Question 1

What is problem framing for an AI system?

Accepted Answer

Problem framing is the pre-build activity in which an organisation establishes, documents and understands the context of a proposed AI system — its intended purposes, prospective settings, users and stakeholders — before any decision to design, develop or deploy it. NIST AI 100-1 codifies this activity as the MAP function of the AI Risk Management Framework; ISO/IEC 22989:2022 supplies the standardised vocabulary around it. NIST AI 100-1 states that the MAP function "establishes the context to frame risks related to an AI system" and records that early decisions identifying an AI system's purposes and objectives can alter its behavior and capabilities (§5.2, p. 24). The first MAP category, MAP 1 — "Context is established and understood" — opens with subcategory MAP 1.1, under which intended purposes, potentially beneficial uses, context-specific laws, norms and expectations, and the prospective settings in which the AI system will be deployed are understood and documented, including the specific set or types of users along with their expectations (Table 2, p. 26). NIST further states that, after completing the MAP function, framework users should have sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system (p. 25). ISO/IEC 22989:2022 anchors the surrounding vocabulary: it defines a stakeholder as any individual, group or organisation positioned to affect a decision or activity, to be affected by it, or to regard itself as affected by it (clause 3.5.13, paraphrased), and frames the life cycle of a human-made entity as running from conception through retirement (clause 3.1.22, paraphrased).

Question 2

What does "intended purpose" mean under the EU AI Act, and where must it be stated?

Accepted Answer

Article 3(12) of Regulation (EU) 2024/1689 defines 'intended purpose' as "the use for which an AI system is intended by the provider, including the specific context and conditions of use, as specified in the information supplied by the provider in the instructions for use, promotional or sales materials and statements, as well as in the technical documentation". For high-risk AI systems, it must be stated in the instructions for use and in the technical documentation. The definition makes intended purpose a provider-declared fact, fixed by what the provider itself specifies across the instructions for use, promotional or sales materials and statements, and the technical documentation. For high-risk AI systems, Article 13(3)(b)(i) lists the system's intended purpose first among the characteristics, capabilities and limitations of performance that the instructions for use must contain, within information that Article 13(2) requires to be concise, complete, correct and clear. Annex IV, point 1(a) requires the technical documentation referred to in Article 11(1) to open with a general description of the AI system including "its intended purpose, the name of the provider and the version of the system reflecting its relation to previous versions". Article 3(15) separately defines the instructions for use as the information the provider gives the deployer covering, in particular, the AI system's intended purpose and proper use. Uses that depart from this declaration are addressed by the distinct concept of reasonably foreseeable misuse in Article 3(13), displayed below.

Question 3

How does intended purpose determine risk classification under Article 6?

Accepted Answer

Article 6 classifies an AI system as high-risk through two routes, both attached to the purpose the provider declares: under Article 6(1), an AI system intended to be used as a safety component of a product, or that is itself a product, covered by the Union harmonisation legislation in Annex I, where that product is required to undergo a third-party conformity assessment under that legislation; and under Article 6(2), the AI systems listed in Annex III. Under Article 6(1), an AI system is high-risk where both conditions are fulfilled: (a) the AI system is intended to be used as a safety component of a product, or is itself a product, covered by the Union harmonisation legislation listed in Annex I; and (b) that product, or the AI system itself as a product, is required to undergo a third-party conformity assessment with a view to its placing on the market or putting into service under that Annex I legislation. Under Article 6(1a) to (1c), inserted by Regulation (EU) 2026/1744, AI systems solely used for non-safety related aspects of user assistance, performance optimisation, service efficiency, automation or convenience or quality control do not qualify as safety components unless their failure or malfunctioning would endanger health and safety, and a product required to undergo a third-party conformity assessment solely due to risks other than risks to health and safety, such as risks relating to the distribution of radio spectrum or electromagnetic interference that do not affect health and safety, does not fulfil condition (b). Annex I is the list of Union harmonisation legislation, divided into Section A (acts based on the New Legislative Framework, such as Directive 2009/48/EC on the safety of toys) and Section B (other Union harmonisation legislation). Regulation (EU) 2026/1744 deleted Directive 2006/42/EC on machinery from Section A and added Regulation (EU) 2023/1230 on machinery to Section B as point 21; for AI systems classified as high-risk under Article 6(1) in relation to products covered by Section B, Article 2(2), as replaced by that Regulation, provides that only Article 6(1), Article 60a and Articles 102 to 112 apply, with Articles 57, 58 and 59 applying only in so far as the requirements for high-risk AI systems have been integrated into that legislation. Under Article 6(2), the AI systems referred to in Annex III are additionally considered high-risk; each Annex III entry is itself worded around purpose — "AI systems intended to be used" for the listed functions. Classification under both routes therefore attaches to the declared intended purpose under Article 3(12) before any observation of how the system performs in operation. Under Article 113 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, the classification provisions and the requirements and obligations of Chapter III, Sections 1 to 3 attached to both routes apply later than the Regulation's general application date of 2 August 2026: from 2 December 2027 for AI systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for AI systems classified as high-risk under Article 6(1) and Annex I. Article 6(5), on the Commission's classification guidelines, is excepted from that deferral.

