Key Obligations for Providers (Articles 9-15)
Providers of high-risk AI systems must implement comprehensive compliance measures before placing their systems on the EU market:
- Article 9 — Risk Management System: Continuous, iterative risk management throughout the AI system's lifecycle
- Article 10 — Data Governance: Training, validation, and testing data must meet quality criteria including completeness, relevance, and representativeness
- Article 11 — Technical Documentation: Comprehensive documentation demonstrating compliance with all requirements
- Article 12 — Record-Keeping: Automatic logging capabilities enabling traceability of the system's functioning
- Article 13 — Transparency: Instructions for use that enable deployers to interpret the system's output appropriately
- Article 14 — Human Oversight: Design measures enabling effective oversight by humans during the system's operation
- Article 15 — Accuracy, Robustness, Cybersecurity: Appropriate levels of accuracy, robustness, and cybersecurity throughout the lifecycle
Conformity Assessment
Before placing a high-risk AI system on the market, providers must conduct a conformity assessment. Most high-risk systems can use self-assessment (internal conformity assessment under Annex VI). However, certain biometric systems and systems used by law enforcement require third-party assessment by a notified body (Annex VII).
Post-Market Monitoring
High-risk AI providers must establish a post-market monitoring system proportionate to the nature and risks of the AI system. This includes collecting and analyzing relevant data on the system's performance, reporting serious incidents, and taking corrective actions when necessary.