Why this object hangs off that object

Assess Article 5, Article 6 and Annex III in that order and document purpose, context and any Article 6(3) exception.

Hangs off: Annex III: high-risk AI

Editorially reviewed | high-risk

Determine whether you are the provider of the model, appoint an authorised representative established in the Union by written mandate before placing the model on the market, and write out in that mandate the four tasks in paragraph 3, the access to the Annex XI documentation and the point of contact under paragraph 4.

Hangs off: Article 54: authorised representative of a provider of a GPAI model

Editorially reviewed | gpai, value-chain

Assess origin, representativeness, errors and completeness and examine possible bias with appropriate mitigation.

Hangs off: Article 10: data and data governance

Editorially reviewed | high-risk-requirements

Document system description, development process, data, oversight measures, performance and risk management before market placement.

Hangs off: Article 11: technical documentation

Editorially reviewed | high-risk-requirements

Ensure the system automatically records events relevant to risk identification and post-market monitoring.

Hangs off: Article 12: logging and traceability

Editorially reviewed | high-risk-requirements

Describe capabilities, limitations, accuracy, oversight measures and expected lifetime in comprehensible form.

Hangs off: Article 13: transparency towards deployers

Editorially reviewed | high-risk-requirements

Determine oversight measures per system, appoint competent persons and give them the mandate to intervene or stop.

Hangs off: Article 14: human oversight

Editorially reviewed | high-risk-requirements

Determine appropriate accuracy, test robustness against errors and misuse, and take AI-specific security measures.

Hangs off: Article 15: accuracy, robustness and cybersecurity

Editorially reviewed | high-risk-requirements

Describe strategies, procedures and responsibilities for compliance, from design and data to post-market monitoring.

Hangs off: Article 17: quality management system

Editorially reviewed | high-risk-requirements

Determine for each role, system and context which combination of instruction, guidance, practice or training is appropriate.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

Before procurement, build or deployment, check whether the use case falls under a prohibited practice and stop or redesign early rather than after the fact.

Hangs off: Article 5: prohibited practices

Editorially reviewed | prohibited-practices

First determine which paragraph of Article 50 applies, then implement the specific transparency measure.

Editorially reviewed | transparency

Evaluate the model including adversarial testing, assess and mitigate systemic risks, report serious incidents and secure the model.

Hangs off: Article 55: GPAI models with systemic risk

Editorially reviewed | gpai-systemic-risk

Systematically collect and analyse real-world data on the system’s performance and compliance throughout its lifetime.

Hangs off: Article 72: post-market monitoring

Editorially reviewed | post-market

Define what a serious incident is, assign the reporting route to the supervisor and rehearse the process.

Hangs off: Article 73: serious incident reporting

Editorially reviewed | post-market

Establish, per high-risk system, what currently counts as the generally acknowledged state of the art and against which intended purpose the requirements of Section 2 have been met, with a fixed re-assessment moment and with the location in the risk management file of Article 9.

Hangs off: Article 8: compliance with the requirements for high-risk AI systems

Editorially reviewed | conformity, high-risk-requirements

Identify and analyse known and reasonably foreseeable risks, evaluate them and take measures, repeating the cycle on every change.

Hangs off: Article 9: risk management system

Editorially reviewed | high-risk-requirements

Describe, per AI component inside a product under Annex I, Section A, which function it performs, whether that is a safety function, what happens on failure or malfunctioning, and whether the mandatory third-party conformity assessment rests on health and safety risks or only on other risks. A recommended practice, not a legal duty.

Hangs off: Article 6(1a) to (1c): the tightened classification route

Editorially reviewed | conformity, high-risk

Fix a moment in your change and release process at which someone assesses and records whether an intended change to a legacy high-risk system is a significant change in its design, before the change goes into production.

Hangs off: Article 111(2): legacy high-risk systems and the 2 August 2030 date

Editorially reviewed | high-risk, timeline

Select the correct assessment procedure, draw up the EU declaration of conformity, affix the CE marking and register in the EU database.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Editorially reviewed | conformity

Determine per general-purpose AI model whether you adhere to a code of practice, to which version and which chapter, whether under paragraph 7 the obligations in Article 53 suffice for you, and which elaboration of your own you apply for the issues in paragraph 2 where you do not join.

