Role by tier: the articles that apply.

Art. 4

applies from 2 February 2025

Take measures to support AI literacy

Providers and deployers take measures to support the AI literacy of their staff and of other persons operating or using AI systems on their behalf. No required level, no direct fine.

What you would document

• Literacy measures record: type, content, date and participants

Art. 25

applies from 2 December 2027

Know when you become the provider

A deployer, importer or distributor becomes the provider when it puts its name on a high-risk system, substantially modifies it or changes its intended purpose so that it becomes high-risk.

What you would document

• Value-chain note: name on the system, substantial modification, change of intended purpose

Art. 26(1) to (6)

applies from 2 December 2027

Use the system per the instructions, assign human oversight, monitor and keep logs

Technical and organisational measures per the instructions for use; oversight by competent, trained persons; relevant input data; monitoring; logs kept at least six months.

What you would document

• Deployment record: instructions, named oversight persons with their competence, input-data relevance statement, monitoring, logs kept at least six months

Art. 26(7)

applies from 2 December 2027

Inform workers' representatives and affected workers before use at the workplace

Before putting a high-risk system into service or using it at the workplace, employers inform workers' representatives and the affected workers.

What you would document

• Worker information notice with date and recipients

Art. 26(11)

applies from 2 December 2027

Inform natural persons subject to decisions taken or assisted by the system

Deployers inform natural persons that they are subject to the use of a high-risk system that takes or assists decisions about them.

What you would document

• Affected-persons notice

Art. 27

applies from 2 December 2027

Carry out a fundamental rights impact assessment

Before first use: processes, period and frequency, categories of affected persons, specific risks, human oversight measures, remedies; notified to the market surveillance authority.

Where the deployer is a body governed by public law, a private operator providing public services, or deploys a system for creditworthiness or credit scoring or for life and health insurance risk assessment and pricing (Annex III, point 5(b) and (c)).

What you would document

• FRIA record (Art. 27(1)(a) to (f)), notified to the market surveillance authority

Art. 86

applies from 2 December 2027

Provide a clear and meaningful explanation on request

Persons subject to a decision taken on the basis of an Annex III system that produces legal or similarly significant effects may obtain an explanation of the role of the system and the main elements of the decision.

What you would document

• Explanation procedure for individual decisions