Legacy System Grace Period

The grace period is a fixed, non-extendable window defined by the EU AI Act's staggered enforcement dates. It applies exclusively to systems placed on the market or put into service before the Act's application date for high-risk categories. The exact duration depends on the system's classification, with critical infrastructure and safety components often having shorter transition periods than other high-risk categories. This timeline is calculated from the Act's entry into force, not from the date of an individual conformity assessment.

To qualify for the grace period, a system must have been lawfully placed on the Union market before the relevant obligations take effect. This means the system must have completed any previously required conformity procedures under existing legislation, such as the Machinery Directive or Medical Device Regulation. A system merely in development or beta testing does not qualify. The burden of proof rests on the provider to demonstrate the exact date of first market placement through commercial records and supply chain documentation.

The grace period is immediately voided if a legacy system undergoes a substantial modification. This is defined as any change to the system's intended purpose or a modification that materially alters its risk profile beyond what was covered in the original risk assessment. Routine software patches, security updates, and minor performance improvements that do not change the fundamental function or risk level do not trigger a new conformity assessment. The determination of what constitutes 'substantial' is a critical legal analysis point.

Even during the grace period, providers are not exempt from post-market monitoring obligations. Legacy systems must have a documented plan for collecting and analyzing real-world performance data. This includes:

• Serious incident reporting to National Competent Authorities
• Proactive data gathering on system malfunctions and unexpected behaviors
• Retention of logs for auditability The monitoring system must be proportionate to the risk level and serve as the foundation for the eventual conformity assessment.

Providers must use the grace period to prepare a complete technical documentation file and EU database registration package. This includes compiling:

• The intended purpose declaration
• Training data provenance records
• Residual risk disclosures
• Results of the conformity assessment Waiting until the deadline approaches risks administrative bottlenecks at Notified Bodies. Proactive engagement with a National Competent Authority is recommended to clarify documentation expectations for legacy system architectures.

The grace period does not grant a retroactive CE marking. Legacy systems may continue to operate without the physical or digital CE mark until the transition deadline, provided they were legally placed on the market under prior rules. However, once the grace period expires, the system must either have obtained a CE marking through a completed conformity assessment or be withdrawn from the market. A market withdrawal notification must be filed if the provider chooses not to pursue compliance.