High-risk obligations, simply put

If you're the provider

1. 1
   Risk management (Art. 9): identify and reduce risks throughout the system's life, and test against them.
2. 2
   Data governance (Art. 10): use training and test data that is relevant, representative and as error-free as possible, and check it for bias.
3. 3
   Technical documentation (Art. 11, Annex IV): describe how the system works, how it was built and tested, and its limits.
4. 4
   Record-keeping (Art. 12): the system must log events automatically, so problems can be traced.
5. 5
   Transparency to deployers (Art. 13): give clear instructions for use, including accuracy and known limits.
6. 6
   Human oversight (Art. 14): design it so people can understand, monitor, override and stop it.
7. 7
   Accuracy, robustness and cybersecurity (Art. 15): perform consistently and resist errors and attacks.
8. 8
   Quality management system (Art. 17), conformity assessment (Art. 43), EU declaration of conformity, CE marking and registration in the EU database (Art. 49).
9. 9
   Post-market monitoring (Art. 72) and serious incident reporting (Art. 73).

If you're the deployer

1. 1
   Use the system according to the provider's instructions.
2. 2
   Assign human oversight to people with the competence, training and authority to do it.
3. 3
   Make sure input data you control is relevant for the purpose.
4. 4
   Monitor how it works and tell the provider (and in some cases the authority) about risks and serious incidents.
5. 5
   Keep the automatically generated logs for at least six months.
6. 6
   Tell workers and their representatives before using high-risk AI at work.
7. 7
   Tell people when a high-risk system makes or helps make decisions about them.
8. 8
   Do a fundamental rights impact assessment first if you're a public body, a private company providing public services, or you use AI for credit scoring or life and health insurance pricing (Art. 27).

When

Annex III systems: 2 December 2027. Annex I products: 2 August 2028.