Concepts you'll meet on day one
For: all
Tier: free+
Time: ~8 min
Why you'd do this
Three concepts shape what the dashboard shows you and how it scores your project: your operator role under EU AI Act Art. 3, the risk classification of the AI system, and the evidence types we accept. Without these, the per-article views look arbitrary.
Before you start
- Skim the chapter top-to-bottom — you don't need to memorise the tables; knowing they exist is enough
- If you only have 2 minutes, read sections 1 and 4 (operator role + evidence types) — those are the highest-leverage
Step 1
Operator roles (Art. 3)
EU AI Act assigns obligations by your role in the AI system's value chain, not by your company size or industry. There are six roles, and the same legal entity can hold more than one for different products:
| Role | Definition | Typical signals | |---|---|---| | Provider (Art. 3(3)) | Develops the AI system or has it developed and places it on the EU market under your name | You ship a model, host an API, train a model that customers use | | Deployer (Art. 3(4)) | Uses an AI system in your own activity | You buy an LLM API and embed it in your product | | Authorised Representative (Art. 3(5)) | A natural or legal person established in the EU mandated by a non-EU Provider to perform their tasks | You're the EU-based legal contact for a US-based AI Provider | | Importer (Art. 3(6)) | Established in the EU, places on the EU market an AI system bearing the name or trademark of a non-EU person | You distribute a foreign AI product in the EU under their name | | Distributor (Art. 3(7)) | Anyone in the supply chain other than Provider/Importer who makes an AI system available on the EU market | You resell or repackage an AI system | | Product Manufacturer (Art. 25(3)) | Places a high-risk AI system that is a safety component of a product covered by Annex I, Section A on the market together with the product under your name or trademark, or puts the AI system into service under that name or trademark after the product has been placed on the market | You ship a Section A product with an embedded high-risk AI safety component, or put that AI component into service after the product is on the market — treated as Provider for that high-risk AI system |
ComplianceLint asks for your role(s) on each repo and uses that to filter which articles apply. By role alone, 184 obligations are actionable for a Provider and 18 for a Distributor (out of 255 total across 46 articles); the Profiling Wizard narrows further.
What you'll see: The AI System Profile card in repo settings — a read-only summary of your Profiling Wizard answers, including the roles you stated, each with its Art. 3 reference.
Step 2
Risk classification (Art. 5, 6, 50)
Once role is known, the next gate is what the Regulation says about the AI system. It has prohibited practices (Art. 5), high-risk AI systems (Art. 6 with Annex I and Annex III) and transparency obligations for certain AI systems (Art. 50). You do not pick a class: the Profiling Wizard concludes one of four results from your answers:
- Prohibited practice (Art. 5) — banned outright. Examples include social scoring by public authorities and untargeted facial-recognition scraping.
- High-risk (Art. 6, Annex I and Annex III) — heavy obligations: technical documentation, conformity assessment, post-market monitoring, human oversight, etc. Annex III lists 8 sub-categories (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration/asylum, justice/democracy).
- Not high-risk — Article 50 transparency trigger identified — the Art. 50 transparency obligations (e.g. inform users they're interacting with AI; label deepfakes).
- Not high-risk — no Article 50 transparency trigger identified — no specific obligations beyond voluntary codes.
The wizard shows the result before you finish, and Settings → AI System Profile shows it afterwards. Once concluded, the per-repo banner groups the findings by the legal basis of the obligation and shows the illustrative statutory ceiling per established infringement, not per finding: €35 M or 7 % of worldwide annual turnover for the Art. 5 prohibitions (Art. 99(3)); €15 M or 3 % for the provisions listed in Art. 99(4), namely provider obligations under Art. 16, authorised-representative obligations under Art. 22, importer obligations under Art. 23, distributor obligations under Art. 24, obligations under Art. 25(2) and (4), deployer obligations under Art. 26, the listed notified-body requirements in Arts. 31, 33 and 34, and Art. 50 transparency obligations; and, for providers of general-purpose AI models, up to 3 % of worldwide annual turnover or €15 M, whichever is higher, imposed by the Commission under Art. 101. Obligations for which Art. 99(1) leaves the penalties to Member State rules (for example Art. 4 AI literacy) are marked as such; for systems within Art. 75(1), the AI Office may apply the Art. 99(4) level under Art. 75c(4). Supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request can be fined up to €7.5 M or 1 % under Art. 99(5). The SME lower-of rule in Art. 99(6) applies to Art. 99(3)-(5); the SMC lower-of rule in Art. 99(6a) applies to Art. 99(4)-(5) only. Neither applies to Art. 101. Findings on requirements that do not apply yet are listed separately, with counts only and no amount; scanner findings are not established infringements.