Hangs off: Article 56: codes of practice for general-purpose AI models

Editorially reviewed | governance, gpai, gpai-systemic-risk

Compile per system the data listed in Sections A and B of Annex VIII, or Section C where you are a public deployer, designate the natural person with the legal authority to register, and make sure the entry stays correct when the status, the Member States or the declaration of conformity change. Section C can only be completed after the provider has entered Section A, because point 3 asks for the URL of that entry.

Hangs off: Article 71: EU database for high-risk AI systems listed in Annex III

Editorially reviewed | conformity

Determine per product which Annex I legal act it falls under and whether that is Section A or Section B, which conformity assessment procedure applies there, which AI functions are safety components and who is thereby the provider.

Hangs off: Article 6(1): the product route to high risk

Editorially reviewed | conformity, high-risk

Assess process, duration, affected persons, risks, oversight, mitigation and complaint mechanisms and notify results where required.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights, high-risk

Maintain technical documentation, information for downstream providers, a copyright policy and a public summary of training content.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | gpai

Bring the five components of Article 18(1) together per high-risk system in an identifiable place, record both the date of placing on the market and the date of putting into service, calculate the end date from the later moment, and assign the upkeep to a role rather than to a person.

Hangs off: Article 18: documentation keeping

Editorially reviewed | high-risk-requirements

Determine per AI system which of the eight areas and which lettered subpoint the intended purpose touches, or establish with reasons that no point applies. Then run the Article 6(3) test and record the outcome as Article 6(4) requires. Do so at the level of the intended purpose and not at the level of the department or the sector.

Hangs off: Annex III: the eight areas separately

Editorially reviewed | high-risk

State on every submission which part is confidential business information, trade secret or source code, keep track of what was handed to whom on what date, and on a further request ask about the necessity and the purpose within the meaning of Article 78(2).

Hangs off: Article 78: confidentiality of what you submit to an authority

Editorially reviewed | enforcement, governance

Notify the model as soon as it meets the condition in Article 51(1), point (a), or as soon as it becomes known that it will, with the information necessary to demonstrate that the requirement has been met, and with any substantiation that the model does not present systemic risks after all.

Hangs off: Article 52: notification of a GPAI model with systemic risk

Editorially reviewed | gpai-systemic-risk

Determine which high-risk systems are intended to be used by public authorities and were already running before the cut off date for their route, and count back from the conformity assessment and the registration to a plan that finishes before 2 August 2030.

Hangs off: Article 111(2): legacy high-risk systems and the 2 August 2030 date

Editorially reviewed | high-risk, timeline

Only for those who themselves decide to process special categories of personal data for bias testing. In that case record which paragraph of Article 4a you rely on and whether that paragraph is open to your role, why other data do not suffice, which safeguards apply, who has access and when the data are deleted. Replace old references to Article 10(5) while you are there.

Hangs off: Article 4a: legal basis for bias testing with special categories of personal data

Editorially reviewed | fundamental-rights, high-risk-requirements

If your model has been designated under Article 52(4), you may request reassessment by reasoned request. The request must contain objective, detailed and new reasons that have arisen since the designation decision, and may be made at the earliest six months after that decision; where the designation is maintained, a further six months apply.

Hangs off: Article 52: notification of a GPAI model with systemic risk

Editorially reviewed | gpai-systemic-risk

On white-labelling, substantial modification or purpose change, assess whether your organisation becomes the provider, and arrange the representative for non-EU supply.

Hangs off: Articles 22-25: value chain and authorised representative

Editorially reviewed | value-chain

At the moment of choice and periodically thereafter, verify whether the body appears in the Commission public list, for which activities and system types it is notified, whether its designation has been restricted or suspended, and whether the independence of Article 31(4) and (5) holds; also ask which tasks are subcontracted and give your agreement under Article 33(3) in writing.

Hangs off: Articles 28 to 39: notifying authorities and notified bodies

Editorially reviewed | conformity, governance

The Commission office that supervises providers of general-purpose AI models. AI Office enforcement is active since 2 August 2026.

Editorially reviewed | enforcement, governance, gpai

A deployer of the relevant creditworthiness or life and health insurance systems in Annex III point 5(b) or 5(c).

Editorially reviewed | fundamental-rights, high-risk

An organisation using an AI system under its authority, excluding personal non-professional use.

Editorially reviewed | governance

A party that places a general-purpose AI model on the Union market.

