row is complete. That does not say the reasoning is right: counsel confirms it.
7	If you read a system as one the deployer duties of Article 26 apply to, record your evidence for DD-1 to DD-9 on the Duties and Dates sheet. Those duties apply to Annex III systems from 2 Dec 2027. Check whether a fundamental rights impact assessment applies (Article 27), and whether a data protection impact assessment is needed (GDPR Article 35).
8	Set the date on the Duties and Dates sheet to the date you review. The dates and the status of each prohibited practice and each Article 50 duty follow it.
9	Put the row reference and the date of Legal's confirmation in the inventory (AI System & Use Case Inventory, IF-14). For a use whose answer to IQ-12 is Yes, because it is built on a supplier's model API or for another reason, also enter the role Legal records (deployer, provider or other). The role clears hold H-4 only when both the row reference and the date are filled. If Legal records the deployer role, the tier is set again from the answers. If Legal records the provider role or another role, H-4 clears as a hold but the use stays Tier 3, because the organisation is then outside the deployer governance of this pack: the executive decision-maker decides, with this worksheet confirmed by Legal. A use already running carries H-4 as a condition with a date. Re-ask the question each time something changes: a new purpose, a new feature, a change of supplier or a change in the law (AI System & Use Case Inventory, IV-09). Keep the records for the period in AG-12.
10	To clear the EXAMPLE, delete the EXAMPLE rows on the three data sheets once your own are entered. The formulas stay. Keep this workbook with your own records. It is a file you keep, not a place to record anything on a website.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

The idea behind this workbook. Most organisations use other people's AI, so most of the time the question is whether the organisation is a deployer, and whether any of its uses touches a prohibited practice or an Annex III area. The Act's other roles matter when the organisation builds (building an application or feature on a supplier's model API counts), brands or resells.

What this workbook does not do. This workbook does not say which ISO/IEC 42001 or ISO/IEC 27001 controls, or which NIST AI RMF outcomes, meet a requirement of the EU AI Act. Each reference says what the source asks for and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met. It states no incident reporting clock: P09 and P18 hold those. It reads no national law.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. The seven uses are those of the inventory (AI System & Use Case Inventory). Every use is read as one the organisation uses under its own authority, with the supplier as the party that supplies it. One use, a job-applicant ranking add-on, might fall in Annex III area 4. It was declined at screening, and counsel confirmed the reading.

Adapting this workbook

Small organisation: most uses will answer RQ-4 Yes and every other role question No. Do the prohibited-practice questions all the same: they take a minute and they are the ones with the largest fines.

Regulated organisation: sector rules may add duties for the same use. Record them in your reasoning and ask Legal. This workbook reads only the AI Act.

Using a service provider or outsourced IT: ask the supplier in writing what role it says it holds for the system (ST-8). Its answer goes in the fact column of your reasoning. It does not settle your own role.

Worksheet

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. One row per AI use. Your reasoning against the text of the Act; counsel confirms it. The answers are on the next two sheets.

7 uses listed; 7 of 7 with every question answered; 0 to stop and take to Legal; 0 for Legal to decide first; 2 of 7 with Legal's confirmation recorded.

Row	Use ID	System and supplier	Role questions answered (RQ-1 to RQ-7)	What the answers point to	Prohibited-practice checklist (PP-01 to PP-10)	Annex III area it might touch (HA-1 to HA-8)	Transparency duties that might apply (TD-1 to TD-4)	Our reasoning	Legal's confirmation (name and date)	Check
EXAMPLE	AI-001	Drafting and summarising internal text with the office-suite assistant. Supplier: SUP-005.	7 of 7 answered	The answers point to the deployer test (Article 3(4)).	10 of 10 answered; 0 Yes, 0 Unsure	None ticked	TD-2	We use the supplier's assistant for our own drafting, under our authority. We read this as the deployer role, with the supplier as provider. We do not train or change the system. Drafting and summarising for staff does not fit any area of Annex III. The supplier carries the marking duty of Article 50(2); we do not remove the marking. Article 4 applies to us.		Recorded
EXAMPLE	AI-002	Demand forecasting inside the warehouse management system. Supplier: SUP-010.	7 of 7 answered	The answers point to the deployer test (Article 3(4)).	10 of 10 answered; 0 Yes, 0 Unsure	None ticked	None ticked	We use a forecasting feature in a system we run, under our authority, so the deployer test points to us and the supplier is the provider. No natural person is affected by the output. We checked Annex III area 2 and do not read the module as in it. Article 4 applies to the planners.		Recorded
EXAMPLE	AI-003	A customer-service chatbot, proposed by the outsourced contact centre, that answers order-status questions. Supplier: SUP-013.	7 of 7 answered	The answers point to the deployer test (Article 3(4)).	10 of 10 answered; 0 Yes, 0 Unsure	None ticked	TD-1, TD-2	Customers would deal directly with a system the contact centre supplies. We read ourselves as the deployer and the supplier as the provider. If the supplier asked us to present it as our own, the provider test could point to us and Legal would decide first. Article 50(1) puts the duty to tell customers on the provider; we require it in the contract and check the first message at go-live. Nothing it does has a legal or similarly significant effect on a person, so GDPR Article 22 is not engaged while it stays on order status.	[[name of counsel]], 2026-09-23	Recorded
EXAMPLE	AI-004	Generating images for campaign material in the design tool. Supplier: [[P06 reference of the design tool supplier]].	7 of 7 answered	The answers point to the deployer test (Article 3(4)).	10 of 10 answered; 0 Yes, 0 Unsure	None ticked	TD-2, TD-4	Marketing uses the tool's image generator for campaign pictures, under our authority. We read this as the deployer role. Article 50(4) asks a deployer to disclose a deep fake. The Act's definition covers generated content that resembles existing persons, objects, places, entities or events and would falsely appear authentic, so a realistic picture of our own site or products could be one. We avoid such pictures and label any realistic one.		Recorded
EXAMPLE	AI-005	Drafting campaign wording in a free public assistant on personal accounts. Supplier: none.	7 of 7 answered	The answers point to the deployer test (Article 3(4)).	10 of 10 answered; 0 Yes, 0 Unsure	None ticked	None ticked	Staff used a public tool for work, so the organisation may be treated as the deployer of it; the use sat outside any approval. The main breach was of our own policy (AG-02 and P15 CL-19). Article 4 applies, and the four users have completed the module.		Recorded
EXAMPLE	AI-006	Machine-learning anomaly detection in the managed security monitoring service. Supplier: SUP-006.	7 of 7 answered	The answers point to the deployer test (Article 3(4)).	10 of 10 answered; 0 Yes, 0 Unsure	None ticked	None ticked	We use a managed service that includes machine-learning detection, under our authority. We read this as the deployer role. We checked Annex III points 2 and 4 and explain our reading in the area rows. Counsel confirms the reading of point 4 before the high-risk duties apply on 2 December 2027.		Recorded
EXAMPLE	AI-007	A job-applicant ranking add-on to the recruitment system, proposed by HR. Supplier: [[P06 reference of the recruitment system provider]].	7 of 7 answered	The answers point to the deployer test (Article 3(4)).	10 of 10 answered; 0 Yes, 0 Unsure	HA-4	None ticked	If we used it we would be the deployer, with the supplier as provider. We read it as an Annex III area 4 system that performs profiling, so Article 6(3) would not take it out of the high-risk category. The deployer duties (DD-1 to DD-9) apply from 2 December 2027, including telling candidates and our workers' representatives. Ranking candidates is also a decision about people (AG-06; GDPR Article 22). We declined it for now. Counsel confirmed the reading.	[[name of counsel]], 2026-09-22	Recorded

