Who this applies to
This obligation applies to providers (including developers) and deployers of high-risk AI systems as defined under Article 6(1), as well as importers and distributors per Article 2(2). Relevant sectors include AI systems used in critical infrastructure, education, employment, essential private/public services, law enforcement, migration, and justice (Annex III).What is required
- Risk management system: Establish, implement, and document a continuous risk management process per Article 9(1).
- Data governance: Ensure training, validation, and testing datasets meet quality criteria (relevance, representativeness, bias mitigation) under Article 10(1-5).
- Technical documentation: Compile and maintain documentation demonstrating compliance with Article 11(1), including design, development, and performance metrics.
- Record-keeping: Maintain logs automatically generated by the high-risk AI system per Article 12(1), covering at minimum the period defined in Article 12(2).
- Transparency obligations: Provide clear, accessible information to users per Article 13(1-3), including system capabilities/limitations and human oversight requirements.
- Human oversight: Design systems to enable effective human monitoring per Article 14(1-4), including technical measures for intervention.
- Accuracy, robustness, and cybersecurity: Ensure resilience against attacks and malfunctions per Article 15(1-3), including adversarial testing where applicable.
- Conformity assessment: Undergo third-party assessment (for most high-risk systems) or self-assessment (limited exceptions) per Article 43(1-3).
Key deadlines
The primary deadline for this obligation is August 2, 2026.Enforcement patterns
AI Act enforcement begins August 2, 2026. No precedent currently exists. This page will be updated as enforcement cases emerge.(Cross-border considerations section intentionally omitted due to lack of jurisdiction-specific implementation data in the provided context.)