Full list

What the regulation requires: Providers and deployers take measures to support the development of AI literacy among their staff and other persons dealing with the operation of the systems on their behalf, taking into account prior knowledge, experience, training and the context of use.

Implementation guidance: Assess training needs based on the systems used, staff responsibilities and prior knowledge. Plan suitable training and regular refreshers. Document content and attendance, and review whether the measures adequately support the intended use.

Possible evidence: Training concept per role, attendance records, date of the most recent refresher.

Amendment by Reg. 2026/1744: Regulation (EU) 2026/1744 recast Art. 4. The duty to ensure AI literacy has become a duty to support its development. It is now expressly clarified that no one has to guarantee a particular level of competence for any individual. The obligation as such remains and has applied since 2 February 2025. The wording attaches to AI systems; a provider of a general-purpose AI model alone is covered in so far as they also provide or deploy systems.

What the regulation requires: Art. 5 prohibits, among other things, social scoring with detrimental effects in an unrelated context, purposefully manipulative or deceptive techniques, exploitation of vulnerability, emotion recognition at the workplace and in education, untargeted scraping of facial images, and biometric categorisation by sensitive attributes. The prohibition covers placing on the market, putting into service and use.

Implementation guidance: Check existing systems and planned purchases against the prohibited practices, including emotion recognition and assessments of individuals. Where a practice is prohibited, the relevant use must cease. Documentation alone does not make it permissible.

Possible evidence: Review record per system against the prohibitions in Art. 5, with outcome and date.

Amendment by Reg. 2026/1744: These prohibitions have applied since 2 February 2025 and are unaffected by the deferral of the high-risk obligations. Infringements carry the highest fine bracket of the regulation.

What the regulation requires: Where a model meets the conditions for classification as a model with systemic risk, the provider must notify the Commission without delay and in any event within two weeks after the requirement is met or it becomes known that it will be met.

Implementation guidance: Record cumulative training compute continuously. Assess this value and the other classification criteria to determine whether notification to the Commission is required, taking account of the two-week deadline.

Possible evidence: Calculation of the training compute, notification to the Commission with date.

What the regulation requires: Providers draw up and keep up to date the technical documentation of the model, including its training and testing process and evaluation results, and make it available to the AI Office and the competent authorities on request. Annex XI sets the minimum content.

Implementation guidance: Capture the required information during training. Document data provenance, training procedures and computing resources so that they remain traceable later.

Possible evidence: Model documentation per Annex XI with version status.

What the regulation requires: Providers make information and documentation available to providers of downstream AI systems enabling them to understand the capabilities and limitations of the model and to comply with their own obligations. Annex XII sets the minimum content.

Implementation guidance: Provide the Annex XII information clearly and completely. Describe capabilities, limitations and integration conditions so downstream providers can assess their own obligations.

Possible evidence: Information package per Annex XII, evidence that it was made available.

What the regulation requires: Providers put in place a policy to comply with Union copyright law, in particular to respect a reservation under Art. 4(3) of Directive (EU) 2019/790, and publish a sufficiently detailed summary of the content used for training, following the template provided by the AI Office.

Implementation guidance: Prepare the public summary using the prescribed template. Clarify early which information about data sources is needed and account for the licensing terms of data suppliers.

Possible evidence: Copyright policy, published summary following the template.

Amendment by Reg. 2026/1744: For models released under a free and open-source licence with publicly available parameters, the obligations under points (a) and (b) do not apply, but the copyright policy and the summary do. Models with systemic risk are excluded from this relief.

What the regulation requires: Providers established in third countries must, prior to placing a model on the Union market, appoint in writing an authorised representative established in the Union who keeps the documentation available for ten years and acts as the point of contact for the AI Office.

Implementation guidance: Assess whether an authorised representative must be appointed. Account for the exception for models released under a free and open-source licence without systemic risk.

Possible evidence: Written mandate, documentation on file.