Role Reasoning

Answer RQ-1 to RQ-7 for each use listed on the Worksheet sheet. The questions are on the Reference sheet. The pointers are words that point to a test of Article 3. They are not a role the organisation holds.

Row	Use ID	RQ-1	RQ-2	RQ-3	RQ-4	RQ-5	RQ-6	RQ-7	Answered	What the answers point to	Ask Legal now
EXAMPLE	AI-001	No	No	No	Yes	No	No	No	7 of 7	The answers point to the deployer test (Article 3(4)).	No
EXAMPLE	AI-002	No	No	No	Yes	No	No	No	7 of 7	The answers point to the deployer test (Article 3(4)).	No
EXAMPLE	AI-003	No	No	No	Yes	No	No	No	7 of 7	The answers point to the deployer test (Article 3(4)).	No
EXAMPLE	AI-004	No	No	No	Yes	No	No	No	7 of 7	The answers point to the deployer test (Article 3(4)).	No
EXAMPLE	AI-005	No	No	No	Yes	No	No	No	7 of 7	The answers point to the deployer test (Article 3(4)).	No
EXAMPLE	AI-006	No	No	No	Yes	No	No	No	7 of 7	The answers point to the deployer test (Article 3(4)).	No
EXAMPLE	AI-007	No	No	No	Yes	No	No	No	7 of 7	The answers point to the deployer test (Article 3(4)).	No

Checklists

PP-01 to PP-10: prohibited practices (Article 5). HA-1 to HA-8: Annex III areas, answered only for areas you checked. TD-1 to TD-4: Article 50 duties. What each ID asks is on the Reference sheet.

Row	Use ID	PP-01	PP-02	PP-03	PP-04	PP-05	PP-06	PP-07	PP-08	PP-09	PP-10	HA-2	HA-4	HA-5	TD-1	TD-2	TD-4	Prohibited-practice summary	Stop and take to Legal?	Annex III areas to take to Legal	Article 50 duties that might apply	Areas checked and our reading
EXAMPLE	AI-001	No	No	No	No	No	No	No	No	No	No					Might apply		10 of 10 answered; 0 Yes, 0 Unsure	No	None ticked	TD-2
EXAMPLE	AI-002	No	No	No	No	No	No	No	No	No	No	No						10 of 10 answered; 0 Yes, 0 Unsure	No	None ticked	None ticked	HA-2: The module forecasts stock quantities. It is not a safety component in the management or operation of critical digital infrastructure, road traffic or the supply of water, gas, heating or electricity, so we do not read it as in this area.
EXAMPLE	AI-003	No	No	No	No	No	No	No	No	No	No			No	Might apply	Might apply		10 of 10 answered; 0 Yes, 0 Unsure	No	None ticked	TD-1, TD-2	HA-5: The assistant answers order and delivery questions. It does not evaluate creditworthiness, set a credit score or price insurance, so we do not read it as in this area; a rule that it never gives such answers is a condition.
EXAMPLE	AI-004	No	No	No	No	No	No	No	No	No	No					Might apply	Might apply	10 of 10 answered; 0 Yes, 0 Unsure	No	None ticked	TD-2, TD-4
EXAMPLE	AI-005	No	No	No	No	No	No	No	No	No	No							10 of 10 answered; 0 Yes, 0 Unsure	No	None ticked	None ticked
EXAMPLE	AI-006	No	No	No	No	No	No	No	No	No	No	No	No					10 of 10 answered; 0 Yes, 0 Unsure	No	None ticked	None ticked	HA-4: The detection looks at account activity to protect our systems. It is not used to evaluate the performance or behaviour of staff or to decide anything about them, and a condition says so; if that changed we would treat it as in this area. HA-2: It monitors our logs and controls nothing, so we do not read it as a safety component of critical digital infrastructure.
EXAMPLE	AI-007	No	No	No	No	No	No	No	No	No	No		Might be in this area					10 of 10 answered; 0 Yes, 0 Unsure	No	HA-4	None ticked	HA-4: Annex III point 4(a) lists systems intended for the recruitment or selection of people, including to filter applications and evaluate candidates. A ranking add-on matches that wording.

