Provider Obligations

A mandatory, iterative process running throughout the entire AI system lifecycle. Providers must identify, estimate, and evaluate reasonably foreseeable risks to health, safety, and fundamental rights. This includes risks from intended use and reasonably foreseeable misuse. The system must define specific, measurable risk acceptance criteria and implement mitigation measures, with residual risks communicated transparently to deployers.

Providers must apply rigorous governance to training, validation, and testing datasets. This is not just about volume but quality and relevance. Mandatory criteria include:

• Bias examination: Proactive identification and mitigation of statistical biases.
• Error analysis: Assessment of inaccuracies and data gaps.
• Relevance: Ensuring datasets are representative of the system's intended purpose.
• Provenance: Documenting the origin and lineage of all data used.

A comprehensive, living dossier that proves compliance. It must be drawn up before the system is placed on the market and kept up-to-date. The documentation includes a detailed description of the system's design and development, its intended purpose, the architecture of the model, and the performance metrics achieved during testing. This serves as the primary evidence for a conformity assessment.

An organizational backbone ensuring consistent, compliant design and maintenance. The QMS must document the provider's strategy for regulatory compliance, including the design control procedures, verification protocols, and resource management. It must also cover the procedures for reporting serious incidents and for post-market monitoring, ensuring the system remains compliant after deployment.

A continuous, proactive duty that begins the moment a system is deployed. Providers must systematically collect and analyze real-world performance data to detect emerging risks. This is not passive observation; it requires a documented plan to gather user feedback and operational metrics, feeding findings back into the risk management system to trigger corrective actions or a new conformity assessment if a substantial modification occurs.

A critical reactive obligation. Providers must immediately notify the relevant market surveillance authority of any malfunction or failure of the AI system that directly or indirectly leads to:

• Death of a person.
• Serious damage to a person's health.
• Serious and irreversible damage to property. The report must include a root cause analysis and the corrective actions taken.

The mandatory verification process by which a provider demonstrates that a high-risk AI system meets all applicable regulatory requirements prior to market placement. This assessment is based on the risk management system and technical documentation.

• Can be internal or involve a notified body
• Results in the declaration of conformity
• Must be updated after a substantial modification

The comprehensive dossier a provider must compile to demonstrate a high-risk AI system's design, development, and compliance. It contains detailed information on:

• System architecture and design specifications
• Training, validation, and testing datasets
• Performance metrics and accuracy levels
• Risk management system procedures

This documentation must be kept for 10 years after market placement.

A formalized, documented organizational structure of policies, processes, and procedures required for providers to ensure consistent design, development, and post-market maintenance of compliant high-risk AI systems.

• Covers design control and verification
• Includes post-market monitoring procedures
• Mandates incident reporting protocols
• Requires executive accountability for compliance

The continuous, systematic process by which a provider collects and analyzes real-world data on the performance of a deployed AI system to identify emerging risks and ensure ongoing compliance.

• Must be documented in the technical documentation
• Feeds into the risk management system
• Triggers serious incident reporting when failures occur
• Applies for the entire lifetime of the system

An independent, accredited organization designated by an EU member state to conduct third-party conformity assessments of high-risk AI systems before they receive CE marking. The provider must engage a notified body when internal conformity assessment is insufficient.

• Operates within a defined accreditation scope
• Audits the quality management system
• Reviews the technical documentation

A change to an AI system's intended purpose or a significant alteration to its performance characteristics that triggers a new conformity assessment. The original provider's certification is no longer valid.

• Includes changes to the algorithm's logic
• Covers repurposing for a new use case
• Requires updated technical documentation
• May necessitate a new notified body review