EU AI Act Compliance Checker | Embed

In scope

Your system is in scope of the EU AI Act according to Article 2.

Handover obligations

If a deployer, distributer, or importer makes a 'substantial modification' (see Article 3 point 23) to your system, they will be considered a 'provider' of that system under Article 25. The original provider will not longer be considered a provider of that particular system.

However, the original provider will have obligations to provide the new provider with:

• Technical documentation.
• Information about the capabilities of the AI system.
• Technical access.
• Assistance to help the new provider fulfil their obligations under the Act.

Provider obligations

As a provider of a high-risk AI system, you must comply with the obligations listed under Article 16.

Deployer obligations

As a deployer of a high-risk AI system, you must comply with Article 26 obligations.

These include:

• Taking appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions of use accompanying the systems.
• Monitoring the operation of the system on the basis of the instructions of use and when relevant, informing providers in accordance.
• Prior to installing or using the system within the workplace, consulting workers representatives with a view to reaching an agreement in accordance with Directive 2002/14/EC and informing the affected employees that they will be subject to the system.
• Cooperating with the relevant national competent authorities on any action those authorities take in relation with the high-risk system in order to implement the Regulation.

To the extent that you exercise control over the system, you must:

• Implement human oversight, ensuring that the person or persons assigned to ensure this oversight are competent, properly qualified and trained, and have the necessary resources in order to ensure effective supervision.
• Ensure that relevant and appropriate robustness and cybersecurity measures are regularly monitored for effectiveness and are regularly adjusted or updated.
• Ensure that input data is relevant and sufficiently representative in view of the intended purpose of the high-risk AI system.
• Keep logs automatically generated by the system for at least six months.

Where the system makes decisions or assists in decision-making related to people (such as in hiring or education), you must inform those people:

• That they are subject to the use of the high-risk AI system.
• Of the system's intended purpose and the type of decisions it makes.
• About their right to an explanation.

If you believe that using the AI system according to its instructions might harm the health, safety, or rights of any person, you must:

• Without undue delay, inform the provider or distributor and relevant national supervisory authorities.
• Suspend the use of the system.

If you have identified any serious incident or any malfunctioning, you must:

• Interrupt the use of the AI system.
• Immediately inform first the provider, and then the importer or distributor and relevant national supervisory authorities.

Distributor obligations

As a distributor, you must comply with Article 24 obligations.

These include:

• Before distributing a high-risk AI system, verifying it has the required CE conformity marking, documentation, and instructions for use, and that the provider and importer have fulfilled their obligations.
• Not distributing non-compliant high-risk AI systems. If a system poses a risk, you must inform the provider, importer, and national competent authority of that.
• Ensuring storage and transport conditions do not jeopardise compliance of high-risk AI systems.
• If a distributed high-risk AI system is found to be non-compliant, to take corrective actions and report the non-compliant systems to the provider or importer, as well as national competent authorities.
• Providing the national competent authority with all necessary information and documentation to demonstrate a high-risk system's conformity, upon request.
• Cooperating with national competent authorities on actions to reduce and mitigate risks of high-risk AI systems.

Importer obligations

As an importer, you must comply with Article 23 obligations.

These include:

• Indicating your business name and address on the system or documentation.
• Ensuring proper storage and transport to maintain compliance.
• Providing authorities, upon a reasoned request, the necessary information and documentation to demonstrate conformity, including access to system logs.
• Cooperating with authorities on actions to reduce and mitigate system risks.
• If you are importing an AI system that is considered high-risk under Article 6, ensuring that the system conforms to the regulation by verifying that the provider conducted the proper conformity assessment, drew up the technical documentation, affixed the conformity marking, and included documentation and instructions.

If you believe a system is non-conforming or counterfeit, you:

• Cannot place it on the market until it conforms.
• Must inform the provider and authorities of risks.

Authorised representative obligations

As an authorised representative appointed by an AI system provider via a written mandate, you must comply with Article 22 obligations.

This includes:

• Being based in the EU.
• Performing mandated tasks.
• Providing a copy of the mandate to market surveillance authorities upon request.
• Being mandated to communicate with authorities on behalf of the provider on compliance issues.

However, if you consider or have reason to consider that the provider is acting contrary to its obligations under the AI Act, you must immediately inform:

• The national supervisory authority of the Member State in which you are established.
• The relevant notified body, where applicable.

High-risk obligations

Under Article 6, high-risk obligations apply to systems that are considered a 'safety component' of the kind listed in Annex I Section A, and to systems that are considered a 'High-risk AI system' under Annex III.

You need to follow these obligations for high-risk systems:

• Establish and implement risk management processes according to Article 9.
• Use high-quality training, validation and testing data according to Article 10.
• Establish documentation and design logging features according to Article 11 and Article 12.
• Ensure an appropriate level of transparency and provide information to users according to Article 13.
• Ensure human oversight measures are built into the system and/or implemented by users according to Article 14.
• Ensure robustness, accuracy and cybersecurity according to Article 15.
• Set up a quality management system according to Article 17.

General Purpose AI model obligations

You need to follow these obligations for General Purpose AI models under Article 53. In summary, you must:

Transparency obligations: Natural persons

You need to follow these transparency obligations under Article 50:

• The AI system, the provider or the user must inform any person exposed to the system in a timely, clear manner when interacting with an AI system, unless obvious from context.
• Where appropriate and relevant include information on which functions are AI enabled, if there is human oversight, who is responsible for decision-making, and what the rights to object and seek redress are.

Transparency obligations: Emotion & biometric

You need to follow these transparency obligations under Article 50:

• Obtain user consent before processing biometric and other personal data, unless authorised by law for criminal offences.

Transparency obligations: Synthetic content

You need to follow these transparency obligations under Article 50:

• Ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated.

This does not apply to content authorised by law.

Transparency obligations: Deep fakes

You need to follow these transparency obligations under Article 50:

• Disclose that the content has been artificially generated or manipulated.
• Disclose, whenever possible, the name of the natural or legal person that generated or manipulated the content.
• Label the content as inauthentic.
• Information must be provided at first interaction or exposure and be accessible to vulnerable persons.

This does not apply to content authorised by law or necessary for freedom of expression and arts and sciences.

No obligations

The EU AI Act likely imposes no legal obligations on your AI system. The European Commission may publish a voluntary code of conduct in future that you may be asked to comply with on a voluntary basis. See Article 95 on Codes of Conduct.