Reference

The Act's tests and checklists

The words the other sheets point to, as the pack's facts hold them from the Act's text. Nothing on this sheet is yours to change.

Who the Act binds, and the word distributor

Regulation (EU) 2024/1689 binds the operators of its Article 2(1): providers, deployers, importers, distributors, product manufacturers and authorised representatives. An organisation that uses another party’s AI system under its own authority for its business is a deployer (Article 3(4)). An organisation that sells goods and is called a distributor in its trade is not an AI Act distributor unless it makes an AI system available on the Union market (Article 3(7)). Which role an organisation holds for each system depends on the facts, and counsel confirms it.

A business that distributes goods, such as a wholesale distributor, is not a distributor under the AI Act. The Act's distributor makes an AI system available on the Union market. An organisation that uses AI tools in its own work is looking at the deployer test.

Operators of Article 3

The tests are the Act's. A role is a conclusion for counsel to confirm.

ID	Operator	Article	The test	Who it usually is
OR-1	Provider	Article 3(3)	The organisation develops the system, or has it developed, and places it on the market or puts it into service under its own name or trademark.	The supplier of an AI tool, or an organisation that builds one for others or sells another party's tool under its own brand.
OR-2	Deployer	Article 3(4)	The organisation uses the system under its own authority, other than for a personal non-professional activity.	Most organisations, for the AI they use at work: staff using an assistant, a forecasting feature or a supplier's chatbot.
OR-3	Importer	Article 3(6)	The organisation is located or established in the Union and places on the market a system that bears the name or trademark of a person established in a third country.	An organisation that brings a non-EU supplier's AI product into the EU market to sell.
OR-4	Distributor	Article 3(7)	The organisation is in the supply chain, is neither the provider nor the importer, and makes an AI system available on the Union market.	A reseller of AI products. A wholesaler of goods that only uses AI is not an AI Act distributor.
OR-5	Authorised representative	Article 3(5)	The organisation is located or established in the Union and has accepted a written mandate from a provider to carry out the provider's obligations on its behalf.	An EU entity appointed by a non-EU provider.

Role questions

Answer these on the Role Reasoning sheet, one use at a time.

ID	Question
RQ-1	Did we develop the system, or have it developed for us? Building an application or feature on a supplier's model API counts.
RQ-2	Do we offer it to anyone under our own name or trademark, or does our name appear on it when others use it?
RQ-3	Have we changed what it is meant for (its intended purpose, Article 3(12)), or made a substantial change to it, so that it becomes high-risk?
RQ-4	Do we use it under our own authority for our business?
RQ-5	Is the use purely personal and non-professional?
RQ-6	Do we bring it into the Union from a non-EU supplier under that supplier's name, or make it available onward to others?
RQ-7	Has a non-EU provider given us a written mandate to act for it?

What the answers point to

The Role Reasoning sheet puts these seven sentences together. They point to a test. They do not say which role the organisation holds.

Shown when	Sentence
RQ-5 is Yes	The use is purely personal and non-professional, which the Act sets outside the deployer obligations (Article 2(10)).
RQ-4 is Yes and RQ-5 is not Yes	The answers point to the deployer test (Article 3(4)).
RQ-1 or RQ-2 is Yes	The answers point to the provider test (Article 3(3)). Legal decides before the use starts.
RQ-3 is Yes	The answers point to Article 25(1): a deployer that changes the purpose or makes a substantial change to a high-risk system can be treated as its provider. Legal decides.
RQ-6 is Yes	The answers point to the importer or distributor tests (Article 3(6) and 3(7)). Legal decides.
RQ-7 is Yes	The answers point to the authorised representative test (Article 3(5)). Legal decides.
no question points to a role	The answers do not point to any role. Record why, and ask Legal.

Prohibited practices (Article 5)

Any Yes or Unsure stops the use and takes it to Legal. The last column follows the date on the Duties and Dates sheet.

