Explainer

EU AI Act high-risk obligations by role

Written with AI from the sources below and checked against our facts sheet. Last checked 7 Nov 2026. How this site is made · Spot an error?

Part of: EU AI Act

The EU AI Act puts most high-risk duties on providers. They must meet the requirements in Arts. 9 to 15, run a quality management system, pass a conformity assessment and monitor the system after launch. Deployers must use it as instructed, assign human oversight, keep logs and inform people. Importers, distributors and authorized representatives run checks. Annex III duties apply from 2 December 2027, Annex I from 2 August 2028.

In short

Providers carry the most: Arts. 9 to 15 requirements, QMS, conformity assessment, CE marking, registration, monitoring and incident reports (Art. 16).
Deployers use the system as instructed, assign human oversight, check input data, monitor, keep logs six months and inform workers and people (Art. 26). Some also owe a FRIA (Art. 27).
Importers, distributors and authorized representatives verify conformity before a system moves on (Arts. 22 to 24).
Rebranding, substantially modifying or repurposing a system into high-risk makes you its provider (Art. 25).
After the 2026 Omnibus, Annex III duties apply from 2 Dec 2027 and Annex I duties from 2 Aug 2028.

Which AI systems are high-risk?

An AI system is high-risk through one of two doors in Art. 6. Door one covers AI that is a safety component of a product, or is itself a product, under the EU laws in Annex I. That product must also need third-party conformity assessment, as with medical devices or lifts. Door two covers AI used in one of the eight Annex III areas, such as hiring, credit scoring, education or access to public benefits.

Art. 6(3) offers one narrow exit for Annex III systems that only perform narrow procedural or preparatory tasks. A system that profiles people is always high-risk. See high-risk AI system and high-risk vs prohibited AI.

When do the high-risk obligations apply?

The 2026 Digital Omnibus fixed new dates in Art. 113.

Systems	Obligations apply from
Annex III high-risk systems	2 December 2027 (originally 2 August 2026)
Annex I high-risk systems (AI in regulated products)	2 August 2028 (originally 2 August 2027)
Systems already on the market before those dates	Only after significant design changes
Legacy systems used by public authorities	Must comply by 2 August 2030

AI literacy (Art. 4) has applied to all AI systems since 2 February 2025. Art. 50 transparency applied from 2 August 2026, whatever the risk tier.

What must providers of high-risk AI do?

The provider develops the system, or has it developed, and places it on the market or puts it into service under its own name. Art. 16 lists its duties.

Duty	Article	In brief
Risk management system	Art. 9	A continuous process covering intended use and reasonably foreseeable misuse
Data and data governance	Art. 10	Relevant, representative data, examined for bias, with documented origin
Technical documentation	Art. 11, Annex IV	Drawn up before launch; simplified forms for SMEs and small mid-caps
Record-keeping	Art. 12	Automatic logging of events over the system's lifetime
Instructions for use	Art. 13	Purpose, accuracy and metrics, limits, oversight measures
Human oversight by design	Art. 14	People can understand, override and stop the system
Accuracy, robustness, cybersecurity	Art. 15	Consistent performance; resilience to poisoning and adversarial attacks
Quality management system	Art. 17	Written policies and procedures, proportionate to size
Keep documentation	Art. 18	10 years after market placement
Keep logs	Art. 19	At least six months, where under the provider's control
Corrective action	Art. 20	Fix, disable, withdraw or recall, and inform others
Conformity assessment	Art. 43	Before launch; internal control for most Annex III systems
Declaration and CE marking	Arts. 47 and 48	Sign the EU declaration of conformity; affix the CE mark
Registration	Art. 49	Annex III systems go in the EU database before launch
Post-market monitoring	Art. 72	Actively collect performance data for the system's whole life
Serious incident reporting	Art. 73	15 days, 10 if a person dies, 2 for widespread or critical-infrastructure cases

For biometric systems in Annex III point 1, a notified body is involved unless the provider fully applied harmonized standards or common specifications. Annex I products follow their own sector law's procedure. Providers based outside the EU must appoint an authorized representative in the EU (Art. 22).

What must deployers of high-risk AI do?

A deployer uses an AI system under its own authority in a professional context. Art. 26 sets its duties:

Use the system according to the provider's instructions for use (Art. 26(1)).
Assign human oversight to people with the competence, training, authority and support to do it (Art. 26(2)).
Make sure input data under its control is relevant and sufficiently representative (Art. 26(4)).
Monitor operation. If it has reason to believe the system presents a risk, inform the provider and the authority and suspend use (Art. 26(5)).
Report a serious incident immediately, first to the provider (Art. 26(5)).
Keep automatically generated logs under its control for at least six months (Art. 26(6)).
As an employer, inform workers' representatives and affected workers before workplace use (Art. 26(7)).
If a public authority, register its use and avoid unregistered systems (Arts. 26(8) and 49(3)).
Use the provider's information to carry out a GDPR DPIA where one is needed (Art. 26(9)).
Tell people when an Annex III system makes or helps make decisions about them (Art. 26(11)).