What the regulation requires: The authorised representative of a model provider established in a third country verifies that the technical documentation under Annex XI has been drawn up and that the obligations under Art. 53 and, where applicable, Art. 55 have been met. They keep a copy of that documentation and the provider contact details available for the AI Office and the national authorities for ten years after the model was placed on the market, provide information upon reasoned request and cooperate with the authorities. A copy of the mandate must be provided to the Office on request in an official language of the Union.

Implementation guidance: For the model provider mandate, assess the Chapter V obligations and cooperation with the AI Office. If you also hold a mandate for AI systems under Article 22, document the tasks and records for each mandate separately.

Possible evidence: Written mandate, copy of the Annex XI documentation, provider contact details, evidence of the verification.

What the regulation requires: Providers of models with systemic risk must perform model evaluations including adversarial testing, assess and mitigate possible systemic risks at Union level, report serious incidents without delay to the AI Office and the competent national authorities, and ensure an adequate level of cybersecurity for the model and its physical infrastructure.

Implementation guidance: Assess how to demonstrate compliance. While relevant harmonised standards are unavailable, the General-Purpose AI Code of Practice may be used. If another approach is chosen, its equivalence must be demonstrated.

Possible evidence: Evaluation reports, adversarial testing results, reporting channels, cybersecurity concept.

What the regulation requires: Anyone deploying a system in an Annex III area but not classifying it as high-risk by virtue of Art. 6(3) must nevertheless register themselves and the system in the EU database. The assessment must be provided on request from the authorities.

Implementation guidance: When planning, account for the fact that the Article 6(3) exception does not remove registration and documentation obligations. Keep the documented assessment with the registration record.

Possible evidence: Registration entry and the documented assessment under Art. 6(3).

What the regulation requires: Before placing the system on the market, the relevant conformity assessment procedure must be completed. For most Annex III systems the internal control procedure in Annex VI suffices; for biometric systems a notified body may need to be involved. For Annex I systems the procedure follows the respective product legislation.

Implementation guidance: Determine the applicable assessment procedure and whether a notified body must be involved. Account for its availability in planning. Assess the need for renewed evaluation when substantial changes occur.

Possible evidence: Assessment documentation and, where applicable, the notified body certificate.

Amendment by Reg. 2026/1744: Regulation (EU) 2026/1744 recast Art. 43(3) and clarified the interface with product legislation: manufacturers need not choose a third-party assessment merely because the product contains a high-risk AI system as a safety component, unless the product legislation requires it. Note at the same time that, on the wording of the amended Art. 113, Section 5 applies from 2 August 2026 while the substantive requirements in Sections 1 to 3 take effect later; the practical handling of this sequence is the subject of announced Commission guidelines.

What the regulation requires: The provider draws up a written EU declaration of conformity for each system, keeps it available for ten years and thereby assumes responsibility for compliance with the requirements. The CE marking is affixed visibly, legibly and indelibly, and digitally where the system is provided digitally.

Implementation guidance: Before signing, verify that the required documentation, assessment and registration records are complete.

Possible evidence: Signed EU declaration of conformity, evidence of the CE marking.

What the regulation requires: Before placing on the market or putting into service, providers of Annex III systems register themselves and their system in the EU database managed by the Commission. The information to be entered is set out in Annex VIII.

Implementation guidance: Before registration, check that the information is complete and consistent with the declaration of conformity. When handling trade secrets, consider which information will become publicly accessible.

Possible evidence: Registration confirmation, reconciliation of the entries with the declaration of conformity.

Amendment by Reg. 2026/1744: Regulation (EU) 2026/1744 streamlined the scope of registration: points 7 and 9 in Annex VIII Section B were deleted. The provider documentation duties are unaffected.

What the regulation requires: Systems intended to interact directly with natural persons must be designed so that those persons are informed that they are interacting with an AI system, unless this is obvious from the circumstances.

Implementation guidance: Design the AI interaction notice for each communication channel used, including telephone and voice assistants. Check that it can be understood and received in good time.

Possible evidence: Wording and placement of the notice per channel.

What the regulation requires: Providers of systems generating synthetic audio, image, video or text content must ensure that the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. The technical solutions must be effective, interoperable, robust and reliable as far as this is technically feasible.

