High-Risk AI System

A continuous, iterative risk management process must be established throughout the AI system's lifecycle. This includes implementing Human Oversight Mechanisms to minimize residual risks and prevent automated harm.

• Mandatory Residual Risk Disclosure to end-users for any unmitigated dangers
• Requires Algorithmic Impact Assessments to evaluate societal consequences
• Built-in human-in-the-loop or human-on-the-loop validation protocols

Compliance does not end at deployment. Providers are legally obligated to conduct Post-Market Monitoring—a systematic process of collecting and analyzing real-world performance data. Any serious incident triggers a mandatory report.

• Establishes an Incident Reporting Linkage using the system's Unique ID
• Requires mechanisms for Market Withdrawal Notification if non-compliance is detected
• National authorities can issue a Registration Suspension for failing systems

High-risk classification demands strict adherence to AI Data Governance protocols. Training, validation, and testing datasets must be subject to appropriate governance practices concerning provenance, relevance, and bias mitigation.

• Requires a documented Training Data Provenance Record for copyright compliance
• Mandates transparency through Model Explainability Techniques
• Must comply with Purpose Limitation Controls to prevent data repurposing

Any Substantial Modification to the system's intended purpose or performance characteristics resets the compliance clock. Such changes trigger a new conformity assessment and re-registration obligation.

• A change in the Intended Purpose Declaration requires re-evaluation
• Software updates that alter core logic may constitute a substantial change
• Providers must monitor for Legacy System Grace Period expirations

The mandatory verification process proving a high-risk AI system meets the EU AI Act's essential requirements before CE Marking can be affixed. This assessment evaluates the system's risk management, data governance, and technical documentation.

• Can be internal (self-assessment) or external (by a Notified Body)
• Must be repeated after any Substantial Modification
• Forms the legal basis for the provider's Declaration of Conformity

An independent third-party organization designated by an EU member state to conduct external conformity assessments. These entities possess the technical competence to audit complex AI systems, particularly those involving biometric identification or critical infrastructure.

• Required when harmonized standards are insufficient
• Operates under strict impartiality and confidentiality rules
• Issues certificates that are valid across all member states

The comprehensive dossier submitted during registration containing system architecture, design specifications, and risk management details. This living document must be kept for 10 years after market placement.

• Includes Training Data Provenance Records
• Contains the Intended Purpose Declaration defining operational boundaries
• Must be presented to authorities within 10 days upon request

The continuous, systematic process by which providers collect and analyze real-world performance data after registration. This obligation ensures that residual risks are tracked and that the system remains compliant throughout its lifecycle.

• Triggers Incident Reporting Linkage for serious events
• Feeds into the provider's Quality Management System Audit
• May necessitate a Market Withdrawal Notification if safety is compromised

A change to an AI system's intended purpose or performance characteristics that fundamentally alters its risk profile. This event triggers a new conformity assessment and re-registration obligation, preventing providers from bypassing oversight through incremental updates.

• Evaluated against the original Intended Purpose Declaration
• Includes significant changes to underlying model architecture
• The provider bears the burden of determining if a change is 'substantial'