EU AI Act Compliance

Start every record with the AI asset, intended purpose, EU market or use facts, operator role, and risk classification. The AI Act separates high-risk AI system duties from GPAI model duties and from transparency duties for certain AI systems, so the register should not collapse those categories into one generic control.

For high-risk AI systems, keep a role column for provider, authorised representative, importer, distributor, deployer, product manufacturer, and any third party supplying tools, services, components, or processes for integration. Article 25 can move provider obligations to a distributor, importer, deployer, or other third party when they rebrand the system, substantially modify it, or change the intended purpose so that it becomes high-risk.

For high-risk AI systems, the provider evidence file should demonstrate the Section 2 requirements: risk management, data governance, technical documentation, record-keeping, deployer-facing information, human oversight, accuracy, robustness, and cybersecurity. These are product and lifecycle controls, not only policy statements.

A deployer file should prove that the system is used according to the provider's instructions, that oversight is assigned to people with competence, training, authority, and support, and that monitoring feeds provider and authority escalation when risk or a serious incident appears.

Article 43 makes conformity assessment route selection a release gate for high-risk AI systems. Some Annex III point 1 systems can use internal control when harmonised standards or common specifications are fully applied; otherwise the notified-body route in Annex VII is used. Annex III points 2 to 8 use internal control unless the Regulation is amended to require notified-body involvement.

High-risk AI systems covered by Union harmonisation legislation listed in Annex I, Section A follow the conformity assessment procedure under that sector law, while the AI Act Section 2 requirements become part of that assessment. A new conformity assessment is required after a substantial modification to a high-risk AI system.

Article 11 requires technical documentation before a high-risk AI system is placed on the market or put into service and requires it to be kept up to date. Annex IV turns that into a concrete file: system description, development process, data, architecture, oversight, validation, cybersecurity, risk management, standards, declaration of conformity, and post-market monitoring.

The documentation should be versioned with the system. It must be clear enough for national competent authorities and notified bodies to assess compliance, and it should also support internal release decisions, incident investigations, and customer assurance.

A fundamental rights impact assessment is not required for every deployment. Article 27 applies before deployment to deployers that are bodies governed by public law, private entities providing public services, and deployers of high-risk AI systems referred to in Annex III points 5(b) and 5(c), except high-risk systems intended for the area listed in Annex III point 2. The assessment covers the deployer process, use period and frequency, affected people and groups, specific risks, human oversight, and measures for risk materialisation, including governance and complaint mechanisms.

Article 50 transparency controls should be tracked separately from high-risk status. They cover direct interaction with natural persons, marking synthetic audio, image, video, or text outputs where applicable, notices for emotion recognition or biometric categorisation, deepfake disclosures, and disclosure for AI-generated public-interest text unless a stated exception applies.

GPAI model provider duties are another separate track. Article 53 requires model technical documentation, downstream information, a copyright policy, and a public summary of training content. Systemic-risk GPAI duties add model evaluation, adversarial testing, systemic-risk assessment and mitigation, serious-incident tracking and reporting, and cybersecurity protection.

Post-market monitoring is a provider duty for high-risk AI systems. Article 72 requires a documented system that actively and systematically collects, documents, and analyses performance data throughout the system lifetime so the provider can evaluate continuing compliance with the high-risk requirements.

Incident evidence should connect deployer monitoring, provider investigation, market surveillance reporting, and corrective action. Article 73 requires providers of high-risk AI systems placed on the Union market to report serious incidents to the market surveillance authority of the Member State where the incident occurred, with shorter maximum reporting periods for widespread infringements, certain serious incidents, and deaths.