Implementation guidance: Check whether machine-readable markings survive subsequent processing. Consider format conversions, cropping and distribution through external services in particular.

Possible evidence: Description of the marking method, testing of its persistence along the output chain.

What the regulation requires: Deployers of an emotion recognition system or a biometric categorisation system must inform the persons exposed to it about its operation and process the personal data in accordance with data protection law.

Implementation guidance: Assess the permissibility of the intended use before deployment. Pay particular attention to the general prohibition on emotion recognition at work and in education, and the exceptions for medical and safety reasons.

Possible evidence: Information provided to those affected, data protection legal basis, assessment against Art. 5.

What the regulation requires: Deployers who generate or manipulate deepfakes with an AI system must disclose that the content has been artificially generated or manipulated. Those publishing text to inform the public on matters of public interest must also disclose this, unless the content has undergone human review with editorial responsibility.

Implementation guidance: Define how labelling is applied in each publication channel. Account for the specific rules for art and satire. For text, assess and document the conditions for an exception based on human review and editorial responsibility.

Possible evidence: Labelling rule per channel, arrangement for editorial responsibility.

What the regulation requires: Providers establish a post-market monitoring system proportionate to the nature of the technology and the risks. It is based on a plan that forms part of the technical documentation under Annex IV and systematically evaluates experience from operation.

Implementation guidance: Define which operational data will be analysed, who is responsible and how often results are reviewed. Incorporate relevant findings into system development and risk management.

Possible evidence: Monitoring plan, evaluated operational data, measures derived from it.

Amendment by Reg. 2026/1744: The Commission is to adopt guidelines including a template for the monitoring plan by 2 September 2027; this deadline was adjusted by Regulation (EU) 2026/1744.

What the regulation requires: Serious incidents must be reported to the market surveillance authority of the member state concerned, immediately after the causal link with the system has been established and no later than 15 days after becoming aware. For widespread infringements or serious disruption of critical infrastructure the deadline shortens to two days; in the event of a person death a ten day deadline applies.

Implementation guidance: Define a reporting process that accounts for the shortest applicable deadlines. Establish responsibilities, authority contacts, reporting channels and the information needed immediately.

Possible evidence: Reporting process with deadlines and responsibilities, documented reports and investigations.

Amendment by Reg. 2026/1744: Where the system falls under the exclusive competence of the AI Office under the amended Art. 75(1), the report goes to the Office instead. This mainly concerns systems built on a general-purpose AI model from the same provider.

What the regulation requires: Affected persons have a right to obtain a clear and meaningful explanation from the deployer where a decision is taken on the basis of the output of an Annex III system and produces legal effects or significantly and adversely affects their health, safety or fundamental rights. Systems under Annex III point 2 are excluded. The explanation must cover the role of the system in the decision-making procedure and the main elements of the decision.

Implementation guidance: Prepare understandable explanations for the relevant use cases. Use the provider’s information and define how requests for explanation are handled and adapted to the individual case.

Possible evidence: Explanation template, handling path and deadline for requests.

What the regulation requires: For systems that are not high-risk, the regulation encourages voluntary codes of conduct. You may voluntarily apply the requirements for high-risk systems in whole or in part.

Implementation guidance: First document why the system is not classified as high-risk. Then assess which voluntary requirements are useful for your use case and record them in a code of conduct with clear responsibilities.

Possible evidence: A short code listing the points adopted, the responsible people and the review cycle.

What the regulation requires: It is prohibited to place on the market, put into service or use AI systems that generate or manipulate material or performances within the meaning of Art. 2(c) and (e) of Directive 2011/93/EU, unless the conduct is justified under national law.

Implementation guidance: Assess the conditions of the prohibition for your system. Document safeguards against foreseeable misuse in particular, and verify their effectiveness through suitable tests.

Possible evidence: Documented safeguards, test results, reporting channels.

Amendment by Reg. 2026/1744: Also newly inserted by Regulation (EU) 2026/1744, applying from 2 December 2026.