Question 4

When is an Annex III system not considered high-risk under Article 6(3)?

Accepted Answer

By derogation, Article 6(3) provides that an Annex III AI system is not considered high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making — provided at least one of four listed conditions is fulfilled, and never where the system performs profiling of natural persons. The derogation applies where any of the following conditions is fulfilled: (a) the AI system is intended to perform a narrow procedural task; (b) the AI system is intended to improve the result of a previously completed human activity; (c) the AI system is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review; or (d) the AI system is intended to perform a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III. Each of the four conditions is phrased on what the system is intended to do. The derogation carries an absolute limit: notwithstanding those conditions, an Annex III AI system shall always be considered high-risk where it performs profiling of natural persons. Article 6(6) empowers the Commission to adopt delegated acts adding new conditions to those listed or modifying them, Article 6(7) provides for delegated acts deleting any of the conditions, and Article 6(8) provides that such amendments shall not decrease the overall level of protection of health, safety and fundamental rights.

Question 5

What must a provider document when it concludes an Annex III system is not high-risk?

Accepted Answer

Under Article 6(4), a provider who considers that an Annex III AI system is not high-risk shall document its assessment before the system is placed on the market or put into service, is subject to the registration obligation in Article 49(2), and shall provide the documentation of the assessment upon request of national competent authorities. Article 49(2) requires that, before placing on the market or putting into service an AI system for which the provider has concluded that it is not high-risk according to Article 6(3), the provider or, where applicable, the authorised representative shall register themselves and that system in the EU database referred to in Article 71. The provider's Article 6(3) assessment is therefore itself a documented, registrable and inspectable act under the Regulation. Article 6(5) directed the Commission, after consulting the European Artificial Intelligence Board and no later than 2 February 2026, to provide guidelines specifying the practical implementation of Article 6 in line with Article 96, together with a comprehensive list of practical examples of use cases of AI systems that are high-risk and not high-risk.

Question 6

What is "reasonably foreseeable misuse", and where does the AI Act attach it?

Accepted Answer

Article 3(13) defines 'reasonably foreseeable misuse' as "the use of an AI system in a way that is not in accordance with its intended purpose, but which may result from reasonably foreseeable human behaviour or interaction with other systems, including other AI systems". The concept binds in the risk management system under Article 9(2)(b) and in the instructions for use under Article 13(3)(b)(iii). The two concepts are defined as complements: the intended purpose (Article 3(12)) fixes the declared use, while reasonably foreseeable misuse covers departures from it that stem from foreseeable human behaviour or from interaction with other systems. Article 9(2)(b) requires the risk management system for a high-risk AI system to comprise "the estimation and evaluation of the risks that may emerge when the high-risk AI system is used in accordance with its intended purpose, and under conditions of reasonably foreseeable misuse". Article 13(3)(b)(iii) requires the instructions for use to state any known or foreseeable circumstance, related to the use of the high-risk AI system in accordance with its intended purpose or under conditions of reasonably foreseeable misuse, which may lead to risks to the health and safety or fundamental rights referred to in Article 9(2). Reasonably foreseeable misuse therefore carries forward into both the provider's risk analysis and the information handed to deployers.

