System requirements and provider duties
Articles 9 to 15 require a risk management system, governance of training data, validation and testing, technical documentation, automatic logging of events, clear instructions for use, effective human oversight and appropriate levels of accuracy, robustness and cybersecurity.
In addition, the provider implements a quality management system (Article 17), submits the system to conformity assessment (Article 43), registers it in the EU database where applicable (Article 49), carries out post-market monitoring (Article 72) and reports serious incidents no later than fifteen days after becoming aware of them (Article 73(2)).
After the Omnibus, SMEs and small mid-cap enterprises may submit the technical documentation using a simplified Commission form (Article 11(1)), and the quality management system applies in proportion to the size of the provider (Article 17(2)).
What the deployer does
Article 26 requires the deployer to use the system in accordance with its instructions, assign human oversight to people with the necessary competence, training and authority, ensure that the input data it controls is relevant, monitor operation and suspend use if it identifies a risk, and keep the logs the system generates for at least six months.
If the system is used at work, the employer informs workers' representatives and the affected workers beforehand (Article 26(7)). If it is used to make or assist decisions about people in an Annex III area, it informs those people (Article 26(11)).
Fundamental rights impact assessment
Article 27 requires one before deployment from public bodies, private entities providing public services, and those using systems for creditworthiness assessment or pricing in life and health insurance (Annex III, point 5, points (b) and (c)).
The Omnibus allows deployers to refer to or incorporate the relevant parts of the data protection impact assessment under Article 35 of the GDPR, and tasks the AI Office with a template questionnaire to simplify it (Article 27(4) and 27(5)).
From when
These obligations apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems (Article 113, point (c)). High-risk systems already on the market before that date are only caught if their design subsequently changes significantly; those intended for public authorities must comply by 2 August 2030 at the latest (Article 111(2)).
What an auditor usually asks for
- Provider's instructions for use received and filed
- People designated for human oversight, with training and authority to intervene
- System logs kept for a minimum of six months
- Workers' representatives informed before the system is used at work
- Fundamental rights impact assessment carried out where Article 27 requires it
How to tackle it in practice
- 1Ask the provider for the system's instructions for use and declaration of conformity, and keep them with the contract.
- 2Appoint the person who oversees each high-risk system and set down in writing what they can do when they are not convinced by the output.
- 3Build log retention and notice to staff into the data protection procedures you already have.
The data protection impact assessment and the fundamental rights assessment share much of the same analysis: it makes sense to do them together.
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) EUR-Lex · OJ L 2024/1689 · 12 July 2024
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Regulation (EU) 2024/1689 EUR-Lex · OJ L 2026/1744 · 24 July 2026
- Regulation (EU) 2024/1689, consolidated text EUR-Lex · CELEX 02024R1689-20260727 · Version of 27 July 2026
- Regulation (EU) 2016/679, General Data Protection Regulation EUR-Lex · Applicable since 25 May 2018