Why this object hangs off that object

The control that ensures an information request, a notice of investigation or an announced inspection from the AI Office reaches an identifiable person, that it is first established whether it is a simple request or a decision, that the period set is tracked, and that what was supplied is recorded. The substance is sanctioned too: a periodic penalty payment can be imposed where you fail to give correct or complete answers during an ordered inspection, and incorrect, incomplete or misleading information supplied to the Office falls under the fines of Article 99(5). A retention order under Article 75a(6) belongs in this control, because it overrides your deletion routines.

Hangs off: Article 75(1a) and (1e): reporting to and assessment by the AI Office, Article 75: market surveillance, mutual assistance and the powers of the AI Office

Editorially reviewed | control, enforcement

The control that reruns the route determination as soon as the product, the AI function, the conformity assessment procedure chosen or the list in Annex I changes, instead of standing still after the first market introduction. The move of machinery to Section B on 27 July 2026 shows that the list moves too.

Hangs off: Article 6(1): the product route to high risk

Editorially reviewed | control, high-risk

The control that ensures a change of intended purpose, a new vendor feature, a new use inside the organisation or a delegated act under Article 7 triggers a fresh assessment of the mapping to a point of Annex III, instead of the first record standing for years while the system or the list moves.

Hangs off: Annex III: the eight areas separately

Editorially reviewed | high-risk

Reopen classification when intended purpose, use context or system functionality changes materially.

Hangs off: Annex III: high-risk AI

Editorially reviewed | control, high-risk

Block signature of an AI contract until the supplier has answered in writing which Annex III point the intended purpose falls under, whether it relies on Article 6(3), and whether the system profiles natural persons.

Hangs off: Annex III: high-risk AI

Editorially reviewed | high-risk

Repeat the data quality assessment before every retraining or dataset change.

Hangs off: Article 10: data and data governance

Editorially reviewed | control, high-risk-requirements

Update the file before every release and retain earlier versions traceably.

Hangs off: Article 11: technical documentation

Editorially reviewed | control, high-risk-requirements

Periodically verify that logging works, is complete and is retained according to the regime.

Hangs off: Article 12: logging and traceability

Editorially reviewed | control, high-risk-requirements

At every deployment and update, verify instructions are present, current and internally translated.

Hangs off: Article 13: transparency towards deployers

Editorially reviewed | control, high-risk-requirements

Before go-live, test that intervening, stopping and disregarding output actually works and is assigned.

Hangs off: Article 14: human oversight

Editorially reviewed | control, high-risk-requirements

Monitor whether the system stays within declared levels in production and escalate on deviation.

Hangs off: Article 15: accuracy, robustness and cybersecurity

Editorially reviewed | control, high-risk-requirements

A hard block in your release or delivery process: no delivery without a completed conformity assessment, a signed EU declaration of conformity, an affixed CE marking and a completed registration.

Hangs off: Article 16: the twelve duties of a provider of a high-risk AI system

Editorially reviewed | high-risk-requirements

Periodically audit whether practice follows the described system and record deviations and improvements.

Hangs off: Article 17: quality management system

Editorially reviewed | control, high-risk-requirements

The control that keeps the file complete per system, tracks the end date of the period, and ensures the documents can still be opened after a systems migration, a reorganisation or a change of supplier.

Hangs off: Article 18: documentation keeping

Editorially reviewed | control, high-risk-requirements

Periodically reconcile the list of accounts and licences with access to AI systems against the participation and instruction register, and clear the gap list with an owner and a deadline.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy

Check when systems, roles or risks change whether the selected measures remain appropriate.

Hangs off: Article 4: AI literacy

Editorially reviewed | ai-literacy, control

The control that keeps a system running under Article 46 under watch: the ongoing conformity assessment has an owner and an end date, the fifteen calendar days of paragraph 4 are in the calendar, and a rehearsed plan is in place to stop use with immediate effect and discard all results and outputs if the authorisation is refused or withdrawn.

Hangs off: Article 46: derogation from conformity assessment procedure

Editorially reviewed | conformity, control, enforcement

The control that stops any Annex III system from being placed on the market, put into service or used before the registration is complete, with an explicit check on the Article 6(3) route and on the Article 26(8) question whether the provider entry is present in the database.

Hangs off: Article 49: registration in the EU database before the system reaches the market

Editorially reviewed | conformity, control, high-risk

Repeat the screening for every new system, procurement and material change of purpose or context; an earlier clearance does not cover a new use.

Hangs off: Article 5: prohibited practices

Editorially reviewed | control, prohibited-practices

Each quarter, sample the systems carrying an Article 50 scenario and verify in the production environment that the disclosure still appears and the marking is still present in the actual output, recording finding, owner and remediation deadline.

Hangs off: Article 50: transparency

Editorially reviewed | transparency

Before release, test that the applicable disclosure, marking or label is timely, clear and technically effective.

Hangs off: Article 50: transparency

Editorially reviewed | control, transparency

Monitor cumulative training compute and notify the Commission when the threshold is reached.

