High-risk AI systems – obligations of providers and deployers
Support in meeting the requirements for high-risk systems – both for providers and for organisations deploying such systems.
Provider obligations
- Risk management system and data governance (Articles 9 and 10 AI Act).
- Technical documentation and record-keeping (Articles 11 and 12 AI Act).
- Transparency, instructions for use and human oversight (Articles 13 and 14 AI Act).
- Quality management system, conformity assessment, declaration of conformity and CE marking.
- Registration in the EU database and post-market monitoring.
Deployer obligations
The deployer uses the system in accordance with the instructions, assigns human oversight to competent persons, monitors the system and keeps the logs it generates (Article 26 AI Act).
Bodies governed by public law and certain private deployers carry out a fundamental rights impact assessment before deployment (Article 27 AI Act). Where personal data are processed, it complements the GDPR data protection impact assessment.
Frequently asked questions
When do the high-risk obligations apply?
Following the Digital Omnibus, obligations for Annex III systems (e.g. recruitment, creditworthiness assessment, education) apply from 2 December 2027, and for AI systems in products covered by Annex I from 2 August 2028. Preparing documentation and processes takes time, so it is worth starting early.
Let us discuss your matter
The first conversation is used to define the scope of the matter and the fee.