EU AI Act obligations

The 54 operator duties the compliance engine scores against — each one with the article it comes from, the roles it binds, and the artifact that discharges it. These pages are derived from the engine’s own table rather than written alongside it, so they say exactly what the product would tell you.

Read against Regulation (EU) 2024/1689 as amended, consolidated text 02024R1689-20260727 (consolidation 001.001, incorporating Regulation (EU) 2026/1744).

1. criticalAnnex IV §3Annex IV §3 Training data / methodology
2. criticalAnnex IV §5Annex IV §5 Risk management measures
3. criticalAnnex IV §8Annex IV §8 Cybersecurity measures
4. criticalArt.10, Annex IV §3Data and data governance
5. criticalArt.11, Annex IVTechnical documentation
6. criticalArt.14Human oversight
7. criticalArt.15Accuracy, robustness and cybersecurity
8. criticalArt.16Obligations of providers of high-risk AI systems
9. criticalArt.17Quality management system
10. criticalArt.26Obligations of deployers of high-risk AI systems
11. criticalArt.26(5), Art.73Reporting serious incidents by deployers
12. criticalArt.27Fundamental rights impact assessment (FRIA) for deployers
13. criticalArt.5(1)(a)Prohibited: subliminal / manipulative techniques (material harm)
14. criticalArt.5(1)(b)Prohibited: exploitation of vulnerabilities
15. criticalArt.5(1)(c)Prohibited: social scoring — evaluating or classifying people over time by social behaviour or personal characteristics, where the score causes detrimental treatment in an unrelated context or is disproportionate. Binds private actors as well as public ones
16. criticalArt.5(1)(d)Prohibited: predicting the risk that a person will commit a criminal offence, based solely on profiling or on assessing personality traits — does not cover systems supporting a human assessment already grounded in objective, verifiable facts
17. criticalArt.5(1)(e)Prohibited: creating or expanding facial recognition databases by untargeted scraping of facial images from the internet or CCTV footage
18. criticalArt.5(1)(f)Prohibited: inferring emotions of a person in the workplace or in education institutions — except where the system is intended for medical or safety reasons
19. criticalArt.5(1)(g)Prohibited: biometric categorisation deducing race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation — does not cover labelling or filtering of lawfully acquired biometric datasets, or categorisation of biometric data in law enforcement
20. criticalArt.5(1)(h)Prohibited: real-time remote biometric identification in publicly accessible spaces for law enforcement — unless strictly necessary for one of the narrow listed objectives, and subject to the Art.5(2)-(4) authorisation regime
21. criticalArt.5(1)(bb), Art.5(1a)Prohibited: AI producing child sexual abuse material (from 2 Dec 2026). A deployer is caught only where they use the system for that purpose — Art.5(1a)(b)
22. criticalArt.5(1)(ba), Art.5(1a)Prohibited: AI generating or manipulating non-consensual intimate imagery of identifiable people (from 2 Dec 2026). A deployer is caught only where they use the system for that purpose — Art.5(1a)(b)
23. criticalArt.53Obligations for providers of general-purpose AI models
24. criticalArt.73Serious incident reporting
25. criticalArt.9, Annex IVRisk management system throughout the lifecycle
26. majorAnnex IV §1Annex IV §1 General description of the AI system
27. majorAnnex IV §2Annex IV §2 System architecture / logical interactions
28. majorAnnex IV §4Annex IV §4 Performance metrics / robustness
29. majorAnnex IV §6Annex IV §6 Lifecycle changes / versions
30. majorAnnex IV §9Annex IV §9 Operational design domain / context of use
31. majorArt.4a(1)Special-category data processed for bias detection in a high-risk system — strict necessity, pseudonymisation, access control, no onward transfer, deletion once corrected
32. majorArt.12Record-keeping / logging
33. majorArt.13Transparency and provision of information to deployers (high-risk)
34. majorArt.18Documentation keeping (provider retention, 10 years)
35. majorArt.19Automatically generated logs (provider retention)
36. majorArt.20Corrective actions and duty of information
37. majorArt.22Obligations of authorized representatives
38. majorArt.23Obligations of importers
39. majorArt.24Obligations of distributors
40. majorArt.25Responsibilities along the value chain
41. majorArt.26(5)Monitoring high-risk AI systems operated by deployers
42. majorArt.4Measures to support AI literacy among staff and operators (applies to ALL AI systems)
43. majorArt.43Conformity assessment — notified body involvement (high-risk)
44. majorArt.47EU declaration of conformity
45. majorArt.49, Art.71Registration of high-risk AI systems in the EU database — timing unsettled: Art.49 sits in Chapter III Section 5, which the Omnibus did NOT defer, but the Commission states the Annex III rules apply from 2 Dec 2027, and the database is not yet reachable
46. majorArt.49(3)EU database registration — deployer duties where applicable. Timing unsettled: Art.49 was not among the provisions the Omnibus deferred, yet the Commission states the Annex III rules apply from 2 Dec 2027 and the database is not yet reachable
47. majorArt.4a(2)Special-category data processed for bias detection outside the high-risk provider case — deployers of high-risk systems, and providers and deployers of other AI systems and models
48. majorArt.50Transparency: tell people they are dealing with AI, mark synthetic content, and disclose deepfakes and emotion recognition
49. majorArt.72Post-market monitoring
50. minorAnnex IV §7Annex IV §7 Standards / specifications applied
51. minorArt.21Cooperation with competent authorities
52. minorArt.40(2)Conformity presumed via harmonised standards — the Commission must now seek unified standards covering the AI Act and sectoral law together
53. minorArt.54Authorised representative of general-purpose AI model provider (third country)
54. minorArt.74Cooperation with market surveillance authorities