Why this object hangs off that object

Walk through your obligations register and mark per line which ceiling applies: Article 99(3) for Article 5, Article 99(4) for the role duties enumerated there, Article 25(2) and (4) and Article 50, Article 99(5) for answering information requests, and otherwise the national penalty regime under Article 99(1). Add the Article 101 regime wherever you provide a general-purpose AI model yourself, and the Article 75c regime wherever the AI Office is competent.

Hangs off: Article 99, 100 and 101: the penalty structure per obligation

Editorially reviewed | enforcement, governance

Determine per system which of the four Article 49 routes applies, the ordinary Annex III route, the Article 6(3) route, the secure section for law enforcement, migration, asylum and border control management, or the national route for point 2 of Annex III, and complete the registration before the system is placed on the market, put into service or used.

Hangs off: Article 49: registration in the EU database before the system reaches the market

Editorially reviewed | conformity, high-risk

Verify the CE marking, the presence of the EU declaration of conformity and the instructions for use, and whether the provider and importer complied with Article 16, points (b) and (c), and Article 23(3).

Hangs off: Article 24: obligations of distributors

Editorially reviewed | value-chain

You are a distributor if you make an AI system available on the Union market without being the provider or the importer. This catches resellers, systems integrators and managed service providers that pass on someone else's AI.

Editorially reviewed | value-chain

The control that stops any Annex III system from being placed on the market, put into service or used before the registration is complete, with an explicit check on the Article 6(3) route and on the Article 26(8) question whether the provider entry is present in the database.

Hangs off: Article 49: registration in the EU database before the system reaches the market

Editorially reviewed | conformity, control, high-risk

The control that ensures the factors which determine the amount of a fine are recorded at the time and not reconstructed afterwards: which technical and organisational measures were in place, when you notified an infringement yourself, how you responded to requests from the authority, and what you did to mitigate the harm suffered by affected persons. Those factors cut both ways, so the same record can also count against you; that is a reason to keep it properly rather than not at all.

Hangs off: Article 99, 100 and 101: the penalty structure per obligation

Editorially reviewed | control, enforcement

A pre-arranged capability to bring an already supplied system into conformity, withdraw it or recall it, and to immediately notify the provider or importer and the competent authorities.

Hangs off: Article 24: obligations of distributors

Editorially reviewed | value-chain

The marking by which a provider indicates that an AI system conforms to the requirements of Chapter III, Section 2 and to other applicable Union harmonisation legislation providing for its affixing.

Placed against the official source | definitions

Any link in the supply chain that makes an AI system available on the Union market and is neither provider nor importer.

Placed against the official source | definitions

The first moment a system or model is made available on the Union market, and therefore the trigger for many obligations.

Placed against the official source | definitions

The umbrella term for all six roles in the chain, and not the person operating the controls.

Placed against the official source | definitions

A measure aimed at preventing an AI system that is in the supply chain from being made available on the market. It stops distribution, not use by existing customers.

Placed against the official source | definitions

Per system: which Article 49 route was followed, the registration number, the date of registration, the name of the person who submitted it, the system version the entry relates to, and, for the secure section, a statement of which limited fields from Annex VIII and Annex IX were completed.

Hangs off: Article 49: registration in the EU database before the system reaches the market

Editorially reviewed | conformity, evidence, high-risk

Per obligation: which ceiling attaches to it and on which provision that rests, whether the level follows from national law and if so from which, and whether the Article 101 or Article 75c regime is added on top. This is the document that shows a board there is no single amount, and that substantiates where you make your controls heavier.

Hangs off: Article 99, 100 and 101: the penalty structure per obligation

Editorially reviewed | enforcement, evidence

A running record of what you checked, when, with what outcome and which action followed, because the supervisor asks about your conduct rather than about the system.

Hangs off: Article 24: obligations of distributors

Editorially reviewed | value-chain

High-risk AI systems placed on the market or put into service before the date of application of Chapter III, since the Digital Omnibus 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems, come under the high-risk requirements of that Chapter only once their design is significantly changed as from that date. This is not an exemption from the whole Regulation: Article 4 and Article 50 keep running. For systems intended to be used by public authorities the carve out falls away entirely: their providers and deployers must in any case comply with the requirements and obligations by 2 August 2030.

Placed against the official source | high-risk, timeline

A provider that considers, or has reason to consider, that a high-risk AI system it has placed on the market or put into service is not in conformity with the Regulation must immediately take the necessary corrective actions and inform the distributors accordingly, and, where applicable, also the deployers, the authorised representative and the importers. Where that system also presents a risk within the meaning of Article 79(1), the provider must immediately investigate the causes and inform the competent market surveillance authorities and, where applicable, the notified body that issued a certificate under Article 44.

Placed against the official source | high-risk-requirements, post-market

Before making a system available on the market the distributor verifies the marking, the declaration and the instructions for use plus compliance by provider and importer, and must afterwards be able to correct, withdraw or recall.

Placed against the official source | value-chain

The provider of a high-risk AI system listed in Annex III, or where applicable its authorised representative, registers itself and that system in the EU database before it is placed on the market or put into service. The same duty applies to the provider that concludes under Article 6(3) that its Annex III system is precisely not high-risk: that provider too registers itself and that system. The deployer that is a public authority or a Union body, or that acts on behalf of such an authority, registers itself, selects the system and registers its use. For the areas of law enforcement, migration, asylum and border control management the registration goes into a secure non-public section with fewer fields, to which only the Commission and the national authorities referred to in Article 74(8) have access. For the systems in point 2 of Annex III registration does not run through the EU database but at national level.

Placed against the official source | conformity, high-risk

The Regulation carries no single fine amount. For operators, three ceilings attach to different paragraphs of Article 99; in addition the Commission itself fines providers of general-purpose AI models under Article 101, the AI Office can fine in its own right since the 2026 amendment, and Union institutions and bodies face the separate amounts of Article 100. Which ceiling applies depends on which provision was infringed and on who enforces, and not on how serious the consequences are.

Placed against the official source | enforcement, prohibited-practices

The legal text on EUR-Lex: the base text in Regulation (EU) 2024/1689 and the replacement of paragraph 2 and the addition of paragraph 4 in Regulation (EU) 2026/1744. Reading only the base text means reading the 2024 version.

Hangs off: Article 111(2): legacy high-risk systems and the 2 August 2030 date

Editorially reviewed | high-risk, timeline

The full legal text in the public AI Act Explorer.

Hangs off: Article 24: obligations of distributors

Editorially reviewed | template, value-chain

The full legal text in the public AI Act Explorer.

Hangs off: Article 49: registration in the EU database before the system reaches the market

Editorially reviewed | conformity, high-risk, template

The full legal text in the public AI Act Explorer. Note that the explorer shows the original 2024 text, so for paragraph 1, point (da) and paragraph 6a of Article 99 you also need Regulation (EU) 2026/1744, to which the second source link points.

Hangs off: Article 99, 100 and 101: the penalty structure per obligation

Editorially reviewed | enforcement, template