ID	Article 5(1)	Practice	The question	Applies from	Status at the date you set
PP-01	5(1)(a)	Subliminal, manipulative or deceptive techniques	Does the system use techniques beyond a person's awareness, or purposefully manipulative or deceptive techniques, that materially distort behaviour and are reasonably likely to cause significant harm?	2 Feb 2025	Applies
PP-02	5(1)(b)	Exploiting vulnerabilities	Does the system exploit vulnerabilities due to age, disability or a specific social or economic situation, to distort behaviour in a way likely to cause significant harm?	2 Feb 2025	Applies
PP-03	5(1)(c)	Social scoring	Does the system evaluate or classify people over time on social behaviour or personal characteristics, with detrimental treatment in unrelated contexts or that is unjustified or disproportionate?	2 Feb 2025	Applies
PP-04	5(1)(d)	Predicting offences from profiling	Does the system assess the risk of a person committing a criminal offence solely from profiling or personality traits?	2 Feb 2025	Applies
PP-05	5(1)(e)	Untargeted scraping of faces	Does the system create or expand a facial recognition database by untargeted scraping of facial images from the internet or CCTV?	2 Feb 2025	Applies
PP-06	5(1)(f)	Inferring emotions at work or in education	Does the system infer the emotions of a person at work (staff, contractors, candidates) or in education, for example from a voice or a video call? The exception is for medical or safety reasons. The Commission's guidelines treat a call centre tracking its employees' emotions, and monitoring the emotional tone of staff video calls, as prohibited.	2 Feb 2025	Applies
PP-07	5(1)(g)	Biometric categorisation of sensitive traits	Does the system categorise people by biometric data to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation?	2 Feb 2025	Applies
PP-08	5(1)(h)	Real-time remote biometric identification for law enforcement	Is the system real-time remote biometric identification in a publicly accessible space for law enforcement?	2 Feb 2025	Applies
PP-09	5(1)(ba)	Intimate images of a real person without consent	Does the system generate or manipulate realistic images, video or audio of an identifiable person's intimate parts, or of the person in sexually explicit activity, without the person's consent?	2 Dec 2026	Not yet: from 2026-12-02
PP-10	5(1)(bb)	Child sexual abuse material	Does the system generate or manipulate child sexual abuse material?	2 Dec 2026	Not yet: from 2026-12-02

Annex III areas (Article 6(2))

The use cases in each area are as the Annex words them: read them in the Act. A question here only points to the area.

ID	Annex III point	Area	What to ask
HA-1	1	Biometrics	Does the system identify people remotely by biometrics, categorise them by sensitive traits, or recognise emotions?
HA-2	2	Critical infrastructure	Is the system a safety component in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity?
HA-3	3	Education and vocational training	Does the system decide access or admission, evaluate learning outcomes, assess the level of education, or monitor tests?
HA-4	4	Employment, workers' management and access to self-employment	Does the system recruit or select people, filter or rank applications, evaluate candidates, decide terms, promotion or termination, allocate tasks on behaviour or traits, or monitor and evaluate the performance and behaviour of workers?
HA-5	5	Essential private and public services and benefits	Does the system evaluate eligibility for public benefits, creditworthiness or credit scores of people, price life or health insurance, or classify emergency calls?
HA-6	6	Law enforcement	Is the system used by or for law enforcement for the purposes the Annex lists?
HA-7	7	Migration, asylum and border control	Is the system used by or for public authorities in migration, asylum or border control for the purposes the Annex lists?
HA-8	8	Administration of justice and democratic processes	Does the system help a judicial authority research and apply the law, or influence the outcome of an election or referendum?
Article 6(3): an Annex III system is not high-risk where it does not pose a significant risk of harm and one of these conditions holds. The provider documents the assessment.
1. The system is intended to perform a narrow procedural task.
2. The system is intended to improve the result of a previously completed human activity.
3. The system is intended to detect decision-making patterns or deviations from earlier patterns and is not meant to replace or influence the human assessment without proper human review.
4. The system is intended to perform a preparatory task to an assessment relevant to the Annex III use cases.
An Annex III system that performs profiling of natural persons is always high-risk (Article 6(3), last subparagraph).

Transparency (Article 50)

Applies from 2 Aug 2026. The last column follows the date on the Duties and Dates sheet.

ID	Article	Carried by	The duty	What to ask ourselves	Status at the date you set
TD-1	50(1)	Provider	Design systems that interact directly with people so that the people are told they are dealing with an AI system, unless it is obvious.	Do customers or the public deal with the system? Does the supplier tell them? Do we keep that notice in place?	Applies
TD-2	50(2)	Provider	Mark synthetic audio, image, video or text output in a machine-readable format so that it is detectable as artificially generated. Providers of systems placed on the market before 2 August 2026 have until 2 December 2026.	Does the supplier say its output is marked? We do not remove the marking.	Applies
TD-3	50(3)	Deployer	Inform people exposed to an emotion recognition system or a biometric categorisation system of its operation, and process the personal data lawfully.	Does the system recognise emotions or categorise people by biometrics? (Check PP-06 and PP-07 first.)	Applies
TD-4	50(4)	Deployer	Disclose that image, audio or video content that is a deep fake is artificially generated or manipulated. Disclose AI-generated or manipulated text published to inform the public on matters of public interest, unless a person reviewed it and holds editorial responsibility.	Do we publish realistic AI-generated images, audio or video of real people, places, objects or events, or AI text on a public-interest matter? Who labels it?	Applies

Duties and Dates

Dates, and the duties of a deployer of a high-risk system

The date you set decides the status shown here and on the Reference sheet. The duties apply to systems you read as falling in Annex III, from the date shown. Counsel confirms which they are.

Position as at

30 Sep 2026

EXAMPLE: 30 Sep 2026. Type a date, never a formula.