Question 7

Which AI practices does Article 5 prohibit?

Accepted Answer

Article 5(1) prohibits the AI practices listed in its points (a) to (h), several of them subject to exceptions set out in the Article. As part of Chapter II, these prohibitions have applied since 2 February 2025 under Article 113 of Regulation (EU) 2024/1689, except points (ba) and (bb), inserted in Article 5(1) by Regulation (EU) 2026/1744, which apply from 2 December 2026. Article 5(1) prohibits the placing on the market, putting into service or use of: (a) AI systems deploying subliminal, purposefully manipulative or deceptive techniques that materially distort behaviour and cause, or are reasonably likely to cause, significant harm; (b) AI systems exploiting vulnerabilities due to age, disability or a specific social or economic situation, with the same distortion and significant-harm elements; (c) AI systems for social scoring of persons based on social behaviour or personal characteristics where the score leads to detrimental treatment in unrelated contexts or treatment unjustified or disproportionate to the behaviour; (d) AI systems predicting the risk of criminal offending based solely on profiling or personality traits and characteristics, except in support of human assessments based on objective and verifiable facts directly linked to a criminal activity; (e) AI systems creating or expanding facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage; (f) AI systems inferring emotions in the workplace and education institutions, except for medical or safety reasons; (g) biometric categorisation systems deducing or inferring race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation, a prohibition that does not cover any labelling or filtering of lawfully acquired biometric datasets, such as images, based on biometric data or categorising of biometric data in the area of law enforcement; and (h) real-time remote biometric identification in publicly accessible spaces for law enforcement, unless strictly necessary for one of three enumerated objectives and subject to the safeguards in Article 5(2)–(7). Regulation (EU) 2026/1744 — the Digital Omnibus on AI, displayed in the final chunk of this page — amends Article 5: it inserts new points (ba) and (bb) in Article 5(1) and new paragraphs 5(1a) and 5(1b), which apply from 2 December 2026.

Question 8

What does the NIST AI RMF MAP function require in full?

Accepted Answer

NIST AI 100-1 organises the MAP function into five categories, MAP 1 through MAP 5, set out in Table 2 (§5.2, pp. 26–28), running from establishing context to characterising impacts. The framework is described as voluntary, rights-preserving, non-sector-specific and use-case agnostic. MAP 1 — "Context is established and understood" — spans six subcategories: intended purposes and prospective deployment settings (MAP 1.1); interdisciplinary AI actors, competencies and demographic diversity (MAP 1.2); the organization's mission and relevant goals for AI technology (MAP 1.3); business value or context of business use (MAP 1.4); organizational risk tolerances (MAP 1.5); and system requirements elicited from relevant AI actors (MAP 1.6). MAP 2 — "Categorization of the AI system is performed" — covers defining the specific tasks and methods (MAP 2.1), documenting knowledge limits and how output is utilized and overseen by humans (MAP 2.2), and scientific integrity and TEVV considerations (MAP 2.3). MAP 3 states that AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood, including targeted application scope (MAP 3.3) and processes for human oversight (MAP 3.5). MAP 4 maps risks and benefits for all components of the AI system, including third-party software and data. MAP 5 characterises impacts to individuals, groups, communities, organizations, and society. NIST states that outcomes in the MAP function are the basis for the MEASURE and MANAGE functions, and that practices related to mapping AI risks are described in the NIST AI RMF Playbook, an online companion resource that is part of the NIST Trustworthy and Responsible AI Resource Center and offers suggested tactical actions.

Question 9

When must an AI system's classification be revisited?