What you'll see: The repo overview banner with the max-penalty pill underneath the score ring. The concluded result itself is shown under Settings → AI System Profile → Risk.
Step 3
Company size class (Art. 99(6) and (6a))
For the fines in Art. 99(3)-(5), the maximum fine calculation depends on the enterprise's size class. The dashboard derives the size class from the headcount, annual turnover and balance sheet total you enter in Compliance Profile:
- SME (micro, small or medium-sized enterprise, including start-ups) —
min(fixed amount, turnover × percentage)for the fines of Art. 99(3)-(5) - SMC (small mid-cap enterprise) —
min(...)for the fines of Art. 99(4)-(5);max(...)for Art. 99(3) - Other enterprises —
max(fixed amount, turnover × percentage)for the fines of Art. 99(3)-(5) - Art. 101 (providers of general-purpose AI models) —
max(...)for every provider; the SME and SMC lower-of rules in Art. 99 do not apply
For high-risk AI systems, SMEs, including start-ups, and SMCs may use the simplified technical-documentation route in Art. 11(1). Without the figures, the dashboard shows the fixed amounts only (Free tier behaviour). Starter+ calculates the amount once the figures are entered.
What you'll see: Penalty configuration section — inputs for headcount, annual turnover and balance sheet total, from which the size class is derived. Free tier sees this disabled with an upgrade hint.
Step 4
Evidence types (v4 model)
Whenever the dashboard wants you to demonstrate compliance for an obligation, it accepts one of four evidence kinds:
| Type | What it is | Where it lives |
|---|---|---|
| Text attestation | Free-text written into the dashboard form | Dashboard DB only |
| External reference | Link to a doc you host elsewhere (GitHub issue, Drive, Confluence) | Just a URL, we don't fetch the content |
| Found by scan | A file path the scanner detected during a scan (e.g. docs/risk_assessment.md) | Already in your repo |
| Repo file upload | A file you upload via the dashboard which we relay into your git repo | Your repo's .compliancelint/evidence/ after the next sync |
Note: ComplianceLint never holds your evidence files long-term. Uploaded bytes are relayed and committed to your repo, then forgotten from our side. This is a hard architectural rule.
What you'll see: An obligation card with the Add evidence picker — four tabs matching the four types. Different tier gates apply to which tabs are enabled (see the chapter First evidence upload).
Step 5
Applicability — why so many obligations are NOT_APPLICABLE
The full obligation set is 255 obligations across 46 articles. For most projects, only ~30-80 of them actually apply. The rest are auto-marked NOT_APPLICABLE based on profile signals:
- Not a general-purpose AI model? → the 28 Art. 51-55 obligations skipped
- Not training your own model? → 10 Art. 10 data-governance items skipped
- Not generating synthetic media? → 3 Art. 50 deepfake items skipped
- Not an SME? → 1 SME-specific Art. 11 form skipped
- Not an Annex I product? → 1 single-doc Art. 11 path skipped
These signals are collected by the Profiling Wizard (Starter+, see the chapter Profiling Wizard deep dive). Free-tier users see all 255 obligations as worst-case; paid tiers get the filtered view.
What you'll see: Conceptual — no specific UI screen. The effect is visible in the obligation count on the repo overview before vs after running the Profiling Wizard.
Related
Last updated: 2026-10-29