Play with the EU AI Act

The EU AI Act is long, dense and easy to get lost in. So here it is as a small map you can play with. Drag the nodes around, and click any one to see what it means in plain language.

This is a simplified guide to help you get oriented, not legal advice.

Click a node to read about it.

8 common misconceptions

Even people close to the file get these wrong. The reality, in plain terms.

❌ The EU AI Act has a two-year grace period and applies from August 2026.

✅ Different provisions apply at different times. Most apply from August 2026, but the AI-literacy and prohibited-AI provisions applied from February 2025, and the obligations for new general-purpose AI models from August 2025.

❌ All open-source AI models are exempt from the EU AI Act.

✅ Providers of open-source general-purpose AI models with systemic risk must meet all obligations for general-purpose AI models. Providers of other open-source general-purpose AI models must still publish a summary of the training data and put a copyright policy in place.

❌ High-risk AI models are regulated under the EU AI Act.

✅ The Act sets rules for prohibited practices, high-risk AI systems, general-purpose AI models and general-purpose AI systems. There is no such thing as a "high-risk AI model", and no rules for AI models that are not general-purpose.

❌ Transparency is required for "limited risk" AI systems.

✅ There are transparency obligations for certain AI systems, such as those that generate deepfake content, but the Act never calls these "limited risk" systems.

❌ Third-party conformity assessments are required for all high-risk AI systems.

✅ Providers of most Annex III high-risk systems do a self-assessment, with no notified body. Only in some biometric cases is a third-party conformity assessment needed.

❌ Fundamental-rights impact assessments are required for all high-risk AI systems.

✅ Only specific deployers of certain high-risk systems must do one, for example public-service deployers and those using AI for credit assessment or life and health insurance pricing.

❌ All high-risk AI systems must be registered in the public EU-wide database.

✅ Only Annex III high-risk systems must be registered. Systems used for critical-infrastructure safety are registered only at national level.

❌ Deployers do not need to register their use of high-risk AI systems.

✅ Deployers that are public authorities or EU institutions and bodies must register their use of the applicable Annex III high-risk systems in the public EU-wide database.

This little map is a toy version of something practical: turning a dense, shifting rulebook into something you can actually explore. The same idea, structuring messy documents into clean, linked knowledge, is what a tool like josepdfs does with clinical data. If your team is trying to make sense of the AI Act, or of any pile of documents, let’s talk.