When each part of the Act applies

ID	From	What	Status at the date above
DT-1	2 Feb 2025	Chapters I and II: the definitions, AI literacy (Article 4) and the prohibited practices (Article 5, points (a) to (h)).	In force
DT-2	2 Aug 2025	The governance rules, general-purpose AI models (Chapter V), penalties (Chapter XII, except Article 101) and notified bodies (Chapter III, Section 4).	In force
DT-3	27 Jul 2026	Regulation (EU) 2026/1744 in force: the replaced Article 4, and the new date for Annex III systems.	In force
DT-4	2 Aug 2026	The general date of application, including the transparency duties of Article 50. Providers of generative systems placed on the market before this date have until 2 December 2026 for Article 50(2).	In force
DT-5	2 Dec 2026	Article 5(1) points (ba) and (bb), with Article 5(1a) and (1b): intimate images without consent and child sexual abuse material.	Not yet
DT-6	2 Dec 2027	Chapter III, Sections 1, 2 and 3 for systems high-risk under Article 6(2) and Annex III, including the deployer duties of Article 26.	Not yet
DT-7	2 Aug 2028	Chapter III, Sections 1, 2 and 3 for systems high-risk under Article 6(1) and Annex I (safety components of regulated products).	Not yet

Dates are those in Article 113 as amended by Regulation (EU) 2026/1744, in force from 27 July 2026: the prohibitions and AI literacy from 2 February 2025; general-purpose AI models from 2 August 2025; the general date and Article 50 from 2 August 2026; Article 5(1) points (ba) and (bb) from 2 December 2026; high-risk systems under Annex III from 2 December 2027 and under Annex I from 2 August 2028.

What is adopted and what is only proposed

Status	Item
Adopted and in force	Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force from 27 July 2026: replaced Article 4, added two prohibitions from 2 December 2026, moved the high-risk dates to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
Adopted, non-binding	Commission guidelines on prohibited practices (C(2025) 5052), on the definition of an AI system (6 February 2025), on the scope of obligations for providers of general-purpose AI models, and on Article 50 (C(2026) 5054, 20 July 2026).
Draft	Commission guidelines on the classification of high-risk systems (Article 6(5)): a draft published on 19 May 2026, consultation to 23 July 2026. The Act asked for them by 2 February 2026.
Proposed only	The Commission's proposal COM(2025) 837 to amend Regulation (EU) 2016/679 and related law, in committee in the European Parliament on 8 October 2026.

Deployer duties for a system you read as in Annex III (Article 26)

Duties in place	0 of 9 applicable duties in place
Duties apply from	2 Dec 2027	Not yet in force at the date above
System recorded here	[[Use ID of the system]]

ID	Article	Duty	Evidence to keep
DD-1	26(1)	Use the system in accordance with the instructions for use, with appropriate technical and organisational measures.	The instructions for use on file, and the settings and procedures that follow them.
DD-2	26(2)	Assign human oversight to people with the necessary competence, training, authority and support.	Named overseers, their training record (A09) and their authority to stop the system.
DD-3	26(4)	Where the deployer controls the input data, make sure it is relevant and sufficiently representative for the intended purpose.	The input data description and the checks on it.
DD-4	26(5)	Monitor the operation; inform the provider or distributor and the authority and suspend use where there is reason to think it presents a risk; report a serious incident to the provider first, then the importer or distributor and the authorities.	The monitoring plan, the suspension rule and the incident hand-over (AT-8).
DD-5	26(6)	Keep the logs the system generates and the deployer controls for a period appropriate to the purpose, at least 6 months, unless other law says otherwise.	The log location, retention setting and access.
DD-6	26(7)	Before using a high-risk system at the workplace, an employer informs the workers' representatives and the workers affected.	The notice and its date, with HR's record (AG-21).
DD-7	26(9)	Use the provider's information to carry out the data protection impact assessment, where one is required.	The impact assessment (GDPR Article 35) and the provider information it used.
DD-8	26(11)	Inform the people who are subject to the use of an Annex III high-risk system that makes or assists decisions about them.	The notice to the people affected.
DD-9	26(12)	Cooperate with the competent authorities.	The named contact for authority requests (Legal).

A fundamental rights impact assessment before deployment (Article 27) is required of deployers that are bodies governed by public law or private entities providing public services, and of deployers of the creditworthiness and life or health insurance systems in Annex III, points 5(b) and (c). Record whether it applies to each system.

The logs a high-risk system generates are kept for at least 6 months where the deployer controls them (DD-5). The pack's own records period is in AG-12 (3 years, the adopter confirms it).

EXAMPLE: the one use read as possibly in Annex III, AI-007, was declined at screening, so the duties table is blank. A use that is approved and falls in Annex III is Tier 3 and starts only after Legal's confirmation and the Tier 3 decision.

Lists

YesNo	PPAnswer	AreaAnswer	TDAnswer	DutyStatus
Yes	No	No	No	Not started
No	Yes	Might be in this area	Might apply	In progress
	Unsure	Unsure	Unsure	In place