What the regulation requires: It is prohibited to place on the market, put into service or use AI systems that generate or manipulate realistic content depicting the intimate body parts of an identifiable person, or an identifiable person engaged in explicitly sexual conduct, without that person having given freely, specifically, informed, unambiguous and explicit consent.

Implementation guidance: Assess whether generating such content is part of the intended purpose or is foreseeable and reproducible without substantial technical changes. Consider the conditions of the prohibition. Document suitable safeguards, their effectiveness and how reported misuse is addressed.

Possible evidence: Description of safeguards, effectiveness testing, process for handling reported misuse.

Amendment by Reg. 2026/1744: This prohibition is new and was inserted by Regulation (EU) 2026/1744. It applies from 2 December 2026. For deployers, the prohibition applies only where the system is used for that very purpose.

What the regulation requires: Providers of systems, including general-purpose AI models, that generate synthetic content and were placed on the market before 2 August 2026 must take the necessary measures to comply with the marking obligation in Art. 50(2) by 2 December 2026.

Implementation guidance: Identify the affected legacy systems and plan the necessary updates within the four-month transition period. Consider the processing and distribution of generated content as well as the model.

Possible evidence: List of affected legacy systems with planned and achieved implementation status.

Amendment by Reg. 2026/1744: This transitional rule was newly inserted by Regulation (EU) 2026/1744. It is the reason why the marking of generative systems takes effect in two stages.

What the regulation requires: Providers of general-purpose AI models placed on the market before 2 August 2025 must take the necessary steps to comply with the obligations in Chapter V by 2 August 2027.

Implementation guidance: For each legacy model, assess which documentation and measures are still missing. Plan to complete the training documentation and publish the training content summary in good time before 2 August 2027.

Possible evidence: Retrospective documentation per legacy model with a timeline up to August 2027.

What the regulation requires: Whether a system is high-risk is determined under Art. 6. Anyone relying on the exemption in Art. 6(3), because the system performs only a narrow, preparatory or supporting task, must document that assessment before the system is placed on the market or put into service.

Implementation guidance: For each system, document which Annex III areas you assessed and how you reached the classification. Record the date and responsible person. This reasoning provides the basis for identifying the applicable obligations.

Possible evidence: Classification record per system with legal reference, reasoning, date and responsible person.

Amendment by Reg. 2026/1744: Regulation (EU) 2026/1744 added paragraphs 1a to 1c to Art. 6. Systems used exclusively for non-safety-relevant aspects such as user assistance, performance optimisation or usability are not considered safety components. Conversely, a system remains a safety component where its failure or malfunction would endanger health and safety.

What the regulation requires: A continuous risk management system must be established across the entire lifecycle: identify known and reasonably foreseeable risks to health, safety and fundamental rights, evaluate risks from reasonably foreseeable misuse, adopt appropriate measures and keep residual risks acceptable.

Implementation guidance: Maintain a risk register for each system, covering potential impacts, measures, residual risks and responsibilities. Update it when changes occur and test both intended use and foreseeable misuse.

Possible evidence: Risk register with version history, test reports, evidence of recurring updates.

What the regulation requires: Training, validation and testing data sets must meet quality criteria: appropriate collection processes, preparation, assumptions, assessment of availability and suitability, examination for possible biases and their mitigation. The data should be sufficiently representative for the intended purpose and, to the best extent possible, free of errors and complete.

Implementation guidance: Document the origin, composition and preparation of datasets and the checks for bias. Where special categories of personal data are needed, assess and document the conditions of Article 4a.

Possible evidence: Data set description, provenance record, bias analysis and, where Art. 4a applies, the justification in the record of processing activities.

Amendment by Reg. 2026/1744: Regulation (EU) 2026/1744 introduced Art. 4a as an express legal basis for processing special categories of data to detect and correct bias, subject to six conditions such as pseudonymisation, strict access control, deletion after correction and no transfer to third parties. Art. 10(5) was deleted at the same time.

What the regulation requires: Before placing the system on the market, technical documentation must be drawn up that demonstrates compliance with the requirements and enables authorities and notified bodies to assess the system in a clear and comprehensible form. Annex IV sets the minimum content.

