Why this object hangs off that object

Reopen classification when intended purpose, use context or system functionality changes materially.

Editorially reviewed | control, high-risk

Repeat the data quality assessment before every retraining or dataset change.

Editorially reviewed | control, high-risk-requirements

Update the file before every release and retain earlier versions traceably.

Editorially reviewed | control, high-risk-requirements

Periodically verify that logging works, is complete and is retained according to the regime.

Editorially reviewed | control, high-risk-requirements

At every deployment and update, verify instructions are present, current and internally translated.

Editorially reviewed | control, high-risk-requirements

Before go-live, test that intervening, stopping and disregarding output actually works and is assigned.

Editorially reviewed | control, high-risk-requirements

Monitor whether the system stays within declared levels in production and escalate on deviation.

Editorially reviewed | control, high-risk-requirements

Periodically audit whether practice follows the described system and record deviations and improvements.

Editorially reviewed | control, high-risk-requirements

Check when systems, roles or risks change whether the selected measures remain appropriate.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy, control

Repeat the screening for every new system, procurement and material change of purpose or context; an earlier clearance does not cover a new use.

Hangs off: Article 5: prohibited practices

Editorially reviewed | control, prohibited-practices

Before release, test that the applicable disclosure, marking or label is timely, clear and technically effective.

Editorially reviewed | control, transparency

Monitor cumulative training compute and notify the Commission when the threshold is reached.

Hangs off: Article 55: GPAI models with systemic risk

Editorially reviewed | control, gpai-systemic-risk

The control that periodically rechecks a reliance on a code of practice: does the version you rely on still stand, has the code been reviewed or adapted under paragraph 8, has the Commission published its assessment of adequacy under paragraph 6 as replaced by Regulation (EU) 2026/1744, and has the Commission laid down common rules under paragraph 9.

Hangs off: Article 56: codes of practice for general-purpose AI models

Editorially reviewed | control, governance, gpai, gpai-systemic-risk

Ensure real-world signals (deviations, complaints, incidents) demonstrably lead to analysis and, where needed, measures.

Editorially reviewed | control, post-market

Periodically test whether an incident can be reported within the legal deadlines, including the deployer-to-provider chain.

Editorially reviewed | control, post-market

The control that sends a submission touching source code, training methodology or trade secrets through a fixed review: is the request reasoned, what purpose was stated, which part is strictly necessary, and who inside the organisation signs off on it.

Hangs off: Article 78: confidentiality of what you submit to an authority

Editorially reviewed | control, enforcement, governance

Reopen the risk management process on changes in purpose, data, model or use context and before every release.

Editorially reviewed | control, high-risk-requirements

Rerun the conformity route whenever the system is substantially modified.

Editorially reviewed | conformity, control

Block deployment until applicability, assessment, mitigation and notification have been completed.

Editorially reviewed | control, fundamental-rights

Update documentation and downstream information when the model, capabilities or risks change.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | control, gpai

The control that ensures the representative can actually reach the documentation, that the verification under paragraph 3(a) is repeated at a fixed moment, and that there is an agreed route for the termination under paragraph 5 with the immediate notification to the AI Office. Without such a moment a mandate stays on paper while nobody tests it.

Hangs off: Article 54: authorised representative of a provider of a GPAI model

Editorially reviewed | control, gpai

The control that absorbs the loss of a notified body: a fixed periodic check of the public list, a contractual reporting duty mirroring the ten days of Article 36(5), a named alternative body for your type of system, and a handover procedure that stays within the nine months of Article 36(3) and (9).

Hangs off: Articles 28 to 39: notifying authorities and notified bodies

Editorially reviewed | conformity, control, governance

The control that ensures the signal from the training pipeline reaches an identifiable owner and that the notification goes out within two weeks. Its trigger point is the allocation of compute and not the end of the run, because recital 111 also counts pre-training, synthetic data and fine-tuning and recital 112 assumes the provider knows the outcome before then. It sits alongside the monitoring of compute itself: that measures the threshold, this guards the clock that starts afterwards.

Hangs off: Article 52: notification of a GPAI model with systemic risk

Editorially reviewed | gpai-systemic-risk

Repeat the role assessment on every rebranding, modification or new use of an existing system.

Editorially reviewed | control, value-chain