Chapter III Sections 3 and 5 and Chapter IX: what providers, deployers, importers, distributors and authorised representatives of high-risk AI systems must do, from quality management and conformity assessment to registration, post-market monitoring and incident reporting.
The provider's master checklist for a high-risk system: Section 2 compliance, labeling, quality management, documentation and logs, conformity assessment, declaration, CE marking, registration, corrective action and accessibility.
The documented quality management system every high-risk provider needs, its 13 required aspects, proportionality for SMEs and small mid-caps, integration with sectoral and financial-sector systems, and EN 18286:2026 as the first harmonised standard.
How long and what providers must keep for authorities: technical documentation, QMS records, notified body changes and decisions, and the EU declaration of conformity for 10 years, including if the provider ceases trading.
The provider's duty to retain the logs its high-risk system generates, for at least six months where they are under its control, the financial-sector alternative, and authority access to those logs.
What a provider must do when a high-risk system is non-conforming or presents a risk, who it must tell, and how it must answer authority requests for documentation and log access.
The EU-based representative that non-EU providers of high-risk systems must appoint: the written mandate, the tasks it must cover, record retention and when the representative must walk away.
Checks an EU importer must make before placing a non-EU provider's high-risk system on the market, what to do with suspect or falsified systems, labeling, storage, 10-year records and cooperation.
Verification and corrective duties for distributors of high-risk systems: CE marking and documentation checks, holding back non-conforming systems, corrective action after sale, and cooperation with authorities.
When a deployer, importer, distributor or other party becomes the provider of a high-risk system, what the original provider then owes, the written agreements required with component and model suppliers, and the 2026 changes and fines.
What organizations using high-risk AI must do: follow instructions, staff human oversight, control input data, monitor and report, keep logs, inform workers and affected people, and register when they are public authorities.
Which deployers must assess the impact of a high-risk system on fundamental rights before first use, the six required elements, notification to the authority, and the 2026 link to GDPR data protection impact assessments.
Which conformity assessment route a high-risk system must follow: internal control under Annex VI, notified body assessment under Annex VII, or the sectoral procedure for Annex I products, plus certificate validity and reassessment after substantial modification.
The provider's signed statement that a high-risk system meets the requirements, its contents and 10-year retention, and the physical or digital CE marking with any notified body number.
Who must register high-risk and claimed not-high-risk systems in the EU database before use, the data required by Annex VIII, the secure section for law enforcement and migration, and national registration for critical infrastructure.
The provider's system for collecting and analysing real-world performance data on a high-risk system over its lifetime, the post-market monitoring plan in the technical file, the Commission template due in 2027, and integration with sectoral systems.
The provider's duty to report serious incidents involving high-risk AI to market surveillance authorities: the 15, 10 and 2 day deadlines, investigation without altering evidence, sectoral carve-outs, AI Office reporting since 2026 and the Commission's draft guidance.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.