Why this object hangs off that object

Walk through your obligations register and mark per line which ceiling applies: Article 99(3) for Article 5, Article 99(4) for the role duties enumerated there, Article 25(2) and (4) and Article 50, Article 99(5) for answering information requests, and otherwise the national penalty regime under Article 99(1). Add the Article 101 regime wherever you provide a general-purpose AI model yourself, and the Article 75c regime wherever the AI Office is competent.

Hangs off: Article 99, 100 and 101: the penalty structure per obligation

Editorially reviewed | enforcement, governance

Check and record: the conformity assessment has been carried out, the technical documentation exists, the CE marking plus declaration and instructions for use are present, and an authorised representative has been appointed.

Hangs off: Article 23: obligations of importers

Editorially reviewed | value-chain

You are an importer as soon as you, from within the EU, first place an AI system on the Union market that bears the name or trade mark of a party established outside the EU. What counts is not your purchasing role but whose brand is on the system and who first brings it to market.

Editorially reviewed | value-chain

The control that ensures the factors which determine the amount of a fine are recorded at the time and not reconstructed afterwards: which technical and organisational measures were in place, when you notified an infringement yourself, how you responded to requests from the authority, and what you did to mitigate the harm suffered by affected persons. Those factors cut both ways, so the same record can also count against you; that is a reason to keep it properly rather than not at all.

Hangs off: Article 99, 100 and 101: the penalty structure per obligation

Editorially reviewed | control, enforcement

As soon as you have sufficient reason to consider a system non-conforming or falsified, it does not go to market, and where there is a risk you notify the provider, the authorised representative and the market surveillance authorities.

Hangs off: Article 23: obligations of importers

Editorially reviewed | value-chain

The marking by which a provider indicates that an AI system conforms to the requirements of Chapter III, Section 2 and to other applicable Union harmonisation legislation providing for its affixing.

Placed against the official source | definitions

Any link in the supply chain that makes an AI system available on the Union market and is neither provider nor importer.

Placed against the official source | definitions

Whoever places on the Union market a system bearing the name or trademark of a party established in a third country.

Placed against the official source | definitions

The first moment a system or model is made available on the Union market, and therefore the trigger for many obligations.

Placed against the official source | definitions

The umbrella term for all six roles in the chain, and not the person operating the controls.

Placed against the official source | definitions

A measure aimed at preventing an AI system that is in the supply chain from being made available on the market. It stops distribution, not use by existing customers.

Placed against the official source | definitions

Per obligation: which ceiling attaches to it and on which provision that rests, whether the level follows from national law and if so from which, and whether the Article 101 or Article 75c regime is added on top. This is the document that shows a board there is no single amount, and that substantiates where you make your controls heavier.

Hangs off: Article 99, 100 and 101: the penalty structure per obligation

Editorially reviewed | enforcement, evidence

Your own archive of the notified body certificate, the instructions for use and the EU declaration of conformity, available for ten years and in a language the authority easily understands.

Hangs off: Article 23: obligations of importers

Editorially reviewed | value-chain

High-risk AI systems placed on the market or put into service before the date of application of Chapter III, since the Digital Omnibus 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems, come under the high-risk requirements of that Chapter only once their design is significantly changed as from that date. This is not an exemption from the whole Regulation: Article 4 and Article 50 keep running. For systems intended to be used by public authorities the carve out falls away entirely: their providers and deployers must in any case comply with the requirements and obligations by 2 August 2030.

Placed against the official source | high-risk, timeline

A provider that considers, or has reason to consider, that a high-risk AI system it has placed on the market or put into service is not in conformity with the Regulation must immediately take the necessary corrective actions and inform the distributors accordingly, and, where applicable, also the deployers, the authorised representative and the importers. Where that system also presents a risk within the meaning of Article 79(1), the provider must immediately investigate the causes and inform the competent market surveillance authorities and, where applicable, the notified body that issued a certificate under Article 44.

Placed against the official source | high-risk-requirements, post-market

Before placing a system on the market the importer verifies four things about the provider, and afterwards carries its own retention, information and notification package with a ten-year term.

Placed against the official source | value-chain

The Regulation carries no single fine amount. For operators, three ceilings attach to different paragraphs of Article 99; in addition the Commission itself fines providers of general-purpose AI models under Article 101, the AI Office can fine in its own right since the 2026 amendment, and Union institutions and bodies face the separate amounts of Article 100. Which ceiling applies depends on which provision was infringed and on who enforces, and not on how serious the consequences are.

Placed against the official source | enforcement, prohibited-practices

The legal text on EUR-Lex: the base text in Regulation (EU) 2024/1689 and the replacement of paragraph 2 and the addition of paragraph 4 in Regulation (EU) 2026/1744. Reading only the base text means reading the 2024 version.

Hangs off: Article 111(2): legacy high-risk systems and the 2 August 2030 date

Editorially reviewed | high-risk, timeline

The full legal text in the public AI Act Explorer.

Hangs off: Article 23: obligations of importers

Editorially reviewed | template, value-chain

The full legal text in the public AI Act Explorer. Note that the explorer shows the original 2024 text, so for paragraph 1, point (da) and paragraph 6a of Article 99 you also need Regulation (EU) 2026/1744, to which the second source link points.

Hangs off: Article 99, 100 and 101: the penalty structure per obligation

Editorially reviewed | enforcement, template