Accepted Answer

The purpose definition and the classification that follows from it are not fixed once for all: under Article 25(1), any distributor, importer, deployer or other third party is considered to be the provider of a high-risk AI system — and assumes the provider's obligations under Article 16 — where it rebrands the system, substantially modifies it, or modifies the intended purpose of a non-high-risk system so that it becomes high-risk. Article 25(1) names three circumstances: (a) putting one's name or trademark on a high-risk AI system already placed on the market or put into service, without prejudice to contractual arrangements allocating obligations otherwise; (b) making a substantial modification to a high-risk AI system already placed on the market or put into service in such a way that it remains high-risk pursuant to Article 6; and (c) modifying the intended purpose of an AI system, including a general-purpose AI system, which has not been classified as high-risk and is already on the market or in service, in such a way that it becomes a high-risk AI system in accordance with Article 6. Article 3(23) defines a substantial modification as a change not foreseen or planned in the initial conformity assessment that affects compliance with the Chapter III, Section 2 requirements or results in a modification to the intended purpose for which the system was assessed. Where Article 25(1) applies, Article 25(2), as replaced by Regulation (EU) 2026/1744, provides that the initial provider is no longer considered the provider of that specific system, and shall closely cooperate with new providers, make available the necessary information and provide the reasonably expected technical access and other assistance required for the fulfilment of the Regulation's obligations, in particular with regard to compliance with the conformity assessment of high-risk AI systems — unless it clearly specified that its AI system is not to be changed into a high-risk AI system.

Question 10

What applicability timeline governs this stage?

Accepted Answer

Under Article 113 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, the Regulation — published in the Official Journal on 12 July 2024 and in force since 1 August 2024 — applies generally from 2 August 2026, with Chapters I and II applying since 2 February 2025 (except the Article 5 provisions inserted by Regulation (EU) 2026/1744, which apply from 2 December 2026), Chapter III Section 4, Chapters V, VII and XII (except Article 101) and Article 78 applying since 2 August 2025, Articles 102 to 110 applying since 27 July 2026, and Chapter III, Sections 1 to 3 — the high-risk classification rules, requirements and obligations, except Article 6(5) — applying from 2 December 2027 or 2 August 2028 according to the classification route. Article 113 sets entry into force on the twentieth day following publication in the Official Journal of the European Union — publication occurred on 12 July 2024 — and general application from 2 August 2026, subject to stated exceptions. Chapters I and II, which include the Article 5 prohibitions, have applied since 2 February 2025, except the points (ba) and (bb) of Article 5(1) and Article 5(1a) and (1b), inserted by Regulation (EU) 2026/1744, which apply from 2 December 2026 under point (a) of the third paragraph of Article 113, as replaced by that Regulation. Chapter III, Section 4, Chapter V (general-purpose AI models), Chapter VII, Chapter XII with the exception of Article 101, and Article 78 have applied since 2 August 2025. As amended by Regulation (EU) 2026/1744, Chapter III, Sections 1, 2 and 3 (Articles 6 to 27), with the exception of Article 6(5), apply from 2 December 2027 for AI systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for AI systems classified as high-risk under Article 6(1) and Annex I. The second paragraph of Article 113 was not amended, so the general application date of 2 August 2026 stands for the provisions outside that deferral — among them Chapter III, Section 5 (Articles 40 to 49, on standards, conformity assessment and registration), Article 50 on transparency, and Chapter IX on post-market monitoring, information sharing and market surveillance, other than Article 78. Articles 102 to 110 apply from 27 July 2026.

Question 11

What does the Digital Omnibus on AI change for this stage?