Editorially reviewed | gpai

The national authority that supervises compliance with the Regulation and receives serious incident and risk notifications. Which body fills this role per Member State is not recorded in the graph.

Editorially reviewed | enforcement, governance

A party that develops or has an AI system developed and places it on the market under its own name.

Editorially reviewed | governance

A deployer that is a body governed by public law.

Editorially reviewed | fundamental-rights

A private deployer providing public services.

Editorially reviewed | fundamental-rights

The regulation entered into force on 1 August 2024, after which the obligations followed in phases.

Hangs off: Article 4: AI literacy, Article 5: prohibited practices

Placed against the official source | timeline

Since 2 February 2025 the Article 5 prohibition and the Article 4 AI literacy duty apply.

Hangs off: Article 4: AI literacy, Article 5: prohibited practices

Placed against the official source | ai-literacy, timeline

The voluntary code of practice gives GPAI model providers a route to demonstrate compliance.

Hangs off: Article 53: GPAI model providers

Placed against the official source | gpai

The Commission explains when someone becomes the provider of a GPAI model, including through fine-tuning.

Hangs off: Article 53: GPAI model providers, Article 55: GPAI models with systemic risk

Placed against the official source | gpai

The Commission draws the line between software that does and does not fall under the regulation.

Hangs off: Annex III: high-risk AI, Article 4: AI literacy

Placed against the official source | scope

Worked examples for each Article 5 prohibition, with the line between permitted and prohibited.

Hangs off: Article 5: prohibited practices

Placed against the official source | prohibited

Since 2 August 2025 the obligations for providers of general-purpose AI models apply.

Hangs off: Article 53: GPAI model providers, Article 55: GPAI models with systemic risk

Placed against the official source | gpai, timeline

The Commission explains in consultation when a system falls under Annex I or Annex III.

Hangs off: Annex III: high-risk AI, Articles 43-49: conformity assessment, CE and registration

Placed against the official source | high-risk

A voluntary route to comply with parts of Article 50, in two separately signable sections.

Placed against the official source | transparency

EN 18286:2026 on the quality management system is the first completed standard under the standardisation request.

Hangs off: Article 17: quality management system

Placed against the official source | standards

The Commission works out the transparency duties and confirms they apply from 2 August 2026.

Placed against the official source | transparency

The amended application date has been binding law since 27 July 2026.

Hangs off: Annex III: high-risk AI

Placed against the official source | high-risk

Since 27 July 2026 the application of the requirements or obligations in Articles 9 to 15 and 17 to 25 may be limited for high-risk systems referred to in Article 6(1) where the Annex I Section A harmonisation legislation provides an equivalent or higher level of protection. That limitation exists only once a delegated act is adopted, which must happen by 2 August 2027. Until then the requirements apply in full.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Placed against the official source | conformity, high-risk

Since 27 July 2026 the organisational duty supports the development of AI literacy without guaranteeing an individual level.

Hangs off: Article 4: AI literacy

Placed against the official source | ai-literacy

Since 27 July 2026 the legal basis for bias detection using special categories of personal data sits as Article 4a in Chapter I and no longer as Article 10(5) in Chapter III. The circle has widened from providers of high-risk systems alone to providers and deployers of other AI systems and models and deployers of high-risk systems, on the same conditions.

Hangs off: Article 4a: legal basis for bias testing with special categories of personal data

Placed against the official source | fundamental-rights, high-risk-requirements

The FRIA for the relevant Annex III route follows 2 December 2027 and may include or cross-reference relevant DPIA elements.

Hangs off: Article 27: FRIA

Placed against the official source | fundamental-rights, high-risk

Since 27 July 2026 point 1 of Section A of Annex I, the machinery directive, has been deleted and Regulation (EU) 2023/1230 has been added as point 21 to Section B. For AI in machinery the limited regime of the amended Article 2(2) therefore applies: only Article 6(1), Article 60a and Articles 102 to 112.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Placed against the official source | conformity, high-risk, scope

Since 27 July 2026 AI systems solely used for non-safety related aspects of user assistance, performance optimisation, service efficiency, automation or convenience or quality control do not qualify as safety components, unless failure or malfunctioning would endanger health and safety. A product required to undergo a third-party assessment only because of radio spectrum or electromagnetic interference that does not affect health and safety does not fulfil the condition in paragraph 1, point (b).