Not applicable

Definitions

Definitions

Term	Meaning in this workbook
Deployer	An organisation that uses an AI system under its own authority for its business (EU AI Act Article 3(4)). Most organisations are deployers of the AI they use.
Provider	An organisation that develops an AI system, or has one developed, and puts it on the market or into service under its own name or trademark (EU AI Act Article 3(3)). Building a tool for others, or selling another party's tool under your own brand, can make an organisation a provider. Building an application or feature on a supplier's model API (prompts, retrieval, tools or code around a model you call) counts as building for this policy, whether it is for staff or for customers; using a supplier's finished product as supplied does not. The question is a signal that sends the use to Legal, and it is not a finding that the organisation is a provider. Counsel decides.
Distributor (AI Act)	The organisation is in the supply chain, is neither the provider nor the importer, and makes an AI system available on the Union market. A business that distributes goods, such as a wholesale distributor, is not a distributor under the AI Act. The Act's distributor makes an AI system available on the Union market. An organisation that uses AI tools in its own work is looking at the deployer test.
Importer	The organisation is located or established in the Union and places on the market a system that bears the name or trademark of a person established in a third country.
AI system	A machine-based system that infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions (EU AI Act Article 3(1)). A chat assistant, an image generator, a forecasting feature and a spam filter that learns are all AI systems. A fixed formula is not.
Prohibited practice	An AI practice that Article 5 of the EU AI Act prohibits outright, such as inferring the emotions of staff at work (with medical or safety exceptions).
High-risk	An AI system the EU AI Act places in its high-risk category under Article 6, for example a system used to select job applicants (Annex III, point 4). The category carries duties for providers and for deployers.
Instructions for use	The information a provider supplies about an AI system's intended purpose and proper use (EU AI Act Article 3(15)). A deployer keeps it and follows it.
Reasoning	Your own written reading of the Act's text against the facts of the use. It records what you looked at and why you read it as you did. It is not a conclusion about the law, and counsel confirms it.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Clear it before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 5.31 — Legal, statutory, regulatory and contractual requirements	The whole workbook: the legal and contractual requirements of the AI Act, read and recorded for each use
ISO/IEC 42001:2023	Clause 4.2 — Understanding the needs and expectations of interested parties	The whole workbook: the authorities and people the Act gives rights to
ISO/IEC 42001:2023	Clause 6.1 — Actions to address risks and opportunities	The whole workbook: risk and impact, read against the Act
NIST CSF 2.0	GV.OC-03 — “Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed”	The whole workbook: the legal and regulatory requirements that apply to the organisation, understood and recorded
EU AI Act — Regulation (EU) 2024/1689	Article 2(1) — applies to providers placing AI systems on the market or putting them into service in the Union; deployers of AI systems that have their place of establishment or are located within the Union; providers and deployers in a third country where the output of the system is used in the Union; importers and distributors of AI systems; product manufacturers; authorised representatives of providers not established in the Union; and affected persons located in the Union	Reference sheet: who the Act binds
EU AI Act — Regulation (EU) 2024/1689	Article 2(10) — “does not apply to obligations of deployers who are natural persons using AI systems in the course of a purely personal non-professional activity”	RQ-5: a purely personal, non-professional use
EU AI Act — Regulation (EU) 2024/1689	Article 2(11) — does not preclude the Union or Member States from maintaining or introducing laws, regulations or administrative provisions that are more favourable to workers in protecting their rights in respect of the use of AI systems by employers, or from encouraging or allowing collective agreements that are more favourable to workers	Reference sheet: national rules more favourable to workers, checked with Legal
EU AI Act — Regulation (EU) 2024/1689	Article 3(1) — “AI system” means “a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments”	Whether a feature is an AI system at all
EU AI Act — Regulation (EU) 2024/1689	Article 3(3) — “provider” means “a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge”	RQ-1 and RQ-2: the provider test
EU AI Act — Regulation (EU) 2024/1689	Article 3(4) — “deployer” means “a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity”	RQ-4: the deployer test
EU AI Act — Regulation (EU) 2024/1689	Article 3(5), (6) and (7) — an “authorised representative” is a person located or established in the Union who has received and accepted a written mandate from a provider to perform the provider’s obligations on its behalf; an “importer” is a person located or established in the Union that places on the market an AI system bearing the name or trademark of a person established in a third country; a “distributor” is a person in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market	RQ-6 and RQ-7: the importer, distributor and authorised representative tests, and the note on the word distributor
EU AI Act — Regulation (EU) 2024/1689	Article 3(8) — “operator” means “a provider, product manufacturer, deployer, authorised representative, importer or distributor”	Operators table: who counts as an operator
EU AI Act — Regulation (EU) 2024/1689	Article 3(12) — “intended purpose” means “the use for which an AI system is intended by the provider, including the specific context and conditions of use, as specified in the information supplied by the provider in the instructions for use, promotional or sales materials and statements, as well as in the technical documentation”	RQ-3 and the Annex III reading: intended purpose
EU AI Act — Regulation (EU) 2024/1689	Article 3(49) — “serious incident” means an incident or malfunctioning of an AI system that directly or indirectly leads to the death of a person or serious harm to a person’s health; a serious and irreversible disruption of the management or operation of critical infrastructure; the infringement of obligations under Union law intended to protect fundamental rights; or serious harm to property or the environment	DD-4: a serious incident
EU AI Act — Regulation (EU) 2024/1689	Article 3(56) — “AI literacy” means “skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations in the context of this Regulation, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause”	Reasoning: who needs AI literacy (the literacy plan holds the detail)
