EU AI Act Compliance Requirements

Providers of high-risk AI systems bear the primary responsibility under the EU AI Act. Before placing a system on the market, they must establish a risk management system (Article 9), ensure data quality (Article 10), create technical documentation per Article 11 and Annex IV, implement automatic logging (Article 12), meet transparency requirements (Article 13), enable human oversight (Article 14), and ensure accuracy, robustness and cybersecurity (Article 15). Additionally, providers must carry out a conformity assessment, affix the CE marking, issue an EU declaration of conformity and register the system in the EU database under Article 71. Non-compliance can result in fines of up to EUR 15 million or 3% of global annual turnover.

Deployers have independent obligations under Article 26 of the EU AI Act. They must use high-risk AI systems in accordance with the instructions for use, carefully select and verify the relevance of input data, monitor system operation and retain logs for at least six months. Anomalies or serious incidents must be reported to the provider and the competent authority. Before deployment, deployers must conduct a data protection impact assessment and, for certain systems, a fundamental rights impact assessment under Article 27. Important: anyone who substantially modifies a high-risk AI system or places it on the market under their own name becomes the provider and assumes all provider obligations.

The conformity assessment under Article 43 of the EU AI Act is mandatory for all high-risk AI systems before they are placed on the market. For most systems listed in Annex III, an internal conformity assessment by the provider is sufficient, systematically documenting compliance with all requirements under Articles 9–15. For certain biometric systems and critical infrastructure AI, assessment by a notified body is required. After successful assessment, the provider issues an EU declaration of conformity under Article 47, affixes the CE marking under Article 48 and registers the system in the EU database under Article 71. The conformity assessment must be repeated when substantial modifications are made to the system.

Article 9 requires a continuous risk management system covering the entire lifecycle of the high-risk AI system. It must identify and analyze known and foreseeable risks that may arise during intended use and reasonably foreseeable misuse. Based on this analysis, appropriate risk mitigation measures must be developed and implemented. The system must be regularly reviewed and updated. Critically, the risk assessment must also consider impacts on fundamental rights. Test results must be documented and retained. A well-implemented risk management system forms the foundation for all further requirements under Articles 10–15.

CE marking is mandatory under Article 48 of the EU AI Act for all high-risk AI systems before they are placed on the EU market. It confirms that the system meets all EU AI Act requirements. The path to CE marking includes: compliance with all Articles 9–15 requirements, completing the conformity assessment under Article 43, preparing technical documentation per Article 11 and Annex IV, issuing the EU declaration of conformity under Article 47 and registering in the EU database. The CE marking must be visibly, legibly and permanently affixed to the AI system or, where not possible, on its packaging or accompanying documents. For software-based AI, marking in the digital user interface is permissible.

The EU AI Act establishes a three-tier penalty system. Violations of prohibited AI practices face fines of up to EUR 35 million or 7% of global annual turnover. Non-compliance with high-risk AI system requirements under Articles 9–15 and provider/deployer obligations can result in fines of up to EUR 15 million or 3%. Providing false, incomplete or misleading information to authorities may lead to fines of up to EUR 7.5 million or 1%. Lower caps apply to SMEs and startups. Enforcement is carried out by national market surveillance authorities. Additionally, affected individuals may pursue civil damages claims.

The EU AI Act clearly differentiates between risk categories. High-risk AI systems listed in Annex III (e.g. biometric identification, critical infrastructure, creditworthiness assessment, recruitment) must fully comply with all Articles 9–15 requirements, undergo conformity assessment and bear the CE marking. Limited-risk AI systems (e.g. chatbots, deepfake generators) are subject only to transparency obligations under Article 50: users must be informed that they are interacting with AI or viewing AI-generated content. Minimal-risk AI systems are exempt from regulatory obligations, although voluntary codes of conduct are encouraged.