Hangs off: Articles 43-49: conformity assessment, CE and registration

Placed against the official source | high-risk, scope

The Digital Omnibus prohibits AI for child sexual abuse material and non-consensual intimate imagery.

Hangs off: Article 5: prohibited practices

Placed against the official source | prohibited, timeline

Models placed on the market before 2 August 2025 have until 2 August 2027.

Hangs off: Article 53: GPAI model providers, Article 55: GPAI models with systemic risk

Placed against the official source | gpai, timeline

The first subparagraph of Article 57(1) has been replaced. The date by which each Member State must have at least one AI regulatory sandbox operational moved from 2 August 2026 to 2 August 2027. For a provider that is the day the route to supervised testing actually exists.

Placed against the official source | governance, innovation

Article 72(3) has been replaced. The original text required an implementing act with a template by 2 February 2026, and that deadline had passed without an act. Since 27 July 2026 it is guidance including a template, to be adopted by 2 September 2027. There is therefore no overdue implementing act; anyone waiting for the old template is waiting for something that will not come.

Hangs off: Article 72: post-market monitoring

Placed against the official source | high-risk, post-market

AI as a safety component of products under Annex I follows on 2 August 2028.

Hangs off: Annex III: high-risk AI, Articles 43-49: conformity assessment, CE and registration

Placed against the official source | high-risk, timeline

The control that reruns the route determination as soon as the product, the AI function, the conformity assessment procedure chosen or the list in Annex I changes, instead of standing still after the first market introduction. The move of machinery to Section B on 27 July 2026 shows that the list moves too.

Hangs off: Article 6(1): the product route to high risk

Editorially reviewed | control, high-risk

The control that ensures a change of intended purpose, a new vendor feature, a new use inside the organisation or a delegated act under Article 7 triggers a fresh assessment of the mapping to a point of Annex III, instead of the first record standing for years while the system or the list moves.

Hangs off: Annex III: the eight areas separately

Editorially reviewed | high-risk

Reopen classification when intended purpose, use context or system functionality changes materially.

Hangs off: Annex III: high-risk AI

Editorially reviewed | control, high-risk

Repeat the data quality assessment before every retraining or dataset change.

Hangs off: Article 10: data and data governance

Editorially reviewed | control, high-risk-requirements

Update the file before every release and retain earlier versions traceably.

Hangs off: Article 11: technical documentation

Editorially reviewed | control, high-risk-requirements

Periodically verify that logging works, is complete and is retained according to the regime.

Hangs off: Article 12: logging and traceability

Editorially reviewed | control, high-risk-requirements

At every deployment and update, verify instructions are present, current and internally translated.

Hangs off: Article 13: transparency towards deployers

Editorially reviewed | control, high-risk-requirements

Before go-live, test that intervening, stopping and disregarding output actually works and is assigned.

Hangs off: Article 14: human oversight

Editorially reviewed | control, high-risk-requirements

Monitor whether the system stays within declared levels in production and escalate on deviation.

Hangs off: Article 15: accuracy, robustness and cybersecurity

Editorially reviewed | control, high-risk-requirements

Periodically audit whether practice follows the described system and record deviations and improvements.

Hangs off: Article 17: quality management system

Editorially reviewed | control, high-risk-requirements

The control that keeps the file complete per system, tracks the end date of the period, and ensures the documents can still be opened after a systems migration, a reorganisation or a change of supplier.

Hangs off: Article 18: documentation keeping

Editorially reviewed | control, high-risk-requirements

Check when systems, roles or risks change whether the selected measures remain appropriate.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy, control

Repeat the screening for every new system, procurement and material change of purpose or context; an earlier clearance does not cover a new use.

Hangs off: Article 5: prohibited practices

Editorially reviewed | control, prohibited-practices

Before release, test that the applicable disclosure, marking or label is timely, clear and technically effective.

Editorially reviewed | control, transparency

Monitor cumulative training compute and notify the Commission when the threshold is reached.

Hangs off: Article 55: GPAI models with systemic risk

Editorially reviewed | control, gpai-systemic-risk

The control that periodically rechecks a reliance on a code of practice: does the version you rely on still stand, has the code been reviewed or adapted under paragraph 8, has the Commission published its assessment of adequacy under paragraph 6 as replaced by Regulation (EU) 2026/1744, and has the Commission laid down common rules under paragraph 9.