Implementation guidance: Structure the technical documentation according to Annex IV and update it for each system version. Ensure it supports both conformity assessment and subsequent market surveillance checks.

Possible evidence: Technical documentation per Annex IV with version status and sign-off.

Amendment by Reg. 2026/1744: New: SMEs including start-ups and small mid-cap companies may provide the Annex IV elements in a simplified manner. The Commission is to produce a simplified form which notified bodies must accept for the conformity assessment. Those using the simplification must use that form.

What the regulation requires: High-risk systems must technically allow for the automatic recording of events over their lifetime, to an extent appropriate for traceability and for identifying situations that give rise to risk.

Implementation guidance: Define which events are logged, at what level of detail and how logs are protected against changes. Align retention with applicable requirements and verify that relevant incidents can be traced through the records.

Possible evidence: Logging concept, sample logs, retention and protection arrangements.

What the regulation requires: Operation must be sufficiently transparent to enable deployers to interpret and use the output appropriately. This includes instructions for use covering the intended purpose, performance characteristics, known limitations, human oversight requirements, expected lifetime and maintenance.

Implementation guidance: Write the instructions for the people who will operate the system. Explain performance limitations, known sources of error and the conditions for reliable use, so deployers can align their workflows and oversight measures.

Possible evidence: Instructions for use per version, evidence of handover to deployers.

What the regulation requires: Systems must be designed so that they can be effectively overseen during use. The person exercising oversight must understand capacities and limitations, remain aware of automation bias, interpret the output correctly, intervene and stop operation.

Implementation guidance: Account for human oversight in the system design. Provide understandable displays and suitable intervention and stop functions. For remote biometric identification, also assess the applicable requirements for confirmation by additional persons.

Possible evidence: Description of oversight features, operating concept, evidence of effectiveness from testing.

What the regulation requires: High-risk systems must achieve and maintain an appropriate level of accuracy, robustness and cybersecurity throughout their lifecycle. This includes resilience against errors and faults, against feedback loops in continuous learning, and against attacks such as data poisoning, model poisoning and adversarial examples.

Implementation guidance: Define and document suitable accuracy metrics and review them regularly against a defined test set. Use the threat catalogue to plan security tests, including data poisoning, prompt injection and model theft.

Possible evidence: Metrics per version, test reports, results of adversarial testing.

Amendment by Reg. 2026/1744: New: where a high-risk system falls within the scope of Regulation (EU) 2024/2847 on horizontal cybersecurity requirements and meets its conditions, it is deemed compliant with the cybersecurity requirements of Art. 15. Duplicate evidence is therefore not required.

What the regulation requires: The provider must indicate their name, registered trade name or trademark and contact address on the system, its packaging or accompanying documentation. In addition, the accessibility requirements of Directives (EU) 2016/2102 and (EU) 2019/882 must be met.

Implementation guidance: Check that the required provider details are complete and correctly displayed. Consider accessibility requirements for the interface and outputs during development.

Possible evidence: Labelling in the product, accessibility test report.

What the regulation requires: Providers put in place a quality management system that ensures compliance with the regulation. It covers, among other things, a regulatory compliance strategy, design and verification procedures, data management, the risk management system, post-market monitoring, the incident reporting procedure and responsibilities.

Implementation guidance: Compare an existing management system, for example under ISO 9001 or ISO/IEC 42001, with the AI Act requirements and add missing procedures. Assign responsibilities and review implementation in day-to-day work.

Possible evidence: Documented quality management system with procedure descriptions and named responsibilities.

Amendment by Reg. 2026/1744: Implementation is proportionate to the size of the organisation; Regulation (EU) 2026/1744 expressly names SMEs, start-ups and small mid-cap companies here. The required level of protection is unaffected. Under Art. 63, SMEs without partner or linked enterprises may comply with certain elements in a simplified manner.

What the regulation requires: The technical documentation, the quality management system documentation, decisions of notified bodies and the EU declaration of conformity must be kept at the disposal of the authorities for ten years from placing on the market or putting into service.

