Version 1.1.2 · Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 · Legal information only. Not legal advice.
| Obligation | Legal basis | Deadline |
|---|
| Review and document the system design after identifying a prohibited practice | 5 | Immediate |
| Ensure the system meets all high-risk requirements of Articles 8-15 | 8, 9, 10, 11, 12, 13, 14, 15, 16 | 2 December 2027 (Annex III systems) / 2 August 2028 (Annex I-embedded systems) |
| Put a quality management system in place covering design, testing and compliance | 17 | 2 December 2027 (Annex III systems) / 2 August 2028 (Annex I-embedded systems) |
| Draw up Annex IV technical documentation before market placement | 11, 16 | 2 December 2027 (Annex III systems) / 2 August 2028 (Annex I-embedded systems) |
| Enable automatic logging and keep logs while the system is under your control | 12, 16 | 2 December 2027 (Annex III systems) / 2 August 2028 (Annex I-embedded systems) |
| Carry out a conformity assessment before placing the system on the market | 43 | Before market placement |
| Register the system in the EU database before market placement | 49, 71 | Before market placement |
| Take corrective action and inform authorities and the supply chain when a system is non-conforming | 16, 20 | Ongoing |
| Affix the CE marking to the system | 48, 49 | Before market placement |
| Draw up and sign an EU Declaration of Conformity (Annex V) | 47 | Before market placement |
| Providers outside the EU: appoint an EU authorised representative | 22 | Before market placement |
| Cooperate with competent authorities | 21 | Ongoing |
| Run a documented post-market monitoring system and analyse its data | 72, 73 | 2 August 2026 (in force); system-level duties from 2 December 2027 (Annex III systems) / 2 August 2028 (Annex I-embedded systems) |
| Inform persons interacting with AI (chatbot disclosure) | 50 | 2 August 2026 |
| Machine-readable marking of AI-generated content | 50 | 2 August 2026 |
| Document why your Annex III system qualifies for the Article 6(3) exemption | 6 | Before market placement |
| Register system in EU database before market placement | 49 | Before market placement |
| Provide documentation to NCA on request | 6 | Ongoing |
| Indicate name, trade name and contact address on the system | 16 | 2 December 2027 (Annex III systems) / 2 August 2028 (Annex I-embedded systems) |
| Ensure the system complies with accessibility requirements | 16 | 2 December 2027 (Annex III systems) / 2 August 2028 (Annex I-embedded systems) |
| Classify an Annex I Section B product AI system as high-risk under Article 6(1) | 6 | Before placing on the market or putting into service |
| Comply with the reduced article set for Section B products (Art 2(2)): Arts 60a, 102-112 only | 2, 6, 60, 102 | Follows the underlying product legislation |
| Obligation | Legal basis | Deadline |
|---|
| Use system in accordance with instructions of use | 26, 13 | 2 December 2027 (Annex III systems) / 2 August 2028 (Annex I-embedded systems) |
| Assign qualified human oversight personnel | 26, 14 | 2 December 2027 (Annex III systems) / 2 August 2028 (Annex I-embedded systems) |
| Ensure input data under your control is relevant and representative | 26 | 2 December 2027 (Annex III systems) / 2 August 2028 (Annex I-embedded systems) |
| Monitor the system in operation and report serious incidents and malfunctions | 26, 73 | Ongoing |
| Keep the system's automatic logs for at least 6 months | 26 | 2 December 2027 (Annex III systems) / 2 August 2028 (Annex I-embedded systems) |
| Inform workers and representatives before deployment | 26 | Before deployment |
| Carry out a data protection impact assessment where required (GDPR/LED) | 26 | Before deployment |
| Cooperate with competent authorities | 26 | Ongoing |
| Inform persons subject to emotion recognition/biometric categorisation | 50 | 2 August 2026 |
| Disclose AI-generated/manipulated content (deepfakes) | 50 | 2 August 2026 |
| Perform a fundamental rights impact assessment (FRIA) | 27 | Before first use |
| Describe processes where system will be used | 27 | Before first deployment |
| Describe period and frequency of use | 27 | Before first deployment |
| Identify categories of persons likely to be affected | 27 | Before first deployment |
| Describe specific risks of harm to identified categories | 27 | Before first deployment |
| Describe human oversight measures | 27, 26 | Before first deployment |
| Describe measures for risk materialisation, including governance and complaint mechanisms | 27 | Before first deployment |
| Notify the market surveillance authority of the FRIA results | 27 | Once the FRIA is performed (the FRIA itself is due before first use) |
| Inform natural persons subject to the system | 26 | 2 December 2027 (Annex III systems) / 2 August 2028 (Annex I-embedded systems) |