Hangs off: Article 56: codes of practice for general-purpose AI models

Editorially reviewed | control, governance, gpai, gpai-systemic-risk

Ensure real-world signals (deviations, complaints, incidents) demonstrably lead to analysis and, where needed, measures.

Hangs off: Article 72: post-market monitoring

Editorially reviewed | control, post-market

Periodically test whether an incident can be reported within the legal deadlines, including the deployer-to-provider chain.

Hangs off: Article 73: serious incident reporting

Editorially reviewed | control, post-market

The control that sends a submission touching source code, training methodology or trade secrets through a fixed review: is the request reasoned, what purpose was stated, which part is strictly necessary, and who inside the organisation signs off on it.

Hangs off: Article 78: confidentiality of what you submit to an authority

Editorially reviewed | control, enforcement, governance

The control that ensures, for a system inside a product under Section A of Annex I, that the choice in paragraph 2 was made deliberately and remains visible: a cross-reference per requirement of Section 2 into the existing technical file, or two files with a recorded owner who keeps them in step.

Hangs off: Article 8: compliance with the requirements for high-risk AI systems

Editorially reviewed | conformity, control, high-risk-requirements

Reopen the risk management process on changes in purpose, data, model or use context and before every release.

Hangs off: Article 9: risk management system

Editorially reviewed | control, high-risk-requirements

The control that ensures the special categories stay with authorised people, are not transmitted, transferred or otherwise accessed by other parties, and are actually deleted once the bias has been corrected or the retention period ends, instead of lingering because nobody watches the deadline.

Hangs off: Article 4a: legal basis for bias testing with special categories of personal data

Editorially reviewed | fundamental-rights, high-risk-requirements

Rerun the conformity route whenever the system is substantially modified.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Editorially reviewed | conformity, control

The control that ensures no change to a legacy high-risk system reaches production without a recorded judgement on whether it is significant, with an identifiable assessor and a demonstrable link to the release.

Hangs off: Article 111(2): legacy high-risk systems and the 2 August 2030 date

Editorially reviewed | high-risk, timeline

The control that ensures a change of status, Member States, certificate or declaration of conformity leads to an updated entry within a set period, and that a public deployer notices when the provider does not enter its Section A or enters it late, instead of the public page quietly lagging behind reality.

Hangs off: Article 71: EU database for high-risk AI systems listed in Annex III

Editorially reviewed | conformity, control

Block deployment until applicability, assessment, mitigation and notification have been completed.

Hangs off: Article 27: FRIA

Editorially reviewed | control, fundamental-rights

Update documentation and downstream information when the model, capabilities or risks change.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | control, gpai

The control that ensures the representative can actually reach the documentation, that the verification under paragraph 3(a) is repeated at a fixed moment, and that there is an agreed route for the termination under paragraph 5 with the immediate notification to the AI Office. Without such a moment a mandate stays on paper while nobody tests it.

Hangs off: Article 54: authorised representative of a provider of a GPAI model

Editorially reviewed | control, gpai

The control that absorbs the loss of a notified body: a fixed periodic check of the public list, a contractual reporting duty mirroring the ten days of Article 36(5), a named alternative body for your type of system, and a handover procedure that stays within the nine months of Article 36(3) and (9).

Hangs off: Articles 28 to 39: notifying authorities and notified bodies

Editorially reviewed | conformity, control, governance

The control that ensures the assessment is redone as soon as the intended purpose, the function of the component or the applicable harmonisation legislation changes, so that a system does not stay outside the route on the basis of an outdated description. A recommended practice, not a legal duty.

Hangs off: Article 6(1a) to (1c): the tightened classification route

Editorially reviewed | conformity, high-risk

The control that ensures the signal from the training pipeline reaches an identifiable owner and that the notification goes out within two weeks. Its trigger point is the allocation of compute and not the end of the run, because recital 111 also counts pre-training, synthetic data and fine-tuning and recital 112 assumes the provider knows the outcome before then. It sits alongside the monitoring of compute itself: that measures the threshold, this guards the clock that starts afterwards.

Hangs off: Article 52: notification of a GPAI model with systemic risk

Editorially reviewed | gpai-systemic-risk

Repeat the role assessment on every rebranding, modification or new use of an existing system.