Implementation guidance: Define storage locations, access rights and responsibilities for the full retention period. Ensure documents remain available after projects end or systems and personnel change.

Possible evidence: Storage location, retention period per document, named responsible unit.

What the regulation requires: In so far as the logs are under the provider control, they must be kept for at least six months, unless other Union or national law provides otherwise.

Implementation guidance: Align retention periods with data protection deletion requirements. Document the agreed periods and implement them in system settings and the deletion policy.

Possible evidence: Retention rule with period, reasoning and interface to the deletion concept.

What the regulation requires: A provider who has reason to consider that a system placed on the market is not in conformity must immediately take the necessary corrective action, up to withdrawal or recall, and inform distributors, deployers, authorised representatives and importers.

Implementation guidance: Maintain an up-to-date list of system recipients and deployers. Define how to notify them promptly of corrective measures, withdrawals or recalls.

Possible evidence: Distribution list, procedure description, documented cases with date and measure.

What the regulation requires: Providers established in third countries must, prior to making systems available on the Union market, appoint in writing an authorised representative established in the Union and provide them with the necessary documentation.

Implementation guidance: Specify the tasks under Article 22(3) in the written mandate. Arrange access to the required documentation for the full retention period, including after the business relationship ends.

Possible evidence: Written mandate, evidence of documentation handover.

What the regulation requires: The authorised representative verifies that the EU declaration of conformity and the technical documentation have been drawn up and that a conformity assessment procedure has been carried out, keeps a copy of that documentation and the provider contact details at the disposal of the authorities for ten years, and provides information on request.

Implementation guidance: Agree on continuing access to the required documents. Account for the required retention period and arrange availability after the mandate ends.

Possible evidence: Mandate, copies of the documentation, evidence of the verification.

What the regulation requires: Where the authorised representative has reason to consider that the provider is acting contrary to its obligations under the regulation, they must terminate the mandate and immediately inform the market surveillance authority and, where applicable, the notified body, stating the reasons.

Implementation guidance: Define how indications of non-compliance are assessed, who decides to terminate the mandate and how the competent bodies are informed. Document the decision and reasons.

Possible evidence: Procedure for termination, documented notification to the authority.

What the regulation requires: Importers verify that the provider has carried out the conformity assessment, drawn up the technical documentation, affixed the CE marking, provided the EU declaration of conformity and the instructions for use and, where applicable, appointed an authorised representative.

Implementation guidance: Agree at the ordering stage which evidence the provider should supply. Check and document its completeness before placing the system on the market.

Possible evidence: Verification record listing the documents checked, with date and outcome.

What the regulation requires: Where there is sufficient reason to consider the system not in conformity, it must not be placed on the market; where it presents a risk within the meaning of Art. 79(1), the provider and the authorities must be informed. The importer name, trade name or trademark and contact address must be indicated, and storage and transport conditions must not jeopardise conformity.

Implementation guidance: Define who performs the conformity checks and decides on release. Document reasonable doubts and the measures required before the system is placed on the market.

Possible evidence: Release decisions, labelling, arrangements for storage and transport.

What the regulation requires: Importers keep a copy of the notified body certificate, where applicable of the instructions for use and of the EU declaration of conformity, at the disposal of the authorities for ten years.

Implementation guidance: Arrange retention and access to the documents for the full required period, including after the supply relationship ends.

Possible evidence: Filed copies with retention period and access arrangements.

What the regulation requires: Distributors verify that the CE marking is affixed, that the EU declaration of conformity and the instructions for use are provided, and that the provider and importer have complied with their respective obligations. Where there are justified doubts the system must not be made available; storage and transport must not jeopardise conformity.

Implementation guidance: Use a checklist for marking, the declaration of conformity and instructions for use. Record the result and resolve reasonable doubts before making the system available.

Possible evidence: Checklist per product with date, outcome and responsible person.

What the regulation requires: A distributor who has reason to consider that a system made available is not in conformity must take the necessary corrective action or ensure that the provider or importer takes it, and must inform the authorities where the system presents a risk.

Implementation guidance: Record which organisations received the systems. Define how affected recipients will be contacted for corrective measures, withdrawals or recalls.