EU AI Act — Regulation (EU) 2024/1689	Article 3(63) and (66) — a “general-purpose AI model” is an AI model that “displays significant generality and is capable of competently performing a wide range of distinct tasks”, and a “general-purpose AI system” is an AI system based on such a model that “has the capability to serve a variety of purposes, both for direct use as well as for integration in other AI systems”	General-purpose AI: how a supplier's model is described
EU AI Act — Regulation (EU) 2024/1689	Article 4(1), as replaced by Regulation (EU) 2026/1744 — providers and deployers of AI systems “shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”, taking into account their technical knowledge, experience, education and training, the context the systems are used in and the persons on whom they are used; “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” Article 4(2) and (3) have the Commission and the Member States support deployers, in particular SMEs, with practical examples, and have the AI Board adopt recommendations. The replaced text applies from the Omnibus’s entry into force on 27 July 2026; Article 4 itself has applied since 2 February 2025	Reasoning: AI literacy applies to the deployer; DD-2 asks for trained overseers
EU AI Act — Regulation (EU) 2024/1689	Article 5(1), points (a) to (h) — prohibited, from 2 February 2025: AI that deploys subliminal, purposefully manipulative or deceptive techniques that materially distort behaviour and cause significant harm (a); exploits vulnerabilities due to age, disability or a specific social or economic situation (b); evaluates or classifies people by social behaviour or personal characteristics, with detrimental treatment in unrelated contexts or that is unjustified or disproportionate (c); assesses the risk of a person committing a criminal offence based solely on profiling or personality traits (d); creates or expands facial recognition databases by untargeted scraping of facial images from the internet or CCTV (e); infers emotions in the areas of workplace and education institutions, except for medical or safety reasons (f); categorises people by biometric data to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation (g); and, with narrow exceptions, real-time remote biometric identification in publicly accessible spaces for law enforcement (h). Regulation (EU) 2026/1744 adds points (ba) and (bb) (AI that generates or manipulates realistic intimate images of an identifiable person without consent, and AI that generates or manipulates child sexual abuse material), with Article 5(1a) and (1b), from 2 December 2026	Checklists sheet, PP-01 to PP-10
EU AI Act — Regulation (EU) 2024/1689	Article 5(1)(f) — prohibits “the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons”	PP-06: inferring emotions at work
EU AI Act — Regulation (EU) 2024/1689	Article 6(2) — in addition to systems that are safety components of products under Annex I, “AI systems referred to in Annex III shall be considered to be high-risk”	HA-1 to HA-8: the Annex III route to the high-risk category
EU AI Act — Regulation (EU) 2024/1689	Article 6(3) — an Annex III system is not high-risk where it “does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making”, which applies where it is intended to perform a narrow procedural task, improve the result of a previously completed human activity, detect decision-making patterns without replacing or influencing the human assessment, or perform a preparatory task; “an AI system referred to in Annex III shall always be considered to be high-risk where the AI system performs profiling of natural persons”. The provider documents the assessment before the system is placed on the market (Article 6(4))	Reference sheet: the four conditions and the profiling rule
EU AI Act — Regulation (EU) 2024/1689	Article 6(5) — the Commission shall provide guidelines specifying the practical implementation of Article 6, with a comprehensive list of practical examples of high-risk and not high-risk use cases, “no later than 2 February 2026”. Draft guidelines were published on 19 May 2026 and were still a draft on 8 October 2026	Reference sheet: the Commission's guidelines on classification are still a draft
EU AI Act — Regulation (EU) 2024/1689	Annex III — high-risk systems pursuant to Article 6(2) are those listed in eight areas: 1 biometrics; 2 critical infrastructure; 3 education and vocational training; 4 employment, workers’ management and access to self-employment; 5 access to and enjoyment of essential private services and essential public services and benefits; 6 law enforcement; 7 migration, asylum and border control management; 8 administration of justice and democratic processes. Each area lists the use cases, and the use cases are as the Annex words them	HA-1 to HA-8: the eight areas
EU AI Act — Regulation (EU) 2024/1689	Annex III, point 4 — employment, workers’ management and access to self-employment: AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates; and AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics, or to monitor and evaluate the performance and behaviour of persons in such relationships	HA-4: employment and workers' management
EU AI Act — Regulation (EU) 2024/1689	Annex III, point 5 — essential services: among other use cases, AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, except those used to detect financial fraud, and AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance	HA-5: essential services, creditworthiness and insurance
EU AI Act — Regulation (EU) 2024/1689	Article 25(1) — a distributor, importer, deployer or other third party “shall be considered to be a provider of a high-risk AI system” and subject to the provider’s obligations where it puts its name or trademark on a high-risk system already on the market, makes a substantial modification to a high-risk system that remains high-risk, or modifies the intended purpose of a system that was not high-risk so that it becomes high-risk under Article 6	RQ-3: when a deployer can be treated as a provider
EU AI Act — Regulation (EU) 2024/1689	Article 26(1) — deployers of high-risk AI systems “shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems”. The obligations of Article 26 applies from 2 December 2027 to systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 to those under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as amended by Regulation (EU) 2026/1744)	DD-1 and the date the duties apply
EU AI Act — Regulation (EU) 2024/1689	Article 26(2) — deployers “shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support”	DD-2: human oversight
EU AI Act — Regulation (EU) 2024/1689	Article 26(5) — deployers monitor the operation of the high-risk system on the basis of the instructions for use; where they have reason to consider that use may present a risk within the meaning of Article 79(1) they inform the provider or distributor and the market surveillance authority “without undue delay” and suspend use; where they identify a serious incident they “immediately inform first the provider, and then the importer or distributor and the relevant market surveillance authorities”	DD-4: monitoring, suspension and reporting
EU AI Act — Regulation (EU) 2024/1689	Article 26(6) — deployers keep the logs automatically generated by the high-risk system, to the extent the logs are under their control, “for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in applicable Union or national law, in particular in Union law on the protection of personal data”	DD-5: logs