Hangs off: Articles 22-25: value chain and authorised representative

Editorially reviewed | control, value-chain

Annex III, point 1, as that point stands in the Regulation, with its lettered subpoints and the exceptions named in them.

Hangs off: Annex III: the eight areas separately

Placed against the official source | high-risk

Annex III, point 2, as that point stands in the Regulation, with its lettered subpoints and the exceptions named in them.

Hangs off: Annex III: the eight areas separately

Placed against the official source | high-risk

Annex III, point 3, as that point stands in the Regulation, with its lettered subpoints and the exceptions named in them.

Hangs off: Annex III: the eight areas separately

Placed against the official source | high-risk

Annex III, point 4, as that point stands in the Regulation, with its lettered subpoints and the exceptions named in them.

Hangs off: Annex III: the eight areas separately

Placed against the official source | high-risk

Annex III, point 5, as that point stands in the Regulation, with its lettered subpoints and the exceptions named in them.

Hangs off: Annex III: the eight areas separately

Placed against the official source | high-risk

Annex III, point 6, as that point stands in the Regulation, with its lettered subpoints and the exceptions named in them.

Hangs off: Annex III: the eight areas separately

Placed against the official source | high-risk

Annex III, point 7, as that point stands in the Regulation, with its lettered subpoints and the exceptions named in them.

Hangs off: Annex III: the eight areas separately

Placed against the official source | high-risk

Annex III, point 8, as that point stands in the Regulation, with its lettered subpoints and the exceptions named in them.

Hangs off: Annex III: the eight areas separately

Placed against the official source | high-risk

Per product: the Annex I legal act, the section it falls under after 27 July 2026, the conformity assessment procedure chosen and whether a third party is involved, the harmonised standards any opt-out relies on, the AI functions identified as safety components together with the failure analysis, and the role you carry as a result. This is the file that shows why your system is or is not high risk through Article 6(1).

Hangs off: Article 6(1): the product route to high risk

Editorially reviewed | evidence, high-risk

Per system: the intended purpose in your own words, the chosen point and lettered subpoint, the reasoning, the outcome of the Article 6(3) assessment with the condition it rests on, whether the system performs profiling, and for a reasoned no also the documentation and registration required by Article 6(4) and Article 49(2). Plus who assessed it and when. This is the document with which you later explain why the system was out of scope.

Hangs off: Annex III: the eight areas separately

Editorially reviewed | high-risk

Traceable rationale covering intended purpose, Annex III category, Article 6(3) assessment and registration decision.

Hangs off: Annex III: high-risk AI

Editorially reviewed | evidence, high-risk

Record per dataset of origin, choices, assumptions, bias examination and mitigations.

Hangs off: Article 10: data and data governance

Editorially reviewed | evidence, high-risk-requirements

Technical documentation kept current per system version, ready for a supervisor’s request.

Hangs off: Article 11: technical documentation

Editorially reviewed | evidence, high-risk-requirements

Log files with a retention period appropriate to the purpose and at least six months for deployers (Articles 19 and 26).

Hangs off: Article 12: logging and traceability

Editorially reviewed | evidence, high-risk-requirements

The received instructions for use plus their internal translation into work instructions per role.

Hangs off: Article 13: transparency towards deployers

Editorially reviewed | evidence, high-risk-requirements

Record of oversight measures, appointed persons, their training and the moments of intervention.

Hangs off: Article 14: human oversight

Editorially reviewed | evidence, high-risk-requirements

Declared accuracy levels, test results, and measures against data poisoning and adversarial attacks among others.

Hangs off: Article 15: accuracy, robustness and cybersecurity

Editorially reviewed | evidence, high-risk-requirements

The documented quality system with procedures, role assignment and references to the underlying files.

Hangs off: Article 17: quality management system

Editorially reviewed | evidence, high-risk-requirements

Per system: the technical documentation, the quality management system documentation, the changes approved by notified bodies, the decisions and documents they issued, and the EU declaration of conformity, with the date of placing on the market, the date of putting into service and the resulting end date of the retention period.

Hangs off: Article 18: documentation keeping

Editorially reviewed | evidence, high-risk-requirements

Versioned record of roles, context, measures, participation or instruction and review moments.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy, evidence

A record per system that the Article 5 screening was performed, with outcome and reasoning. The conclusion "no prohibited practice" is evidence too.

