The world's first comprehensive AI law is now in its decisive phase: Article 50 transparency duties are already in force, and the core obligations for high-risk AI systems apply from December 2, 2027 following the Digital Omnibus deferral. This guide sets out who is in scope, what must be evidenced, and how AxiLayer AI's third-party readiness assessments turn those obligations into documentation that survives scrutiny.
The EU AI Act is extraterritorial by design. It binds providers who place AI systems on the EU market or put them into service there, deployers established in the EU, and, critically, providers and deployers located anywhere in the world when the output of their AI system is used in the EU. Importers, distributors, and authorized representatives carry their own duties.
Obligations scale with risk. A small set of practices, social scoring, exploitative manipulation, most real-time remote biometric identification in public spaces, is prohibited outright. High-risk systems, listed in Annex III (employment, credit, education, essential services, law enforcement, migration, justice) or embedded as safety components in regulated products under Annex I, carry the Act's full requirements. General-purpose AI models have their own transparency and, for systemic-risk models, evaluation regime. Everything else faces lighter transparency duties or none.
Deployers are not spectators: they owe fundamental-rights impact assessments in defined cases, oversight staffing, input-data controls, and log retention. Many compliance gaps begin with a deployer who assumed the provider had it covered.
The Act assigns duties by role, and one company can hold several roles at once. The last column shows what AxiLayer AI tests and evidences for each duty.
| Obligation | Provider | Deployer | Importer / Distributor | GPAI model provider | What AxiLayer AI delivers |
|---|---|---|---|---|---|
| Risk management systemArt. 9 | Provider | Risk file reviewed and controls tested | |||
| Data governanceArt. 10, 26(4) | Provider | Deployer | Dataset quality and bias examination | ||
| Technical documentationArt. 11, 53 | Provider | Importer / Distributor | GPAI model provider | Annex IV file built and checked | |
| Logging and log retentionArt. 12, 19, 26(6) | Provider | Deployer | Log coverage and retention tested | ||
| Instructions and information downstreamArt. 13, 53 | Provider | Importer / Distributor | GPAI model provider | Instructions for use reviewed | |
| Human oversightArt. 14, 26(2) | Provider | Deployer | Oversight tested as it works in practice | ||
| Accuracy, robustness, cybersecurityArt. 15, 55 | Provider | GPAI model provider | Accuracy, robustness and red-team testing | ||
| Quality management systemArt. 17 | Provider | QMS gap assessment | |||
| Conformity assessment and CE markingArt. 43, 48 | Provider | Importer / Distributor | Conformity file prepared for internal control or a notified body | ||
| EU database registrationArt. 49, 26(8) | Provider | Deployer | Registration data pack | ||
| Post-market monitoringArt. 72, 26(5) | Provider | Deployer | Continuous monitoring with AxiSentinel | ||
| Serious incident reportingArt. 73, 55 | Provider | Deployer | GPAI model provider | Incident evidence and reporting pack | |
| Fundamental rights impact assessmentArt. 27 | Deployer | FRIA prepared and evidenced | |||
| Transparency to peopleArt. 50 | Provider | Deployer | Disclosure and content labeling checks | ||
| AI literacy measuresArt. 4 | Provider | Deployer | Role-based AI literacy measures reviewed | ||
| Copyright policy and training content summaryArt. 53 | GPAI model provider | Training content summary reviewed |
Summary for orientation, not legal advice. Regulation text
New prohibitions and Article 50(2) marking for legacy systems
Legacy GPAI models comply; national sandboxes running
Annex III high-risk obligations apply
High-risk AI in regulated products
Dates under Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Official timeline
A readiness engagement is scoped to your portfolio and runs through four movements, each producing artifacts you keep.
Every AI system in the portfolio is classified against the Act's risk tiers, including the borderline cases where classification is genuinely contestable, with a written rationale you can show a market-surveillance authority. Extraterritorial exposure is mapped for non-EU entities.
Third-party, evidence-based testing of the high-risk requirements: we examine the risk-management file, sample the data-governance record, exercise the logging, and evaluate human-oversight measures as implemented, not as described.
Annex IV technical documentation, quality-management records, FRIA support for deployers, and the conformity-assessment file, assembled to the standard an examiner expects, with every claim traceable to a tested control.
Post-market monitoring is a standing legal duty, not a binder. Clients running AxiSentinel keep obligations, controls, and evidence synchronized as models retrain and harmonized standards land, continuously, between point-in-time assessments.
If a system is used for one of these purposes, it is presumed high-risk unless it meets a narrow Article 6(3) exception. Draft Commission guidelines on classification were published on 19 May 2026.
Remote biometric identification, biometric categorisation, emotion recognition
Safety components in digital infrastructure, road traffic, water, gas, heating and electricity
Admission, assessment of learning outcomes, monitoring of tests
Recruitment, promotion and termination, task allocation, worker monitoring
Public benefit eligibility, creditworthiness, life and health insurance pricing, emergency call triage
Risk assessment of individuals, evidence reliability, profiling in investigations
Risk assessment, examination of asylum, visa and residence applications
Assisting judicial decisions; influencing elections or voting behaviour
Sources: Annex III Draft classification guidelines
An AI system in the EU rarely answers to the AI Act alone. Our evidence base maps each control to these regimes at the same time.
Sources: CRA PLD Machinery Regulation MDCG 2025-6 Council of Europe
A scoping briefing maps your portfolio to the Act's risk tiers and tells you exactly what an examiner would ask for, before one does.
