AIAssuranceLabs: EU AI Act testing and evidence preparation
AIAssuranceLabs tests AI systems against the articles of Regulation (EU) 2024/1689 under versioned public protocols and prepares the evidence a provider or deployer keeps in its file. The site serves providers and deployers of high-risk systems, manufacturers of products under Annex I, and providers of general-purpose AI models. It performs no conformity assessment and gives no legal opinion; the boundary is stated on what we cannot do.
Application dates after the Digital Omnibus
Every date on this site renders from the regulation anchor with its source and its verified-on stamp, and every change to that data is recorded in the change log. Regulation (EU) 2026/1744 moved application dates and left the content of the obligations in place; the Omnibus change column states what moved for each entry.
| Item | Applies to | Date | Omnibus change | Verified on |
|---|---|---|---|---|
| AI literacy, Art. 4, as a duty to take supporting measures (amended wording from the Omnibus entry into force) | providers, deployers | In force | Amended Art. 4(1) from 'take measures to ensure, to their best extent, a sufficient level of AI literacy' to 'take measures to support the development of AI literacy', and added that the obligation 'does not require providers or deployers to guarantee any specific level of AI literacy of any individual'. New Art. 4(2) and 4(3) task the Commission with practical examples and the Board with recommendations. | |
| GPAI obligations, Art. 53-55 | gpai-providers | In force | none | Verified on European Commission, AI Act: regulatory framework for AI (timeline) |
| Digital Omnibus on AI, entry into force | all | In force | The Omnibus moved application dates and amended provisions; it did not remove obligations. New Art. 113(d) states that Articles 102 to 110 apply from the entry-into-force date. | Verified on K&L Gates, EU Digital Omnibus on AI Enters Into Force (31 July 2026) |
| Article 50 transparency obligations | providers, deployers | In force | none to the date. A new Art. 111(4) grants systems that generate synthetic content and were already on the market a grace period for the Art. 50(2) marking duty (entry article-50-2-legacy-marking). | Verified on Gibson Dunn, EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines and Other Key Changes (27 May 2026) |
| Commission enforcement powers for GPAI (fines, requests for information) | gpai-providers | In force | none to the date. The Omnibus gave the AI Office exclusive competence over general-purpose AI systems under Art. 75 and added supervisory powers in Art. 75a to 75d. | |
| Article 50(2) machine-readable marking for systems placed on the market before the Article 50 date | providers | Deferred | New Art. 111(4): 'Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026.' | Verified on Winston Taylor, AI Act rules on high-risk AI delayed as AI Digital Omnibus agreed (4 August 2026) |
| New Article 5 prohibitions (non-consensual intimate imagery, CSAM) with technical safeguards | providers, deployers | Deferred | Inserted Art. 5(1) points (ba) and (bb) and Art. 5(1a) and (1b). Amended Art. 113(a): 'Chapters I and II shall apply from 2 February 2025, with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026'. | Verified on Gibson Dunn, EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines and Other Key Changes (27 May 2026) |
| Annex III standalone high-risk obligations | providers, deployers | Deferred | Amended Art. 113(c): 'Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III'. Previously these obligations applied from the general application date. Obligations are unchanged in content. | Verified on Cloud Security Alliance, EU AI Act's High-Risk Deadline: Deferred, Not Cancelled (1 August 2026) |
| Annex I product-embedded high-risk obligations | providers | Deferred | Amended Art. 113(c)(ii): '2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I'. Previously Art. 6(1) obligations applied from 2 August 2027. | Verified on Cloud Security Alliance, EU AI Act's High-Risk Deadline: Deferred, Not Cancelled (1 August 2026) |
What we test
Fourteen obligation records, from Art. 9 to Art. 55, restate each article and split its elements into testable, documentation and process. The matrix shows which service runs which protocol for which article; an empty cell means the service does not test that obligation.
