Why this object hangs off that object

Name which of the four Article 6(3) conditions you invoke, with facts, and separately justify why the system poses no significant risk of harm to health, safety or fundamental rights and does not materially influence the outcome of decision making.

Hangs off: Annex III: high-risk AI

Editorially reviewed | high-risk

Assess Article 5, Article 6 and Annex III in that order and document purpose, context and any Article 6(3) exception.

Hangs off: Annex III: high-risk AI

Editorially reviewed | high-risk

Establish as the first question whether the system performs profiling of natural persons; if yes, the Article 6(3) route falls away and the system remains high-risk, regardless of the four conditions.

Hangs off: Annex III: high-risk AI

Editorially reviewed | high-risk

Name, per high-risk system, who exercises oversight, and ensure that person has the competence, training, authority and support to actually set the output aside.

Hangs off: Article 26: obligations of deployers of high-risk AI systems

Editorially reviewed | high-risk-requirements

Assess origin, representativeness, errors and completeness and examine possible bias with appropriate mitigation.

Hangs off: Article 10: data and data governance

Editorially reviewed | high-risk-requirements

Document system description, development process, data, oversight measures, performance and risk management before market placement.

Hangs off: Article 11: technical documentation

Editorially reviewed | high-risk-requirements

Ensure the system automatically records events relevant to risk identification and post-market monitoring.

Hangs off: Article 12: logging and traceability

Editorially reviewed | high-risk-requirements

Describe capabilities, limitations, accuracy, oversight measures and expected lifetime in comprehensible form.

Hangs off: Article 13: transparency towards deployers

Editorially reviewed | high-risk-requirements

Determine oversight measures per system, appoint competent persons and give them the mandate to intervene or stop.

Hangs off: Article 14: human oversight

Editorially reviewed | high-risk-requirements

Determine appropriate accuracy, test robustness against errors and misuse, and take AI-specific security measures.

Hangs off: Article 15: accuracy, robustness and cybersecurity

Editorially reviewed | high-risk-requirements

Describe strategies, procedures and responsibilities for compliance, from design and data to post-market monitoring.

Hangs off: Article 17: quality management system

Editorially reviewed | high-risk-requirements

Determine for each role, system and context which combination of instruction, guidance, practice or training is appropriate.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

Map roles against the AI systems they use and record per combination what a person must be able to judge: what the system does, where it fails, who it is applied to, and when to intervene or escalate.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

Attach the literacy measure to two fixed moments in existing processes: the rollout of a new AI tool and the onboarding of anyone gaining access to an existing tool.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

Before procurement, build or deployment, check whether the use case falls under a prohibited practice and stop or redesign early rather than after the fact.

Hangs off: Article 5: prohibited practices

Editorially reviewed | prohibited-practices

First determine which paragraph of Article 50 applies, then implement the specific transparency measure.

Hangs off: Article 50: transparency

Editorially reviewed | transparency

Determine per channel whether the text is published to inform the public on matters of public interest, who performs the human review, who holds editorial responsibility, and which standard wording you use when the disclosure is required.

Hangs off: Article 50: transparency

Editorially reviewed | transparency

For each AI system, walk through the distinct Article 50 scenarios (direct interaction, synthetic output, emotion recognition or biometric categorisation, deep fake, published text on matters of public interest) and record per paragraph whether it applies, does not apply or falls under an exception, with the reason.

Hangs off: Article 50: transparency

Editorially reviewed | transparency

Evaluate the model including adversarial testing, assess and mitigate systemic risks, report serious incidents and secure the model.

Hangs off: Article 55: GPAI models with systemic risk

Editorially reviewed | gpai-systemic-risk

Apply to the competent authority, agree a specific sandbox plan, and record which uncertainty about the Regulation you want resolved inside the sandbox.

Hangs off: Article 57: AI regulatory sandboxes

Editorially reviewed | innovation

Draw up a real-world testing plan, submit it to the market surveillance authority, obtain approval, register the test with a Union-wide unique single identification number, and record the division of roles with your deployer.

Hangs off: Article 60: testing in real world conditions outside a sandbox

Editorially reviewed | innovation

Systematically collect and analyse real-world data on the system’s performance and compliance throughout its lifetime.

Hangs off: Article 72: post-market monitoring

Editorially reviewed | post-market

Define what a serious incident is, assign the reporting route to the supervisor and rehearse the process.

Hangs off: Article 73: serious incident reporting

Editorially reviewed | post-market

Identify and analyse known and reasonably foreseeable risks, evaluate them and take measures, repeating the cycle on every change.

Hangs off: Article 9: risk management system

Editorially reviewed | high-risk-requirements

Translate the twelve points (a) to (l) into twelve named owners with a start date, so that no point falls between product management, quality and legal.

Hangs off: Article 16: the twelve duties of a provider of a high-risk AI system

Editorially reviewed | high-risk-requirements

Select the correct assessment procedure, draw up the EU declaration of conformity, affix the CE marking and register in the EU database.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Editorially reviewed | conformity

Name the categories of natural persons and groups likely to be affected by the use in this specific context, and work out the specific risks of harm per category, using the information the provider supplied under Article 13.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights

Assess process, duration, affected persons, risks, oversight, mitigation and complaint mechanisms and notify results where required.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights, high-risk

Describe the measures taken if a risk materialises, who decides internally, through which route an affected person can complain, within which deadline you respond, and who is authorised to stop the use.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights

Maintain technical documentation, information for downstream providers, a copyright policy and a public summary of training content.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | gpai

Build one package for providers integrating your model, covering the intended tasks and integration options, acceptable use policies, release date and distribution methods, interaction with external hardware or software, software versions, architecture and parameter count, modality and format of inputs and outputs including maximum size, licence, required technical means, and information on the training, testing and validation data used.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | gpai

Record which techniques you use to identify a reservation of rights within the meaning of Article 4(3) of Directive (EU) 2019/790 when collecting training data, how often you recheck, and how you then comply with that reservation.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | gpai

Ensure your complaints or objections desk recognises a request for an explanation of an AI-supported decision, that it can be traced per decision which system in which version contributed to it, and that someone is designated to give the explanation.

Hangs off: Article 86: right to an explanation of a decision

Editorially reviewed | fundamental-rights

Record per AI system which assessment was carried out, by whom, on what date and against which system version, and agree who receives a question from the authority and within what period.

Hangs off: Article 85: right to lodge a complaint with the market surveillance authority

Editorially reviewed | fundamental-rights

Verify the CE marking, the presence of the EU declaration of conformity and the instructions for use, and whether the provider and importer complied with Article 16, points (b) and (c), and Article 23(3).

Hangs off: Article 24: obligations of distributors

Editorially reviewed | value-chain

Check and record: the conformity assessment has been carried out, the technical documentation exists, the CE marking plus declaration and instructions for use are present, and an authorised representative has been appointed.

Hangs off: Article 23: obligations of importers

Editorially reviewed | value-chain

On white-labelling, substantial modification or purpose change, assess whether your organisation becomes the provider, and arrange the representative for non-EU supply.

Hangs off: Articles 22-25: value chain and authorised representative

Editorially reviewed | value-chain