Hangs off: Article 5: prohibited practices

Editorially reviewed | evidence, prohibited-practices

Record of scenario, actor, disclosure or marking, technical implementation, test and owner.

Editorially reviewed | evidence, transparency

Evaluation results, risk assessments, mitigations, incident reports and security measures per model version.

Hangs off: Article 55: GPAI models with systemic risk

Editorially reviewed | evidence, gpai-systemic-risk

Per model: the decision whether or not to adhere to a code of practice, the version and chapter it relates to, the date and the authorised signatory, whether adherence was limited under paragraph 7 to the obligations in Article 53, and, where the decision is negative, the elaboration of your own for the issues in paragraph 2.

Hangs off: Article 56: codes of practice for general-purpose AI models

Editorially reviewed | evidence, governance, gpai, gpai-systemic-risk

The plan as part of the technical documentation plus the periodic analyses and follow-up actions.

Hangs off: Article 72: post-market monitoring

Editorially reviewed | evidence, post-market

Record of incidents, analyses, reports to supervisors and corrective measures.

Hangs off: Article 73: serious incident reporting

Editorially reviewed | evidence, post-market

Per submission: which system, which document, which version, to which recipient, on what date, which part was marked confidential, and which purpose the recipient stated.

Hangs off: Article 78: confidentiality of what you submit to an authority

Editorially reviewed | enforcement, evidence, governance

Per system and per version: which intended purpose was taken, which standards, specifications, evaluation methods and test sets were treated as the state of the art, which were deliberately not applied and why, who established that, and on what date the record was reviewed again.

Hangs off: Article 8: compliance with the requirements for high-risk AI systems

Editorially reviewed | conformity, evidence, high-risk-requirements

Versioned record of risk analyses, chosen measures, residual risks and test results per system version.

Hangs off: Article 9: risk management system

Editorially reviewed | evidence, high-risk-requirements

Per processing operation: the system or model, the paragraph of Article 4a relied on, the justification why synthetic or anonymised data do not suffice, the technical and organisational safeguards applied, the access list, the confirmation that no other party can reach the data, and the deletion date. This is also the text that paragraph 1, point (f), requires in the record of processing activities.

Hangs off: Article 4a: legal basis for bias testing with special categories of personal data

Editorially reviewed | fundamental-rights, high-risk-requirements

The assessment, EU declaration of conformity, CE marking and registration proof, per system version.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Editorially reviewed | conformity, evidence

Per system: which Annex VIII data was entered, by which natural person with the legal authority to do so, on what date, in which version, when the entry was last checked against reality, and for a public deployer the URL of the entry made by the provider. This is also the file that shows the public entry and your internal documents say the same thing.

Hangs off: Article 71: EU database for high-risk AI systems listed in Annex III

Editorially reviewed | conformity, evidence

Dated impact assessment, measures, residual risks and, where required, notification to the market surveillance authority.

Hangs off: Article 27: FRIA

Editorially reviewed | evidence, fundamental-rights

Current technical documentation, downstream information, copyright policy and public training summary.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | evidence, gpai

The written mandate itself, in an official language of the institutions of the Union, together with the copy of the Annex XI technical documentation, the contact details of the provider, and the record of the verification under paragraph 3(a). The provider grants the mandate and supplies the documentation; the ten year retention after the placing on the market rests under paragraph 3(b) with the representative, which keeps the file at the disposal of the AI Office and national competent authorities.

Hangs off: Article 54: authorised representative of a provider of a GPAI model

Editorially reviewed | evidence, gpai

Per type and model: the date the first unit was placed on the market or put into service, the route and therefore the cut off date, whether it is intended to be used by public authorities, which design changes have been made since that cut off, and per change the judgement whether it was significant with the reasoning and the date. This is the file that shows which track a system was on and why.

Hangs off: Article 111(2): legacy high-risk systems and the 2 August 2030 date

Editorially reviewed | high-risk, timeline

Per body: identification number, Member State of establishment, the conformity assessment activities and system types for which it is notified, the date of each check against the public list, the outcome of the independence test, the subcontracted tasks with your written agreement, and every notice of a change to its designation.

