Providers and deployers take measures to support the AI literacy of their staff and of other persons operating or using AI systems on their behalf. No required level, no direct fine.

Take measures to support AI literacy

Manipulative or exploitative techniques, social scoring, predictive policing on profiling alone, facial-image scraping, emotion recognition at work and in education, sensitive biometric categorisation and real-time remote biometric identification for law enforcement outside the exceptions.

Do not place on the market, put into service or use a prohibited practice

Inserted by Regulation (EU) 2026/1744. Systems that generate or facilitate such content are prohibited from 2 December 2026.

New prohibitions: non-consensual intimate deep fakes and child sexual abuse material

A continuous, iterative process over the system's lifecycle: identify and analyse known and reasonably foreseeable risks, evaluate them, adopt targeted measures and test them.

Establish and maintain a risk management system

Data sets meet the quality criteria of Art. 10(2) to (5): design choices, collection, preparation, assumptions, bias examination and gaps are documented.

Apply data governance to training, validation and testing data

Documentation that demonstrates compliance with Section 2 and gives authorities what they need to assess it. SMEs may use the simplified form of Art. 11(1).

Draw up the technical documentation before placing on the market

The system technically allows the automatic recording of events over its lifetime, for traceability and post-market monitoring.

Enable automatic recording of events (logs)

Operation is sufficiently transparent for deployers to interpret the output; instructions cover identity, characteristics, limitations, oversight measures and expected lifetime.

Provide transparent information and instructions for use to deployers

Human-machine interface tools let natural persons oversee the system, understand its limits, decide not to use it, override or stop it.

Design for effective human oversight

Appropriate levels of accuracy, robustness and cybersecurity, performed consistently throughout the lifecycle, with metrics declared in the instructions.

Ensure accuracy, robustness and cybersecurity

Documented policies, procedures and instructions covering compliance strategy, design, data, testing, risk management, post-market monitoring and incident reporting.

Put a quality management system in place

Run the conformity assessment procedure, draw up the EU declaration of conformity and affix the CE marking before placing on the market.

Conformity assessment, EU declaration of conformity and CE marking

Providers of Annex III high-risk systems register themselves and the system in the EU database of Art. 71.

Register the system in the EU database before placing on the market

A documented plan that collects and reviews experience from the use of high-risk systems to evaluate continuous compliance.

Operate a post-market monitoring system

Immediately after establishing a causal link, and no later than 15 days; 10 days after a death; 2 days for widespread infringement or critical-infrastructure incidents.

Report serious incidents to the market surveillance authority

Verify the declaration of conformity and technical documentation, keep them for ten years, cooperate with the authorities and terminate the mandate if the provider acts contrary to the Act.

Act under the written mandate of a provider established outside the Union

Check that the conformity assessment was carried out, the technical documentation exists, the CE marking is affixed and an authorised representative is appointed; indicate name and address.

Verify conformity before placing a high-risk system on the market

Do not make a non-conforming system available; ensure storage and transport conditions do not jeopardise compliance; inform provider or importer and the authorities.

Verify CE marking, declaration of conformity and instructions before making available

A deployer, importer or distributor becomes the provider when it puts its name on a high-risk system, substantially modifies it or changes its intended purpose so that it becomes high-risk.

Know when you become the provider

Technical and organisational measures per the instructions for use; oversight by competent, trained persons; relevant input data; monitoring; logs kept at least six months.

Use the system per the instructions, assign human oversight, monitor and keep logs

Before putting a high-risk system into service or using it at the workplace, employers inform workers' representatives and the affected workers.

Inform workers' representatives and affected workers before use at the workplace

Deployers inform natural persons that they are subject to the use of a high-risk system that takes or assists decisions about them.

Inform natural persons subject to decisions taken or assisted by the system

Before first use: processes, period and frequency, categories of affected persons, specific risks, human oversight measures, remedies; notified to the market surveillance authority.

Carry out a fundamental rights impact assessment

Persons subject to a decision taken on the basis of an Annex III system that produces legal or similarly significant effects may obtain an explanation of the role of the system and the main elements of the decision.

Provide a clear and meaningful explanation on request

A provider that considers an Annex III system not high-risk documents the assessment before placing it on the market and registers the system in the EU database.

Document the Art. 6(3) assessment and register the system

Systems intended to interact directly with natural persons are designed so that the persons are informed, unless this is obvious from the point of view of a reasonably well-informed person.

Inform persons that they are interacting with an AI system

Outputs are marked and detectable as artificially generated or manipulated; the technical solution is effective, interoperable, robust and reliable as far as technically feasible.

Mark synthetic audio, image, video or text output in a machine-readable format

Deployers inform the natural persons exposed to the operation of the system and process personal data in line with the GDPR.

Inform persons exposed to emotion recognition or biometric categorisation

Deployers disclose that the content has been artificially generated or manipulated; lighter disclosure where the work is evidently artistic, creative, satirical or fictional.

Disclose that image, audio or video content is a deep fake

Deployers disclose that the text was artificially generated or manipulated, unless it underwent human review or editorial control and a person holds editorial responsibility.

Disclose AI-generated text published to inform the public on matters of public interest

Providers of general-purpose AI models keep model documentation up to date, inform downstream providers, put a copyright policy in place and publish a summary of the training content.

Technical documentation, downstream information, copyright policy and training-content summary

Model evaluation with adversarial testing, assessment and mitigation of systemic risks, serious-incident reporting to the AI Office and an adequate level of cybersecurity.

Classify one AI system. No account, no email.

Which roles does your organisation have for this system?