Possible evidence: Supply chain per product, documented measures and notifications.

What the regulation requires: Anyone who puts their name or trademark on a high-risk system already placed on the market, makes a substantial modification to it, or changes its intended purpose such that it becomes high-risk, is considered the provider of that system and bears the full provider obligations.

Implementation guidance: Before marketing a system under your own name, substantially modifying it or changing its intended purpose, assess whether your organisation assumes the provider role. Account for the resulting obligations during planning.

Possible evidence: Record for each modification: nature of the change, assessment under Art. 25(1), outcome.

What the regulation requires: Where another actor becomes the provider, the initial provider must cooperate closely: supplying technical documentation sufficient to assess the obligations under Art. 16, informing about known limitations and failure modes, and granting targeted technical access, including for testing and validation. Anyone supplying tools, services or components for a high-risk system must set out the necessary support in a written agreement.

Implementation guidance: Agree early on which technical documents, access and support will be provided. Account for a possible change in the customer’s role to that of provider and the cooperation this requires.

Possible evidence: Written agreement setting out the scope of documentation, access and support.

Amendment by Reg. 2026/1744: Regulation (EU) 2026/1744 spelled out the initial provider duty to cooperate and at the same time created an exception: it does not apply where the initial provider has clearly specified that their system must not be turned into a high-risk system. Infringements of Art. 25(2) and (4) are now expressly subject to fines.

What the regulation requires: Deployers take appropriate technical and organisational measures to ensure they use the systems in accordance with the instructions for use accompanying them.

Implementation guidance: Compare the instructions for use with the planned deployment before introduction. Where use differs from the intended purpose, assess whether the legal classification or your organisation’s role changes.

Possible evidence: Record comparing the intended purpose with the planned use, internal usage rule.

What the regulation requires: Human oversight must be assigned to natural persons who have the necessary competence, training and authority, and who receive the necessary support.

Implementation guidance: Appoint the persons responsible for oversight and document their intervention powers. Ensure they have sufficient knowledge, support and authority to intervene effectively when needed.

Possible evidence: Designation of the persons exercising oversight, evidence of competence, written authority to intervene.

What the regulation requires: In so far as the deployer exercises control over the input data, they must ensure that it is relevant and sufficiently representative in view of the intended purpose of the system.

Implementation guidance: Assess the suitability and representativeness of input data under your control. Pay particular attention to potential bias in your own datasets, such as personnel records or earlier decisions.

Possible evidence: Description of the input data, assessment of suitability and representativeness.

What the regulation requires: Deployers monitor operation on the basis of the instructions for use. Where they identify a risk within the meaning of Art. 79(1), they must immediately inform the provider or distributor and the market surveillance authority and suspend use. In the event of a serious incident, they must inform the provider first, then the importer or distributor and the authority.

Implementation guidance: Define criteria for identifying risks and initiating action. Determine who decides to suspend operation and how the provider and competent authorities are informed.

Possible evidence: Monitoring rule with thresholds, escalation path, documented notifications.

What the regulation requires: In so far as the automatically generated logs are under the control of the deployer, they must be kept for at least six months, unless other law provides otherwise.

Implementation guidance: Clarify with the provider who stores the logs and how you can access them. Align technical settings and contractual arrangements with the required retention period, particularly for cloud services.

Possible evidence: Contractual assurance of log access, documented retention period.

What the regulation requires: Employers putting a high-risk system into service at the workplace must inform workers representatives and the affected workers in advance that they will be subject to the use of the system.

Implementation guidance: Plan to inform affected workers and their representatives before putting the system into service. Also assess the applicable participation rights under national employment law.

Possible evidence: Information notice with date, evidence of involvement of the representative body.

What the regulation requires: Deployers that are public authorities or Union institutions, bodies, offices or agencies must register in the EU database before putting into service or using an Annex III system and must register the system there; systems under Annex III point 2, that is safety components of critical infrastructure, are excluded. Union institutions and bodies must not use an unregistered system under Art. 26(8) and must inform the provider or distributor.