Three more duties sit outside Art. 26. Public bodies, private providers of public services, credit scorers and life or health insurers must complete a fundamental rights impact assessment before first use (Art. 27). Since the Omnibus, it may reuse DPIA content; see FRIA vs DPIA. People affected by a deployer's decision based on an Annex III system can ask for an explanation (Art. 86). And all deployers must support their staff's AI literacy (Art. 4).

What do importers, distributors and authorized representatives do?

These roles check the paperwork as a system moves through the supply chain.

Role	Who	Core duties
Authorized representative (Art. 22)	EU-based entity with a written mandate from a non-EU provider	Verify the declaration and documentation exist; keep them for authorities for 10 years; cooperate; end the mandate if the provider breaks the rules
Importer (Art. 23)	EU-based entity placing a non-EU provider's system on the EU market	Verify conformity assessment, documentation, CE mark, declaration and authorized representative; add its own name and address; never place a nonconforming system
Distributor (Art. 24)	Anyone else making the system available	Verify the CE mark, declaration and instructions; do not supply nonconforming systems; take or ensure corrective action

When does a deployer or distributor become the provider?

Under Art. 25(1), a distributor, importer, deployer or other third party becomes the provider of a high-risk system if it:

puts its own name or trademark on a high-risk system already on the market, unless a contract allocates the duties otherwise;
makes a substantial modification so the system remains high-risk; or
changes the intended purpose of a system, including a general-purpose AI system, so that it becomes high-risk.

The original provider then stops being the provider of that system but must cooperate. Since the Omnibus, Art. 25(2) lists what it supplies: technical documentation, known limitations and failure modes, and targeted technical access. That duty does not apply if it clearly said the system must not be turned into a high-risk one. See provider vs deployer.

What are the penalties for breaching high-risk obligations?

Under Art. 99(4), breaching provider, authorized representative, importer, distributor or deployer duties can cost up to €15 million or 3% of worldwide annual turnover. The higher figure applies. The Omnibus added Art. 25(2) and (4) breaches to this tier. Misleading information to authorities or notified bodies can cost up to €7.5 million or 1% (Art. 99(5)).

SMEs, including start-ups, face the lower figure (Art. 99(6)). Since the Omnibus, small mid-caps also face the lower figure for these two tiers (Art. 99(6a)).

How does the AIGP exam test high-risk obligations?

Match the duty to the role. Conformity assessment, CE marking, the declaration and registration are provider duties. The FRIA is a deployer duty.
Watch the role flip. Rebranding, substantial modification or repurposing into high-risk makes you the provider.
Six months and 10 years. Logs are kept at least six months; documentation 10 years.
Human oversight is not an exit. A human in the loop does not take a system out of high-risk.
Mind the date version. Annex III duties start on 2 December 2027 as amended, not 2 August 2026.

Practice the requirements in lesson II.C.4, the provider path in lesson II.C.5, deployer duties in lesson II.C.6 and the roles matrix in lesson II.C.7. For incident steps, see AI incident response.

Change log

7 Nov 2026: Page published, reflecting Regulation (EU) 2026/1744.

Frequently asked questions

What are the obligations of deployers of high-risk AI systems?

Under Art. 26, deployers must use the system according to the instructions for use and assign trained, competent human oversight. They must check that input data they control is relevant and representative, and monitor operation. They report risks and serious incidents, keep logs for at least six months, and inform workers and affected people. Some deployers must also complete a FRIA under Art. 27.

Do deployers need to do a conformity assessment?

No. Conformity assessment, the EU declaration of conformity and CE marking are provider duties (Arts. 16, 43, 47 and 48). A deployer takes them on only if it becomes the provider under Art. 25. That happens if it rebrands the system, substantially modifies it or repurposes a system into high-risk.

How long must high-risk AI logs be kept?

At least six months, for both providers (Art. 19) and deployers (Art. 26(6)), for logs under their control. Other EU or national law, such as data protection or sector rules, can change that period. Providers must also keep technical documentation and the declaration of conformity for 10 years after the system is placed on the market (Art. 18).

When do EU AI Act high-risk obligations apply?

After the 2026 Digital Omnibus, from 2 December 2027 for Annex III systems such as hiring and credit scoring tools. AI in regulated products under Annex I follows from 2 August 2028. Systems already on the market are caught only if significantly changed, except those used by public authorities, which must comply by 2 August 2030.

Who registers a high-risk AI system in the EU database?

The provider, or its authorized representative, registers Annex III systems before placing them on the market (Art. 49(1)). Critical-infrastructure systems in Annex III point 2 are registered nationally instead. Deployers that are public authorities must also register their use (Art. 49(3)). Providers that rely on the Art. 6(3) exit still register the system (Art. 49(2)).

Sources

Spot an error? Tell us