Figure 1. Malicious use sub-risks and type of AI Act obligations imposed

1. Prohibition: refers to the ban of those use cases that pose unacceptable risks to society, (Article 5). 2. Preventive risk management: risk assessment and risk mitigation duties for providers of GPAI models with systemic risks (Article 55, para 1 (b)). 3. Incident reporting: documentation and reporting of serious incidents (Article 55, para 1 (c)). 4. Cybersecurity obligations: for high-risk system providers, the obligations entail ensuring resilience against attacks by third parties that exploit systems’ vulnerabilities and demonstrate compliance with sectoral and other cybersecurity obligations (Article 15, para 5; Annex IV, para 2 (h)); in the case of providers of GPAI models with systemic risks, they should also ensure an adequate level of cybersecurity protection (Article 55, para 1(d)). 5. Human oversight: requirement of high-risk AI systems to be overseen by humans during their use in the spirit of preventing or minimising “the risks to health, safety or fundamental rights” both when the AI system is used for “its intended purpose or under conditions of reasonably foreseeable misuse” (Article 14, para 1, 2). 6. Transparency obligations: applicable to different aspects and use-cases of AI systems. In the case of AI systems intended for human-machine interaction (e.g. a chatbot), providers need to ensure that natural persons are aware of the nature of the interaction (Art. 40, para 1), and synthetic content should be labelled as such. Deployers (users) of AI systems that produce deepfakes, as well as AI-generated or manipulated text to inform on matters of public interest, should also disclose the artificial nature of the content (para 2, 4).
Chart: Paula Oliver Llorente - Elcano Royal InstituteSource: the author, based on the EU AI Act's provisionsGet the data