EU AI Act — Regulation (EU) 2024/1689	Article 26(7) — before putting into service or using a high-risk system at the workplace, deployers who are employers “shall inform workers’ representatives and the affected workers that they will be subject to the use of the high-risk AI system”	DD-6: telling workers' representatives
EU AI Act — Regulation (EU) 2024/1689	Article 26(11) — deployers of Annex III high-risk systems “that make decisions or assist in making decisions related to natural persons shall inform the natural persons that they are subject to the use of the high-risk AI system”	DD-8: telling people subject to a decision
EU AI Act — Regulation (EU) 2024/1689	Article 27(1) — a fundamental rights impact assessment before deploying a high-risk system under Article 6(2) is required of deployers that are bodies governed by public law or private entities providing public services, and of deployers of the systems in points 5(b) and (c) of Annex III (creditworthiness, and life and health insurance pricing)	Duties and Dates sheet: the fundamental rights impact assessment note
EU AI Act — Regulation (EU) 2024/1689	Article 50(1) — providers ensure that AI systems intended to interact directly with natural persons are designed so that the persons are informed that they are interacting with an AI system, “unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect”	TD-1: telling people they deal with an AI system
EU AI Act — Regulation (EU) 2024/1689	Article 50(2) — providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content “shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated”; providers of systems placed on the market before 2 August 2026 have until 2 December 2026 to take the necessary steps (Article 111(4), added by Regulation (EU) 2026/1744)	TD-2: marking synthetic output
EU AI Act — Regulation (EU) 2024/1689	Article 50(3) — deployers of an emotion recognition system or a biometric categorisation system “shall inform the natural persons exposed thereto of the operation of the system”, and process the personal data in accordance with the data protection regulations	TD-3: emotion recognition and biometric categorisation
EU AI Act — Regulation (EU) 2024/1689	Article 50(4) — deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake “shall disclose that the content has been artificially generated or manipulated”; deployers of an AI system that generates or manipulates text published “with the purpose of informing the public on matters of public interest” disclose that the text has been artificially generated or manipulated, unless it has undergone human review or editorial control and a person holds editorial responsibility for the publication	TD-4: deep fakes and public-interest text
EU AI Act — Regulation (EU) 2024/1689	Article 50(5) — the information is given to the natural persons concerned “in a clear and distinguishable manner at the latest at the time of the first interaction or exposure”, and conforms to the applicable accessibility requirements	TD-1 to TD-4: how and when the information is given
EU AI Act — Regulation (EU) 2024/1689	Article 99(4) — non-compliance with the obligations of providers (Article 16), authorised representatives, importers, distributors, deployers (Article 26) and the transparency obligations of providers and deployers (Article 50) is subject to administrative fines of up to EUR 15 000 000 or, for an undertaking, up to 3 % of total worldwide annual turnover for the preceding financial year, whichever is higher. Member States lay down the rules on penalties (Article 99(1))	Reference sheet: the fines that sit behind the roles and Article 50
EU AI Act — Regulation (EU) 2024/1689	Article 99(3) — non-compliance with the prohibitions of Article 5 is subject to administrative fines of up to EUR 35 000 000 or, for an undertaking, up to 7 % of total worldwide annual turnover for the preceding financial year, whichever is higher	Reference sheet: the fines that sit behind the prohibitions
EU AI Act — Regulation (EU) 2024/1689	Article 113, as amended — the Regulation applies from 2 August 2026, except that Chapters I and II (including Articles 4 and 5) apply from 2 February 2025, with Article 5(1) points (ba) and (bb) and Article 5(1a) and (1b) applying from 2 December 2026; Chapter III Section 4, Chapter V (general-purpose AI models), Chapter VII and Chapter XII and Article 78 apply from 2 August 2025, except Article 101; and Chapter III Sections 1, 2 and 3, except Article 6(5), apply from 2 December 2027 as regards systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 as regards those under Article 6(1) and Annex I. Article 50 is not listed in an exception and so applies from 2 August 2026	Duties and Dates sheet: when each part applies
EU AI Act — Regulation (EU) 2026/1744 (Digital Omnibus on AI)	Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Official Journal, 24 July 2026); in force on the third day after publication (its Article 4), 27 July 2026. Its Article 1 amends Regulation (EU) 2024/1689	Duties and Dates sheet: what the amending Regulation changed
EU AI Act — Commission guidelines (non-binding)	Commission Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act), 6 February 2025; non-binding	Whether a feature is an AI system at all
EU AI Act — Commission guidelines (non-binding)	Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act), C(2025) 5052 final, 29 July 2025; non-binding	PP-01 to PP-10: how the Commission reads the prohibitions
EU AI Act — Commission guidelines (non-binding)	Commission Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of Regulation (EU) 2024/1689, C(2026) 5054 final, 20 July 2026; non-binding	TD-1 to TD-4: how the Commission reads Article 50
EU AI Act — Commission guidelines (non-binding)	Commission guidelines on the scope of obligations for providers of general-purpose AI models under the AI Act; the Commission’s page says they entered into application on 2 August 2025; non-binding	General-purpose AI: the scope of a supplier's duties
EU AI Act — Commission guidelines (non-binding)	Draft Commission guidelines on the classification of high-risk AI systems, published 19 May 2026 for targeted consultation (general principles; Annex I; Annex III); a draft on 8 October 2026, not adopted	HA-1 to HA-8: the classification guidelines are a draft

Editions referenced: Regulation (EU) 2024/1689 (the EU AI Act) as amended by Regulation (EU) 2026/1744; ISO/IEC 27001:2022 incl. Amd 1:2024; ISO/IEC 42001:2023 (by number and title only); NIST CSF 2.0; NIST AI RMF 1.0; Regulation (EU) 2016/679 (GDPR); as published and read on 8 October 2026

ISO/IEC 27001 and ISO/IEC 42001 references name the clause or control this document relates to, by number and title only. ISO/IEC 42001 is a paid standard whose text was not read for this document. A reference does not say that meeting a clause or control meets any requirement of the EU AI Act.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.

The Commission’s guidelines explain how the Commission reads the Act. They are not binding, and only the Court of Justice of the European Union gives an authoritative interpretation of the Act. Member States lay down the penalties for infringements (Article 99(1)) and designate the authorities that enforce the Act, and no national text was read for these documents.