AI Act Obligations Checker

A provider of a high-risk AI system carries the fullest set of duties in the Act. These include a risk management system (Article 9), data and data governance (Article 10), technical documentation per Annex IV (Article 11), record-keeping and automatic logging (Article 12), transparency and instructions for use (Article 13), human oversight by design (Article 14), accuracy, robustness and cybersecurity (Article 15), a quality management system (Article 17), a conformity assessment before market placement (Article 43), an EU declaration of conformity and CE marking (Articles 47-48), registration in the EU database (Article 49), and post-market monitoring with serious-incident reporting (Articles 72-73). A non-EU provider must also appoint an EU authorised representative (Article 22).

A deployer uses a high-risk AI system under its own authority and has lighter but real duties under Article 26: use the system in line with the provider's instructions, assign human oversight to competent and trained people, make sure input data it controls is relevant and representative, monitor operation and suspend use if risks arise, keep the system's logs for at least six months, inform affected workers and their representatives before workplace deployment, and inform people subject to high-risk decisions. Public bodies, and deployers using the system for credit scoring or insurance pricing, must also carry out a Fundamental Rights Impact Assessment (Article 27).

A FRIA is an assessment that certain deployers of high-risk AI must complete before putting the system into use, under Article 27. It applies to deployers that are public bodies or public-service providers, and to systems used for credit scoring or for life and health insurance risk assessment and pricing. It is a deployer duty, not a provider duty, though providers can help by giving clear instructions for use.

Under Article 53, every GPAI model provider must keep technical documentation of the model, give downstream providers the information they need to integrate it, put in place a policy to comply with EU copyright law (including text-and-data-mining opt-outs), and publish a summary of the content used for training. If the model crosses the systemic-risk threshold (training compute above 10^25 FLOP), Article 55 adds model evaluation and adversarial testing, systemic-risk assessment and mitigation, serious-incident reporting to the AI Office, and adequate cybersecurity. The GPAI Code of Practice is the main tool for showing compliance. These rules have applied since 2 August 2025.