Implementation guidance: Check the required EU database entries before putting the system into service. Resolve missing or incomplete provider information during procurement and document the result.

Possible evidence: Registration entry, verification of the provider entry before going live.

What the regulation requires: Where applicable, deployers use the information received under Art. 13 to comply with their obligation to carry out a data protection impact assessment under Art. 35 GDPR or Art. 27 of Directive (EU) 2016/680.

Implementation guidance: Include the relevant provider information in the data protection impact assessment. Link the documents clearly, particularly information on performance limitations and known failure modes.

Possible evidence: Data protection impact assessment referencing the provider information.

What the regulation requires: Anyone using a post-remote biometric identification system in the course of an investigation must request authorisation from a judicial or administrative authority in advance or without undue delay, and at the latest within 48 hours. If authorisation is refused, use must stop immediately and the data must be deleted. Every use is documented, and annual reports on use must be submitted to the market surveillance authority and the data protection authority.

Implementation guidance: Set up an authorisation process that accounts for the applicable deadlines outside regular working hours. For each use, document the specific link to the investigation, the request, the decision and subsequent procedural steps.

Possible evidence: Authorisation requests and decisions, entry in the case file, annual report to the market surveillance and data protection authorities.

Amendment by Reg. 2026/1744: Use without any link to a criminal offence, criminal proceedings, a genuine threat or the search for a missing person is excluded. An adverse decision based solely on the output of the system is not permitted.

What the regulation requires: Deployers of an Annex III system that makes or assists in making decisions about natural persons must inform those persons that they are subject to the use of the system.

Implementation guidance: Place the notice where affected persons can see it in the relevant procedure, such as a job or credit application. Assess whether general privacy information is sufficient or targeted information is needed.

Possible evidence: Wording and placement of the notice per process.

What the regulation requires: On a reasoned request from the competent authorities, all information and documentation necessary to demonstrate conformity must be provided, in one of the official languages of the Union.

Implementation guidance: Clarify which language the competent authority requires for the documents. Agree with suppliers on timely provision of the required information and translations.

Possible evidence: Named point of contact, complete documentation in the required language.

What the regulation requires: Before putting the system into service, certain deployers must carry out a fundamental rights impact assessment: bodies governed by public law, private entities providing public services, and deployers of systems under Annex III point 5(b) and (c), that is creditworthiness assessment and risk assessment and pricing in life and health insurance. Systems under Annex III point 2 are excluded. It must describe the processes, the period and frequency of use, the categories of persons affected, the risks of harm, oversight measures and remedies.

Implementation guidance: First assess whether your organisation and the intended use fall within the obligation. Plan the assessment and the required notification to the competent market surveillance authority before putting the system into service.

Possible evidence: Completed fundamental rights impact assessment, notification to the market surveillance authority.

Amendment by Reg. 2026/1744: Regulation (EU) 2026/1744 reduced duplication: where a data protection impact assessment already covers the same points, its relevant sections may be incorporated by reference or as an extract. The AI Office is to develop a model questionnaire for this, including as an automated tool.

What the regulation requires: For high-risk systems placed on the market or put into service before Chapter III becomes applicable, the regulation applies only if they are subsequently significantly changed in their design. The prohibitions in Art. 5 remain unaffected.

Implementation guidance: For each legacy system, document when it was placed on the market or put into service and its design at that time. Record subsequent changes so the applicability of the transition rule can be assessed.

Possible evidence: Inventory with a reference date per system and a change history.

Amendment by Reg. 2026/1744: Regulation (EU) 2026/1744 adjusted the reference point: what matters now is the start of application of Chapter III under Art. 113, that is 2 December 2027 for Annex III and 2 August 2028 for Annex I.

What the regulation requires: Providers and deployers of high-risk systems intended to be used by public authorities must in any event take the necessary steps to comply with the requirements and obligations of the regulation by 2 August 2030.

Implementation guidance: Identify the affected legacy systems and prepare an implementation plan for 2 August 2030. Account for required changes, procurement procedures and coordination with providers.

Possible evidence: Implementation plan per legacy system with milestones up to 2030.