Hangs off: Article 55: GPAI models with systemic risk

Editorially reviewed | control, gpai-systemic-risk

The control that periodically rechecks a reliance on a code of practice: does the version you rely on still stand, has the code been reviewed or adapted under paragraph 8, has the Commission published its assessment of adequacy under paragraph 6 as replaced by Regulation (EU) 2026/1744, and has the Commission laid down common rules under paragraph 9.

Hangs off: Article 56: codes of practice for general-purpose AI models

Editorially reviewed | control, governance, gpai, gpai-systemic-risk

The authority retains its supervisory and corrective powers and can suspend your testing or participation. If you stay within the plan and follow the guidance in good faith, authorities impose no administrative fines for infringements of this Regulation.

Hangs off: Article 57: AI regulatory sandboxes

Editorially reviewed | innovation

The market surveillance authority may inspect unannounced. On a serious incident you report, take immediate mitigation or suspend, and you must have a procedure in place in advance for prompt recall of the system.

Hangs off: Article 60: testing in real world conditions outside a sandbox

Editorially reviewed | innovation

The control that no subject participates before the information pack is complete, the consent record is dated and a copy has been given, and that the withdrawal route with its recipient, period and deletion step works and has been rehearsed once.

Hangs off: Article 61: informed consent of test subjects for testing in real world conditions

Editorially reviewed | control, fundamental-rights, innovation

The control that on every application for a conformity assessment under Article 43 and on every sandbox application it is checked whether the SME facilities have been invoked and whether the proportionate fee reduction has been made visible, and that the answer reaches the procurement file.

Hangs off: Article 62: measures for providers and deployers that are SMEs or start-ups

Editorially reviewed | control, governance, innovation

The control that every simplification you make under Article 63 is tested against paragraph 2, so that no item from Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73 falls away, and that the shareholding structure test is redone at every change.

Hangs off: Article 63: derogations for SMEs in the quality management system

Editorially reviewed | control, high-risk-requirements, innovation

Ensure real-world signals (deviations, complaints, incidents) demonstrably lead to analysis and, where needed, measures.

Hangs off: Article 72: post-market monitoring

Editorially reviewed | control, post-market

Periodically test whether an incident can be reported within the legal deadlines, including the deployer-to-provider chain.

Hangs off: Article 73: serious incident reporting

Editorially reviewed | control, post-market

The control that sends a submission touching source code, training methodology or trade secrets through a fixed review: is the request reasoned, what purpose was stated, which part is strictly necessary, and who inside the organisation signs off on it.

Hangs off: Article 78: confidentiality of what you submit to an authority

Editorially reviewed | control, enforcement, governance

The control that ensures, for a system inside a product under Section A of Annex I, that the choice in paragraph 2 was made deliberately and remains visible: a cross-reference per requirement of Section 2 into the existing technical file, or two files with a recorded owner who keeps them in step.

Hangs off: Article 8: compliance with the requirements for high-risk AI systems

Editorially reviewed | conformity, control, high-risk-requirements

Reopen the risk management process on changes in purpose, data, model or use context and before every release.

Hangs off: Article 9: risk management system

Editorially reviewed | control, high-risk-requirements

The control that no external statement, quotation, tender response or annual report presents a code of conduct as cover for an obligation under the Regulation, and that every voluntary commitment has an owner, an indicator and a moment of measurement before it goes out.

Hangs off: Article 95: codes of conduct for voluntary application of specific requirements

Editorially reviewed | control, governance, innovation

The control that ensures the factors which determine the amount of a fine are recorded at the time and not reconstructed afterwards: which technical and organisational measures were in place, when you notified an infringement yourself, how you responded to requests from the authority, and what you did to mitigate the harm suffered by affected persons. Those factors cut both ways, so the same record can also count against you; that is a reason to keep it properly rather than not at all.

Hangs off: Article 99, 100 and 101: the penalty structure per obligation

Editorially reviewed | control, enforcement

The control that ensures an incoming request from a competent authority reaches an identifiable owner the same day, that the documents requested are matched to the right system version, and that delivery is complete within the period set by the authority.

Hangs off: Article 21: cooperation with competent authorities

Editorially reviewed | control, high-risk-requirements

The control that ensures the special categories stay with authorised people, are not transmitted, transferred or otherwise accessed by other parties, and are actually deleted once the bias has been corrected or the retention period ends, instead of lingering because nobody watches the deadline.

Hangs off: Article 4a: legal basis for bias testing with special categories of personal data

Editorially reviewed | fundamental-rights, high-risk-requirements

The control that ensures three signals reach an identifiable person in time instead of surfacing only once the certificate has already lapsed or been suspended: an approaching expiry date, a change that may be substantial within the meaning of Article 43(4), and a notice from or about the notified body itself, including the notification within ten days on suspension, restriction or withdrawal of its designation and the confirmation that Article 36(8), point (b), requires from the provider within three months.

Hangs off: Article 44: certificates of notified bodies

Editorially reviewed | conformity, control

Rerun the conformity route whenever the system is substantially modified.

Hangs off: Articles 43-49: conformity assessment, CE and registration

Editorially reviewed | conformity, control

A fixed rule that suspends use and notifies in the correct order as soon as you have reason to consider the system presents a risk or as soon as you identify a serious incident.

