Regulation (EU) 2024/1689, the EU Artificial Intelligence Act, is not a universal certificate for every product that uses software. Start by identifying whether the product contains an AI system, who acts as provider or deployer, and where the output is used. Then map the applicable duties and retain evidence against each entry. This reference uses public European Commission and EUR-Lex materials and is not a system-specific legal opinion.
1. Establish Whether the Act Is in Scope
Regulation (EU) 2024/1689 covers, among other situations, providers placing AI systems or general-purpose AI models on the Union market, deployers established or located in the Union, certain third-country providers or deployers whose output is used in the Union, and specific duties for importers, distributors, and product manufacturers that place an AI system on the market with their product. “We use AI” alone is not enough to determine the applicable duties.
Create an initial record for the system name and version, purpose and intended users, inputs and outputs, whether it is embedded in a product, target markets, provider and deployer, importer or distributor, and whether outputs are used in the Union. Record an AI model separately from an AI system; once a general-purpose model is integrated into a system, model-level and system-level issues may both need review.
2. Map Duties to the Actual Role
Provider generally means the person or organisation that develops an AI system or general-purpose AI model, or places it on the market or puts it into service under its own name. A deployer uses an AI system under its responsibility. Importers, distributors, product manufacturers, and authorised representatives can have specific duties in particular situations. A contract label does not replace an assessment of who controls, places, or uses the system.
Link each duty to the responsible actor rather than filing a supplier document without context. Record the legal name and address, authorisation chain, system version, change history, and evidence owner. A product brochure does not demonstrate that a supplier document covers your deployment context.
3. Screen Prohibited Practices, High-Risk Use, and Transparency
Begin with Article 5. The screening should consider prohibited practices such as manipulative or exploitative techniques that meet the statutory conditions, certain social-scoring practices, and individual criminal-risk prediction based solely on profiling. Do not replace the article-by-article comparison with a broad “low risk” label or an industry marketing term.
If a system may fall into a high-risk category, continue with the relevant product-law or Annex III analysis and review risk management, technical documentation, logs, data governance, human oversight, accuracy, and cybersecurity as applicable. The classification depends on the system’s function, intended purpose, and the relevant annexes.
Article 50 addresses transparency in specific situations, including certain human-machine interactions, synthetic or manipulated content, emotion recognition, and biometric categorisation. Record the trigger, affected audience, notice method, machine-readable marking or disclosure arrangement, and the relevant interface, notice, content-marking, and testing versions.
4. Retain General-Purpose AI Model Information
For a provider of a general-purpose AI model, Article 53 addresses technical documentation, information for downstream AI-system providers, a copyright policy, and a publicly available summary of training content following the AI Office template. Additional duties apply to models with systemic risk. If you integrate a third-party model, request information on capabilities and limitations, version, licence, and downstream documentation, then retain your integration configuration and output testing separately.
5. Maintain the Timeline and Evidence Register
The European Commission’s current implementation page states that the Act entered into force on 1 August 2024; prohibitions and AI-literacy provisions apply from 2 February 2025; general-purpose AI model obligations apply from 2 August 2025; and most rules and transparency requirements apply or become enforceable from 2 August 2026. Following the 2026 simplification changes, some high-risk rules have dates of 2 December 2027 or 2 August 2028. Check the latest official text and the specific provision before relying on any date.
Useful register fields include system and version, purpose and market, provider/deployer, classification basis, relevant Article or Annex, risk assessment, technical documentation, data governance, human oversight, transparency material, supplier contracts, testing and logs, change date, evidence owner, source link, and review note. Reassess when the model, prompt, data, interface, user group, or output purpose changes.
Sources: EUR-Lex, Regulation (EU) 2024/1689; European Commission AI Act framework and timeline; European Commission Article 50 transparency FAQ.
