Obligations and roles.
The EU AI Act assigns duties by role, not by company size. A provider places a system on the market; a deployer puts it into use; importers and distributors sit in between; and Article 25 can turn a deployer into a provider overnight. These pages set out what each role owes — technical documentation under Annex IV, the quality management system under Article 17, logging, human oversight under Article 14, serious incident reporting under Article 73 — and where the line between roles actually falls.
49 guides
AI Compliance
32 guidesSection overview
EU AI Act Compliance: The Obligation Stack for SMEs
Work the EU AI Act obligation stack in order: fix your role, classify each system, build the Article 9–15 file, pass Article 43, register, monitor.
- Accuracy, Robustness & Cybersecurity (Article 15)Article 15 demands declared accuracy metrics, resilience to faults, and cybersecurity against data poisoning and adversarial attacks. A guide.
- AI Compliance Officer Role: EU AI Act Obligations ExplainedEU AI Act creates obligations, not a job title. Who owns Art 9, 11, 14, 72, 73 duties — RACI structure, DPO/CISO split, and the small-company reality.
- AI Data-Governance Program: Article 10 in PracticeHow to implement Article 10 EU AI Act in practice: dataset provenance, bias assessment, the Art 10(5) exception, GDPR overlap, and Annex IV docs.
- AI Literacy Training Under Article 4: EU AI Act GuideEU AI Act Article 4 AI literacy has applied since 2 February 2025. Build a role-based training programme, gather evidence, and track your register.
- AI Value-Chain Roles Under the EU AI ActThe EU AI Act assigns obligations by role — provider, deployer, importer, distributor — and Article 25 can shift them. A map of who owes what.
- AI Vendor Assessment Framework: EU AI Act Deployer GuideEU AI Act deployer guide: verify Art 43 conformity, Annex IV docs, Art 47–49 and the Art 25 role-shift trap before deployment. Deadline: 2 Dec 2027.
- Article 13: Transparency and Instructions for Use ExplainedArticle 13 requires high-risk AI providers to make systems interpretable for deployers and ship instructions for use — distinct from Article 50.
- Article 20 EU AI Act: Corrective Actions and RecallEU AI Act Article 20 obliges providers to fix, withdraw, disable or recall a non-conforming high-risk system and inform the supply chain. From 2 Dec 2027.
- Article 21 EU AI Act: Cooperation With AuthoritiesEU AI Act Article 21: providers must hand over Annex IV docs and Article 12 logs on a reasoned request, in an EU language, to prove conformity.
- Authorised Representative Under the EU AI ActNon-EU providers of high-risk AI must appoint an EU authorised representative under Article 22; GPAI providers under Article 54. What they do, and when.
- Budgeting for EU AI Act Compliance: The Real Cost DriversBudget for EU AI Act compliance: Article 9, Annex IV technical documentation, Article 43 conformity assessment, Article 72 monitoring. Dec 2027.
- Building a Post-Market Monitoring Plan for High-Risk AIArticle 72 EU AI Act: providers of high-risk AI systems must document a post-market monitoring system. Deadline 2 Dec 2027. Fine up to €15M or 3%.
- Building an AI Quality Management System (Article 17)Article 17 requires providers of high-risk AI systems to document a QMS covering 12 elements. Deadline 2 December 2027. Fines up to €15M or 3% of turnover.
- CE Marking for High-Risk AI (EU AI Act, Art 48)CE marking under EU AI Act Article 48 signals a high-risk AI system's conformity. It is affixed after the conformity assessment and Declaration.
- Deployer Obligations Under the EU AI Act (Article 26)Article 26 EU AI Act: deployer duties for high-risk AI. Follow instructions, assign oversight, keep 6-month logs, notify workers. Deadline 2 Dec 2027.
- EU AI Act Distributor Obligations (Article 24)EU AI Act Article 24 distributor duties: verify CE marking, the declaration of conformity and instructions, preserve conformity, act on non-conformity.
- EU AI Act Record-Keeping & Logging (Article 12)Article 12 record-keeping for high-risk AI: systems must auto-log events for traceability. Providers build it in; deployers keep logs at least six months.
- EU Database Registration for High-Risk AI (Art 49)High-risk AI must be registered in the EU database under Article 49 before going to market. Who registers, the public and non-public sections, the data.
- EU Declaration of Conformity: Article 47 and Annex VThe EU declaration of conformity (Article 47, Annex V) is a provider's signed statement a high-risk AI system conforms. Kept 10 years; precedes CE mark.
- From Zero to EU AI Act Compliance: The Full RoadmapEU AI Act compliance roadmap: 8 phases from inventory to post-market monitoring. Correct deadlines — Art 5 live, Art 50 Aug 2026, Annex III Dec 2027.
- GPAI Model Obligations Under the EU AI ActEU AI Act GPAI obligations in force since Aug 2025: Art 53 baseline (Annex XI/XII, copyright), Art 55 systemic risk, Art 101 fines up to €15M or 3%.
- How to Build an Article 9 Risk Management SystemEU AI Act risk management system under Article 9: a continuous, iterative lifecycle process. Build your risk register, meet the 2 December 2027 deadline.