Accepted Answer

The Digital Omnibus on AI is Regulation (EU) 2026/1744, published in the Official Journal (OJ L, 2026/1744) on 24 July 2026 and in force from 27 July 2026. It amends Regulation (EU) 2024/1689, including Article 113: Chapter III, Sections 1, 2 and 3 (Articles 6 to 27), with the exception of Article 6(5), apply from 2 December 2027 for AI systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for those classified as high-risk under Article 6(1) and Annex I. Regulation (EU) 2026/1744 of the European Parliament and of the Council was published in the Official Journal of the European Union on 24 July 2026 (OJ L, 2026/1744) and is in force from 27 July 2026. It came through procedure 2025/0359(COD), titled "Simplification of the implementation of harmonised rules on artificial intelligence – Digital Omnibus on AI (Omnibus VII)": Commission proposal COM(2025) 836 of 19 November 2025; committee report A10-0073/2026 tabled 19 March 2026; Parliament adoption 16 June 2026 (T10-0198/2026); Council adoption 29 June 2026; signature of the final act 8 July 2026. Among the provisions it amends is Article 113 of Regulation (EU) 2024/1689: Chapter III, Sections 1, 2 and 3 (Articles 6 to 27), with the exception of Article 6(5), apply from 2 December 2027 for AI systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for AI systems classified as high-risk under Article 6(1) and Annex I. The second paragraph of Article 113 was not amended: the Regulation's general application date of 2 August 2026 is unchanged, and the provisions outside the deferral — including Chapter III, Section 5, Article 50 and Chapter IX other than Article 78 — keep it. The amending Regulation also adds a point (d) to the third paragraph of Article 113, under which Articles 102 to 110 apply from 27 July 2026, and inserts new points (ba) and (bb) in Article 5(1) and new paragraphs 5(1a) and 5(1b), which apply from 2 December 2026. It also amends the definition of 'safety component' in Article 3(14), inserts Article 6(1a) to (1c) on safety components and on the third-party conformity assessment condition in Article 6(1), point (b), deletes Directive 2006/42/EC on machinery from Section A of Annex I and adds Regulation (EU) 2023/1230 on machinery to Section B.

Annex III point	Area	Coverage as enumerated in Annex III
1	Biometrics	Remote biometric identification (excluding biometric verification whose sole purpose is confirming a claimed identity); biometric categorisation according to sensitive or protected attributes or characteristics based on the inference of those attributes or characteristics; emotion recognition
2	Critical infrastructure	Safety components in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity
3	Education and vocational training	Determining access, admission or assignment to institutions; evaluating learning outcomes; assessing the appropriate level of education; monitoring and detecting prohibited behaviour of students during tests
4	Employment, workers' management and access to self-employment	Recruitment or selection, including targeted job advertisements, application filtering and candidate evaluation; decisions on terms, promotion or termination of work relationships; task allocation based on behaviour or traits; monitoring and evaluating performance and behaviour
5	Access to and enjoyment of essential private services and essential public services and benefits	Evaluating, by or on behalf of public authorities, the eligibility of natural persons for essential public assistance benefits and services, including healthcare services, and granting, reducing, revoking or reclaiming them; evaluating the creditworthiness of natural persons or establishing their credit score (except financial-fraud detection); risk assessment and pricing in relation to natural persons in life and health insurance; evaluating and classifying emergency calls by natural persons and dispatching, or establishing priority in the dispatching of, emergency first response services, including emergency healthcare patient triage
6	Law enforcement	Assessing the risk of a person becoming a victim of criminal offences; polygraphs and similar tools; evaluating the reliability of evidence; assessing offending or re-offending risk not based solely on profiling, or assessing personality traits and characteristics or past criminal behaviour; profiling in the detection, investigation or prosecution of criminal offences
7	Migration, asylum and border control management	Polygraphs and similar tools; assessing security, irregular-migration or health risks posed by persons who intend to enter or have entered a Member State; examining applications for asylum, visa or residence permits; detecting, recognising or identifying persons (except travel-document verification)
8	Administration of justice and democratic processes	Assisting judicial authorities in researching and interpreting facts and the law and applying the law to facts, including in alternative dispute resolution; influencing the outcome of an election or referendum or the voting behaviour of natural persons in the exercise of their vote in elections or referenda (excluding AI systems to whose output natural persons are not directly exposed, such as tools used to organise, optimise or structure political campaigns from an administrative or logistical point of view)

Explore 1BusinessWorld

Welcome to 1BusinessWorld

Problem Framing & Intended Purpose