Hangs off: Article 26: obligations of deployers of high-risk AI systems

Editorially reviewed | high-risk-requirements

The control that ensures no change to a legacy high-risk system reaches production without a recorded judgement on whether it is significant, with an identifiable assessor and a demonstrable link to the release.

Hangs off: Article 111(2): legacy high-risk systems and the 2 August 2030 date

Editorially reviewed | high-risk, timeline

A pre-arranged capability to bring an already supplied system into conformity, withdraw it or recall it, and to immediately notify the provider or importer and the competent authorities.

Hangs off: Article 24: obligations of distributors

Editorially reviewed | value-chain

The control that ensures a change of status, Member States, certificate or declaration of conformity leads to an updated entry within a set period, and that a public deployer notices when the provider does not enter its Section A or enters it late, instead of the public page quietly lagging behind reality.

Hangs off: Article 71: EU database for high-risk AI systems listed in Annex III

Editorially reviewed | conformity, control

The control that ensures an incoming request reaches an identifiable person within a set period and is answered, instead of sitting in a general inbox.

Hangs off: Article 85: right to lodge a complaint with the market surveillance authority, Article 86: right to an explanation of a decision

Editorially reviewed | fundamental-rights

Periodically and on every change in process, duration of use, affected groups, risks or oversight measures, check whether the recorded elements still hold, and update the information as soon as they do not.

Hangs off: Article 27: FRIA

Editorially reviewed | fundamental-rights

Block deployment until applicability, assessment, mitigation and notification have been completed.

Hangs off: Article 27: FRIA

Editorially reviewed | control, fundamental-rights

Establish every six months whether you demonstrate compliance through a code of practice, through a published harmonised standard, or through alternative adequate means, and whether the underlying file matches that choice.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | gpai

Update documentation and downstream information when the model, capabilities or risks change.

Hangs off: Article 53: GPAI model providers

Editorially reviewed | control, gpai

The control that ensures the representative can actually reach the documentation, that the verification under paragraph 3(a) is repeated at a fixed moment, and that there is an agreed route for the termination under paragraph 5 with the immediate notification to the AI Office. Without such a moment a mandate stays on paper while nobody tests it.

Hangs off: Article 54: authorised representative of a provider of a GPAI model

Editorially reviewed | control, gpai

As soon as you have sufficient reason to consider a system non-conforming or falsified, it does not go to market, and where there is a risk you notify the provider, the authorised representative and the market surveillance authorities.

Hangs off: Article 23: obligations of importers

Editorially reviewed | value-chain

The control that ensures a signal about possible non-conformity reaches an identifiable decision maker within a set period, that it is decided there whether paragraph 1 or also paragraph 2 comes into play and whether the reporting duty of Article 73 runs alongside it, and that the decision is recorded with a date instead of remaining in a support ticket.

Hangs off: Article 20: corrective actions and duty of information

Editorially reviewed | control, post-market

The control that absorbs the loss of a notified body: a fixed periodic check of the public list, a contractual reporting duty mirroring the ten days of Article 36(5), a named alternative body for your type of system, and a handover procedure that stays within the nine months of Article 36(3) and (9).

Hangs off: Articles 28 to 39: notifying authorities and notified bodies

Editorially reviewed | conformity, control, governance

The control that keeps the coverage matrix current: a fixed check on new references of harmonised standards, on new or amended common specifications, and on the repeal that Article 41(4) prescribes once a standard is published, with a named owner who then updates the matrix.

Hangs off: Articles 40 to 42: standards, common specifications and presumption of conformity

Editorially reviewed | conformity, control, standards

The control that ensures a report does not reach a line manager in identifiable form and that a person reporting who meets the conditions of Directive (EU) 2019/1937 is not treated differently afterwards. Article 19 of that Directive prohibits retaliation in any form, Article 21 sets out the protection and places the burden of proof on the organisation once the person reporting makes the detriment plausible. That is enforced not through the AI Regulation but through national whistleblower law. Without this control the channel exists but goes unused, and the first person who noticed something never reaches you.

Hangs off: Article 87: reporting of infringements and protection of reporting persons

Editorially reviewed | control, fundamental-rights

The control that ensures the assessment is redone as soon as the intended purpose, the function of the component or the applicable harmonisation legislation changes, so that a system does not stay outside the route on the basis of an outdated description. A recommended practice, not a legal duty.

Hangs off: Article 6(1a) to (1c): the tightened classification route

Editorially reviewed | conformity, high-risk

The control that ensures the signal from the training pipeline reaches an identifiable owner and that the notification goes out within two weeks. Its trigger point is the allocation of compute and not the end of the run, because recital 111 also counts pre-training, synthetic data and fine-tuning and recital 112 assumes the provider knows the outcome before then. It sits alongside the monitoring of compute itself: that measures the threshold, this guards the clock that starts afterwards.

Hangs off: Article 52: notification of a GPAI model with systemic risk

Editorially reviewed | gpai-systemic-risk

Repeat the role assessment on every rebranding, modification or new use of an existing system.

Hangs off: Articles 22-25: value chain and authorised representative

Editorially reviewed | control, value-chain