Obligations register

AI Act obligations from rule to evidence

Start with your role and situation. Every route separates official fact, our interpretation and recommended action and shows source, version and latest review.

Public and no account required. The official source remains authoritative.

Praxikon tracks every obligation under the EU AI Act, citing the source for every statement.

Applicablev1.0.0
Articles 40 to 42: standards, common specifications and presumption of conformity
A party applying a harmonised standard whose reference has been published in the Official Journal of the European Union is presumed to be in conformity with the requirements of Section 2 or with the obligations of Chapter V, Sections 2 and 3, to the extent that the standard covers them. As long as no such standard exists, the Commission may adopt common specifications by implementing act, and those carry the same presumption. If you do not apply such a common specification, you must duly justify that you have adopted technical solutions that are at least equivalent. Article 42 adds three narrow presumptions, and they do not all arise in the same way. Paragraph 1 gives the presumption of conformity with Article 10(4) to systems trained and tested on data reflecting the specific geographical, behavioural, contextual or functional setting within which they are intended to be used; no publication in the Official Journal is attached to it. Paragraph 2 does carry that condition: the presumption of conformity with the cybersecurity requirements of Article 15 applies to systems certified under a scheme pursuant to Regulation (EU) 2019/881 the references of which have been published in the Official Journal. The paragraph 3 added by Article 1, point (18), of Regulation (EU) 2026/1744 gives that same presumption to systems falling within the scope of Regulation (EU) 2024/2847 that meet the conditions in Article 12(1) thereof. Each of these presumptions is rebuttable and reaches no further than what the standard, the specification or the certification covers.
Relevant to: Provider of a GPAI model, Provider of an AI system
First action
Record per requirement which standard or specification you rely on, and justify every departure
Evidence to retain
Coverage matrix and justification for standards and specifications
Open obligation
Applicablev1.0.0
Article 4a: legal basis for bias testing with special categories of personal data
Article 4a grants permission rather than instruction, and to two different sets of parties. Paragraph 1 allows only the provider of a high-risk AI system to process special categories of personal data by way of exception, to the extent strictly necessary for bias detection and correction within the meaning of Article 10(2), points (f) and (g), and only where all six conditions (a) to (f) are met. Paragraph 2 opens the same room to providers and deployers of other AI systems and models and to deployers of high-risk systems, but only for bias likely to affect the health and safety of persons, to have a negative impact on fundamental rights or to lead to discrimination prohibited under Union law, and subject to the same six conditions. Until 27 July 2026 this basis sat in Article 10(5).
Relevant to: Deployer, Provider of a GPAI model, Provider of an AI system
First action
Justify and record your reliance on Article 4a
Evidence to retain
Necessity file for bias testing
Open obligation
Applicablev1.0.0
Article 52: notification of a GPAI model with systemic risk
The provider of a general-purpose AI model that meets the condition in Article 51(1), point (a), notifies the Commission without delay and in any event within two weeks, with the information needed to demonstrate that the requirement has been met. With that notification the provider may present substantiated arguments that the model exceptionally does not present systemic risks after all.
Relevant to: Provider of a GPAI model
First action
Notify the Commission within two weeks
Evidence to retain
Systemic-risk notification file
Open obligation
Applicablev1.0.0
Article 53: GPAI model providers
Documentation, information, copyright and transparency duties for providers of general-purpose AI models.
Relevant to: Provider of a GPAI model
First action
Maintain GPAI documentation and transparency information
Evidence to retain
GPAI compliance file
Open obligation
Applicablev1.0.0
Article 54: authorised representative of a provider of a GPAI model
A provider established in a third country appoints, by written mandate, an authorised representative established in the Union before placing a general-purpose AI model on the Union market. The representative performs the tasks the mandate assigns to it and provides a copy of that mandate to the AI Office upon request. The mandate empowers it at least to verify the documentation, keep a copy available for ten years, provide information and cooperate, and appoints it as the point of contact in addition to or instead of the provider.
Relevant to: Authorised representative, Provider of a GPAI model
First action
Appoint an authorised representative and record the mandate
Evidence to retain
Mandate file of the authorised representative
Open obligation
Applicablev1.0.0
Article 55: GPAI models with systemic risk
Additional duties for the most capable general-purpose AI models, on top of Article 53.
Relevant to: Provider of a GPAI model
First action
Perform model evaluations and risk mitigation
Evidence to retain
Systemic-risk file
Open obligation
Applicablev1.0.0
Article 56: codes of practice for general-purpose AI models
The AI Office encourages and facilitates the drawing up of codes of practice at Union level, and the AI Office and the Board see to it that those codes cover at least the obligations in Articles 53 and 55. Providers of general-purpose AI models and national competent authorities may be invited to participate in the drawing up; civil society organisations, industry, academia and other stakeholders may support the process. Until 27 July 2026 the Commission could approve a code of practice by implementing act and give it general validity within the Union; Article 1, point (21), of Regulation (EU) 2026/1744 replaced paragraph 6 and removed that power. Since then the Commission assesses whether the codes cover the obligations of Articles 53 and 55 and publishes that assessment. The codes were to be ready by 2 May 2025 at the latest; if no code existed by 2 August 2025, or if the AI Office deems one inadequate, the Commission may lay down common rules by implementing acts for the implementation of Articles 53 and 55. For you this is therefore not a separate duty but a route: a code is a voluntary instrument with which you can demonstrate compliance.
Relevant to: Provider of a GPAI model, Provider of an AI system
First action
Take and record the decision whether you adhere to a code of practice
Evidence to retain
Record of the decision on a code of practice
Open obligation
Applicablev1.0.0
Article 78: confidentiality of what you submit to an authority
The Commission, the market surveillance authorities, the notified bodies and everyone involved in the application of the Regulation respect the confidentiality of what they obtain in carrying out their tasks, and in doing so expressly protect the intellectual property rights, the confidential business information and the trade secrets of a natural or legal person, including source code. They may request only data that is strictly necessary, must secure it, and must delete it as soon as it is no longer needed. For you this is therefore not a duty but a protection, with a limit: the exception in Article 5 of Directive (EU) 2016/943 remains, and the provision leaves the exchange of information and the dissemination of warnings between authorities untouched.
Relevant to: Deployer, Provider of a GPAI model, Provider of an AI system
First action
Mark and register what you submit to an authority or body
Evidence to retain
Register of submissions to authorities
Open obligation
Applicablev1.0.0
Article 99, 100 and 101: the penalty structure per obligation
The Regulation carries no single fine amount. For operators, three ceilings attach to different paragraphs of Article 99; in addition the Commission itself fines providers of general-purpose AI models under Article 101, the AI Office can fine in its own right since the 2026 amendment, and Union institutions and bodies face the separate amounts of Article 100. Which ceiling applies depends on which provision was infringed and on who enforces, and not on how serious the consequences are.
Relevant to: Authorised representative, Deployer, Distributor, Provider of a GPAI model, Importer, Provider of an AI system
First action
Assign to each obligation the penalty ceiling that belongs to it
Evidence to retain
Register of penalty ceilings per obligation
Open obligation

View the same data as JSON Open the explorer: why this hangs off that