AI Act: Regulation (EU) 2024/1689

• Article 16 · Role: provider

  Meet the provider obligations for high-risk AI systems.

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 9 · Role: provider

  Establish and maintain a risk management system.

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 10 · Role: provider

  Apply data and data governance requirements to training, validation and testing data.

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 11 · Role: provider

  Draw up and keep technical documentation.

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 12 · Role: provider

  Enable automatic recording of events (logging).

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 17 · Role: provider

  Operate a quality management system.

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 43 · Role: provider

  Carry out the applicable conformity assessment before placing on the market.

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 72 · Role: provider

  Run post-market monitoring of the system in use.

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 73 · Role: provider

  Report serious incidents to the market surveillance authority.

  Deadline: Serious incident: not later than 15 days after awareness (Art. 73(2)); not later than 2 days for a widespread infringement or a serious and irreversible disruption of critical infrastructure (Art. 73(3), Art. 3(49)(b)); not later than 10 days in the event of the death of a person (Art. 73(4)).

  Decision chain (JSON)

• Article 26 · Role: deployer

  Use the system in line with the instructions and assign human oversight.

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 27 · Role: deployer

  Carry out a fundamental rights impact assessment where required.

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 23 · Role: importer

  Verify conformity, documentation and marking before placing on the market.

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 24 · Role: distributor

  Verify marking and documentation before making available on the market.

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 53 · Role: gpai-provider

  Keep model documentation and a copyright policy for general-purpose AI models.

  Deadline: Applies since 2 August 2025; models placed on the market before that date must comply by 2 August 2027. Commission fines apply from 2 August 2026.

  Decision chain (JSON)

• Article 55 · Role: gpai-provider

  Meet the additional obligations for models with systemic risk.

  Deadline: Applies since 2 August 2025 for models with systemic risk; notify the Commission within two weeks of meeting the threshold (Art. 52(1)). Models placed on the market before that date must comply by 2 August 2027.

  Decision chain (JSON)

• Article 5 · Role: operator

  Do not place on the market, put into service or use AI systems for the prohibited practices in Article 5, including manipulative techniques, exploitation of vulnerabilities, social scoring, untargeted scraping of facial images, emotion recognition at work or in education, and biometric categorisation by sensitive traits.

  Deadline: Applies since 2 February 2025.

  Decision chain (JSON)

• Article 4 · Role: provider-or-deployer

  Take measures to ensure a sufficient level of AI literacy among staff and others operating or using AI systems on their behalf, taking account of their knowledge, experience, education and context of use.

  Deadline: Applies since 2 February 2025; amended wording applies from 27 July 2026. No dedicated fine in Article 99; enforcement follows national law.

  Decision chain (JSON)

• Article 50 · Role: provider

  Design AI systems that interact with natural persons so they are informed they are interacting with an AI system, and mark synthetic audio, image, video and text output in a machine-readable and detectable format.

  Deadline: Applies since 2 August 2026; providers of generative systems placed on the market before that date have until 2 December 2026 for the marking in Article 50(2).

  Decision chain (JSON)

• Article 50 · Role: deployer

  Inform natural persons exposed to an emotion recognition or biometric categorisation system, and disclose that deep fake content or AI-generated text published to inform the public on matters of public interest has been artificially generated or manipulated.

  Deadline: Applies since 2 August 2026, at the latest at the time of the first interaction or exposure.

  Decision chain (JSON)

• Article 54 · Role: gpai-provider

  Appoint, by written mandate, an authorised representative established in the Union before placing a general-purpose AI model on the Union market when established outside the Union.

  Deadline: Applies since 2 August 2025; models placed on the market before that date must comply by 2 August 2027. Commission fines apply from 2 August 2026.

  Decision chain (JSON)

• Article 13 · Role: provider

  Design high-risk AI systems to be sufficiently transparent and accompany them with instructions for use stating the provider's identity, the system's characteristics, capabilities, limitations and human oversight measures.

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 14 · Role: provider

  Design high-risk AI systems so that natural persons can effectively oversee them during use, including the ability to disregard, override or stop the system.

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 15 · Role: provider

  Design high-risk AI systems to achieve an appropriate level of accuracy, robustness and cybersecurity throughout their lifecycle, and declare accuracy metrics in the instructions for use.

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 18 · Role: provider

  Keep the technical documentation, quality management system documentation, notified body decisions and EU declaration of conformity at the disposal of national competent authorities.

  Deadline: Ten years after the system has been placed on the market or put into service. Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 19 · Role: provider

  Keep the logs automatically generated by the high-risk AI system, to the extent they are under the provider's control.

  Deadline: For a period appropriate to the intended purpose, of at least six months. Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 20 · Role: provider

  Immediately take corrective action to bring a non-conforming high-risk AI system into conformity, withdraw, disable or recall it, and inform distributors, deployers and the authorities of a risk.

  Deadline: Immediately on considering or having reason to consider non-conformity. Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 47 · Role: provider

  Draw up a written, machine-readable EU declaration of conformity for each high-risk AI system and keep it up to date.

  Deadline: Keep for ten years after placing on the market or putting into service. Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 48 · Role: provider

  Affix the CE marking visibly, legibly and indelibly to the high-risk AI system, or digitally for systems provided digitally.

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 49 · Role: provider

  Register the provider and the high-risk AI system listed in Annex III in the EU database before placing it on the market or putting it into service.

  Deadline: Before placing on the market or putting into service. Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 26(6) · Role: deployer

  Keep the logs automatically generated by the high-risk AI system, to the extent under the deployer's control, and inform workers' representatives and affected workers before putting the system into service at the workplace.

  Deadline: Logs for a period appropriate to the intended purpose, of at least six months. Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

• Article 86 · Role: deployer

  Provide affected persons, on request, with a clear and meaningful explanation of the role of the high-risk AI system in a decision that produces legal or similarly significant effects.

  Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).

  Decision chain (JSON)

Sanction: Administrative fine: prohibited practices up to EUR 35 million or 7 % of worldwide annual turnover; other obligations up to EUR 15 million or 3 %; incorrect information up to EUR 7.5 million or 1 %. For general-purpose AI models the Commission (AI Office) decides, up to EUR 15 million or 3 %.

Summary of the obligation in the register; the official language versions on EUR-Lex are authoritative. Source: NovaCopilot