| Service | Art. 9 | Art. 10 | Art. 11 | Art. 12 | Art. 13 | Art. 14 | Art. 15 | Art. 17 | Art. 26 | Art. 27 | Art. 50 | Art. 53 | Art. 54 | Art. 55 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Classification and readiness assessment | PR-CLS | PR-CLS | PR-CLS | PR-CLS | ||||||||||
| Article 50 transparency and marking/watermark testing | PR-50-MARK | |||||||||||||
| Robustness and adversarial testing | PR-15-ROB | PR-15-ROB | PR-15-ROB | PR-15-ROB | ||||||||||
| Bias and fairness testing under the Omnibus sensitive-data provision | PR-10-BIAS | PR-10-BIAS | ||||||||||||
| Logging and human-oversight verification | PR-12-LOG | PR-14-OVR | PR-12-LOG, PR-14-OVR | |||||||||||
| Technical documentation and evidence-pack preparation | PR-11-DOC | PR-11-DOC | PR-11-DOC | |||||||||||
| Pre-conformity mock assessment | ||||||||||||||
| GPAI evaluation support | PR-15-ROB | PR-11-DOC | PR-15-ROB, PR-11-DOC | PR-15-ROB | PR-CLS | PR-CLS, PR-11-DOC | PR-CLS | PR-15-ROB, PR-CLS | ||||||
| FRIA facilitation and evidence structuring | PR-27-FRIA | |||||||||||||
| Data governance and dataset quality testing | PR-10-BIAS | PR-10-BIAS | ||||||||||||
| QMS gap analysis | PR-17-QMS | PR-17-QMS | ||||||||||||
| Regression testing after substantial modification | PR-15-ROB | PR-15-ROB | PR-15-ROB | PR-15-ROB |
Services
Twelve services each name the protocol versions they run and the deliverables they produce; every deliverable is specified with a synthetic sample on the deliverables page, and the boundary of every service is the one stated on what we cannot do.
Classification and readiness assessment
- For
- Startups, Enterprises, Non-EU providers
- Articles
- Protocols
- Applies from
- In force
Article 50 transparency and marking/watermark testing
- For
- Generative AI features
- Articles
- Protocols
- Applies from
- In force
Robustness and adversarial testing
- For
- Annex III providers, Annex I manufacturers, GPAI providers
- Protocols
- Applies from
- Deferred
Bias and fairness testing under the Omnibus sensitive-data provision
- For
- Annex III providers, Deployers
- Articles
- Protocols
- Applies from
- Deferred
Logging and human-oversight verification
- For
- Annex III providers, Deployers
- Protocols
- Applies from
- Deferred
Technical documentation and evidence-pack preparation
- For
- Annex III providers, Annex I manufacturers, Startups, Non-EU providers
- Protocols
- Applies from
- Deferred
Pre-conformity mock assessment
- For
- Annex III providers, Annex I manufacturers
- Protocols
- Applies from
- Deferred
- For
- GPAI providers
- Applies from
- In force
FRIA facilitation and evidence structuring
- For
- Deployers
- Articles
- Protocols
- Applies from
- Working reading
Data governance and dataset quality testing
- For
- Annex III providers, Annex I manufacturers, GPAI providers
- Articles
- Protocols
- Applies from
- Deferred
- For
- Annex III providers, Annex I manufacturers, Enterprises
- Articles
- Protocols
- Applies from
- Deferred
Regression testing after substantial modification
- For
- Annex III providers, Annex I manufacturers, GPAI providers
- Articles
- Protocols
- Applies from
- Deferred
Tools
Four tools run in the browser, nothing entered is sent anywhere, and the rules they apply are published as JSON on the tool logic page; the outlines for the records they refer to are on the templates page.
Browser-based EU AI Act risk and role classifier: answer the Art. 6, Art. 50 and general-purpose AI questions, get the tier and obligation set with dates.
A per-system register of EU AI Act obligations and application dates by role and tier, with documentation and process elements, status and CSV export.
A test checklist by tier, role and system type: one item per testable obligation element with the protocol that runs it, built in the browser.
Obligation to test to evidence rows for one role and tier, prefilled from the classifier result, with protocol, evidence record and status per row, as CSV.
Method
Every protocol derives from the standards listed on the standards tracker, where each draft standard is named with its stage. No harmonised standard is cited in the Official Journal as of the anchor date, so no presumption of conformity is available and the protocols treat draft standards and ISO/IEC references as evidence of the state of the art.
Verified on last full verification run, see the change log
Every step of a protocol cites the clause or the article it derives from, and no protocol claims field use. AIAssuranceLabs is the only author of the site; no page carries an individual byline, and every substantive sentence rests on an article, a standard with its stage, a dated source rendered from data, a protocol step or a deliverable.What we cannot do
- We do not perform conformity assessments where a notified body is required.
- We do not issue CE marking or the EU Declaration of Conformity.
- We are not a notified body.
- We do not give legal opinions on classification or liability.
- We test against requirements, prepare evidence, and structure documentation; compliance decisions remain with the provider or deployer, their notified body, and their counsel.