Hangs off: Articles 28 to 39: notifying authorities and notified bodies

Editorially reviewed | conformity, evidence, governance

Per AI component: the intended purpose, the function inside the product, the failure analysis with its consequence for health and safety, the basis of the third-party conformity assessment, and which of paragraphs 1a, 1b and 1c was applied and why. This is a self-maintained file; the Regulation does not prescribe it, and for products under Annex I, Section B, the technical documentation of Article 11 and Annex IV does not apply at all.

Hangs off: Article 6(1a) to (1c): the tightened classification route

Editorially reviewed | conformity, high-risk

Per model version: the measured and planned training compute with the scope of recital 111, so including pre-training, synthetic data generation and fine-tuning, the moment the threshold was reached or foreseen, the notification sent with its supporting information, any arguments under paragraph 2, any reassessment request under paragraph 5, and the response or designation decision of the Commission.

Hangs off: Article 52: notification of a GPAI model with systemic risk

Editorially reviewed | gpai-systemic-risk

Record per system of role, contractual arrangements on information and cooperation, and the appointment of a representative where required.

Hangs off: Articles 22-25: value chain and authorised representative

Editorially reviewed | evidence, value-chain

An organisation secures the entrances to its buildings with facial recognition and uses that biometric access control to register visitors as well. When the system returns no match, a security officer reviews the camera images and decides personally whether someone may enter. The question is whose measures have to reach that officer: those of the supplier of the model, those of the department that deploys the system, or both.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A police force uses AI to search large volumes of investigation files and surface connections a detective would otherwise miss. The outputs feed into the choice of which suspect is pursued further and end up in documents that enter the criminal process. The question is whether one and the same basic instruction is enough for the analyst operating the model and for the detective who acts on its output.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A newsroom uses generative AI to prepare summaries, headlines and imagery, after which an editor finishes the piece and the desk decides to publish. Part of that work sits with freelancers, and an outside agency produces marketing content with the same tools. The question is whether your AI literacy measures must reach those freelancers and that agency, or only the people on the payroll.

Hangs off: Article 4: AI literacy

Placed against the official source | examples

A recruiter deploys an AI chat that puts candidates through a first screening conversation after they respond to a job posting, and adds their answers to their CV. The chat introduces itself with a first name and writes in a casual conversational tone. The question is whether these applicants reasonably realise that they are talking to an AI system.

Placed against the official source | examples

An organisation admits staff through facial recognition at its access control gate and additionally runs a camera in the visitor area that sorts faces into age groups. Both applications run on the same biometric infrastructure and the same images. The question is which of the two requires the people involved to be actively informed.

Placed against the official source | examples

A software company uses an AI assistant for code suggestions and code review, available only to professional developers. The same company also runs a helpdesk chatbot for customers.

Placed against the official source | examples

A bank opens an AI-driven reporting portal where customers can flag suspected fraud around their payment account or loan. The system asks follow-up questions, categorises the report and routes it to fraud detection and, where money laundering signals appear, to the internal reporting team. Because the portal concerns criminal offences, the bank assumes the disclosure duty for direct AI interaction does not apply.

Placed against the official source | examples

A municipality has an AI system write the web pages about a changed scheme for social assistance and allowances, meant to explain to citizens what they are entitled to. A communications officer reads the text for style and spelling and publishes it. The question is whether this public service thereby falls under the exception to the labelling duty.

Placed against the official source | examples

An organisation gives staff an internal AI assistant for HR, legal, procurement, compliance and IT questions. Must that assistant disclose at every turn that it is AI?

Placed against the official source | examples

A hospital deploys an interactive AI system used exclusively by properly trained health professionals to support medical diagnosis and suggest treatments. The question is whether the patient or the clinician must be told it is AI.

Placed against the official source | examples

An authority empowered by law to detect criminal offences wants to deploy an interactive AI system without telling those involved that they are communicating with AI.

Placed against the official source | examples

An employer uses an AI system that scores employee performance and lets that score weigh in promotion and dismissal. After a change to the model it turns out that a group of staff was scored too low for months, and decisions have already been taken on those scores. HR wonders whether this is a serious incident and who would have to report it.

Hangs off: Article 73: serious incident reporting

Placed against the official source | examples

An automated border gate uses biometric facial recognition to compare a traveller’s face with the photo in the passport chip. The same camera could technically also compare against a law-enforcement database, and exactly that difference decides whether this biometrics is high-risk.

Hangs off: Annex III: high-risk AI

Placed against the official source | examples