- How to Implement Human Oversight for High-Risk AI (Art 14)Article 14 requires high-risk AI to be designed for real human control: monitor outputs, override decisions, stop the system. Deadline 2 December 2027.
- Importer and Distributor Duties Under the EU AI ActEU AI Act Article 23 (importer) and Article 24 (distributor) duties: CE marking, conformity assessment, 10-year records. Deadline 2 December 2027.
- Open-Source AI Under the EU AI Act: The Two Carve-OutsOpen-source AI has two EU AI Act carve-outs: Article 2(12) for systems, Article 53(2) for GPAI models. Neither exempts high-risk or prohibited uses.
- Provider Obligations Under the EU AI Act: Full ChecklistEU AI Act Article 16 lists 13 provider obligations: QMS, Annex IV file, conformity assessment, DoC, CE marking, registration. Deadline 2 December 2027.
- Reporting Serious AI Incidents: Deadlines and ProcessArticle 73: high-risk AI providers must report serious incidents within 15 days, 10 for deaths, 2 for critical infrastructure. Deadlines and obligations.
- SaaS Provider Obligations Under the EU AI Act (Art 16)SaaS provider obligations under EU AI Act Art 16: risk management, technical file, Art 43 conformity, Art 47 DoC, Art 49 registration. Deadline 2 Dec 2027.
- Technical Documentation in Practice: Article 11 & Annex IVArticle 11 requires providers to draw up technical documentation before launch. Annex IV sets nine mandatory sections. Deadline: 2 December 2027.
- The Article 17 Quality Management System, in ContextThe Article 17 QMS is the spine tying together your Article 9 RMS, Annex IV docs and Article 43 conformity. ISO 42001 supports it but is not the same.
- Which Conformity-Assessment Route Applies? (Article 43)A decision walkthrough for Article 43: Annex VI self-assessment for most Annex III, Annex VII notified body for biometrics, sectoral route for products.
EU AI Act
7 guides- AI Literacy Training Requirements: EU AI Act Article 4What the EU AI Act requires for AI literacy: who is covered, the "sufficient level" standard, evidence to keep, and enforcement. In force since 2 February 2025.
- EU AI Act Audit Preparation: Evidence Checklist (2026)Prepare for an EU AI Act audit under Regulation (EU) 2024/1689: what authorities examine, the Article 74 evidence checklist, and penalties to €35M or 7%.
- EU AI Act Compliance for OpenAI API Use (2026)Using the OpenAI API does not make you a GPAI provider. Your role and use decide your obligations. High-risk Annex III duties bite from 2 December 2027.
- EU AI Act Conformity Assessment: The StepsRun EU AI Act conformity assessment on a high-risk AI system via the Annex VI internal-control route under Article 43 — six steps, owners, and a checklist.
- EU AI Act Gap Analysis: Control-by-Control MethodRun an EU AI Act gap analysis: scope systems, map obligations by role, rate each gap none/partial/missing, prioritise against the 2 December 2027 deadline.
- Provider vs Deployer: Who Carries Which AI Act Duties?EU AI Act provider vs deployer: role definitions, obligation comparison, the Article 25 role-shift, and a decision aid. High-risk deadline: 2 Dec 2027.
- Simplified Technical Documentation SME AI Act (2026)How SMEs use the simplified Annex IV form under Article 11(3) of the EU AI Act. Same evidence, leaner drafting, with high-risk rules from 2 December 2027.
AI BOM
1 guideSection overview
AI-BOM: What It Is and How It Supports EU AI Act Compliance
AI-BOM is an emerging practice, not a statutory term. Structures base models, datasets and GPAI dependencies to feed Article 11 / Annex IV docs.
AI Documentation
1 guideSection overview
AI Technical Documentation Under the EU AI Act
Article 11 EU AI Act: compile Annex IV technical documentation before market launch, 10-year retention under Article 18, deadline 2 December 2027.
AI Due Diligence Checklist
1 guideSection overview
AI Due Diligence Checklist (EU AI Act)
An AI due diligence checklist for buyers: triage a vendor or AI feature, map Annex III exposure, demand the right docs, and clear procurement before you sign.
AI Literacy Training Program
1 guideSection overview
Run an AI Literacy Training Programme (Art 4)
A practical operating plan for an Article 4 AI literacy programme: a role-tier curriculum, delivery channels, and a 12-month onboarding-and-refresh cadence.
Conformity Assessment
1 guideSection overview
EU AI Act Conformity Assessment: How It Works
EU AI Act conformity assessment: two Article 43 routes, Annex VI self-assessment vs Annex VII notified body, CE marking, and the 2 December 2027 deadline.
EU AI Database
1 guideSection overview
EU AI Database: What It Is and Who Must Register
EU AI database established under Article 71. Article 49 is the registration duty. Annex VIII data, public vs restricted sections, 2 December 2027 deadline.
Post Market Monitoring Plan
1 guideSection overview
Build a Post-Market Monitoring Plan (Article 72)
Build an EU AI Act Article 72 post-market monitoring plan: metrics, alert vs escalation thresholds, cadence, ownership, plus an outline table and example.
Classify, document and evidence — in one place
Confir turns Article 6 and Annex III into a decision you can defend, with the technical documentation and audit trail attached.
Start free trial →