The Annex III application date after the Omnibus: what moved and what a provider still owes now
Regulation (EU) 2026/1744 amended Art. 113(c) of Regulation (EU) 2024/1689. A system classified as high-risk under Art. 6(2) and Annex III now carries Chapter III Sections 1, 2 and 3 from the Annex III date in the regulation data Deferred, and the entry records the amendment as a date change only. The text of Art. 9, Art. 11 and Art. 17 is unchanged. A provider uses the interval to build the risk management file, the quality management system and the Annex IV file, each of which the Act requires before placing on the market.
What the source says
The regulation entry quotes amended Art. 113(c): Chapter III, Sections 1, 2 and 3, "with the exception of Article 6(5)", apply from the date in point (i) "as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III". Before the amendment these sections followed the general application date in the second paragraph of Art. 113. Point (ii) gives systems classified under Art. 6(1) and Annex I a later date of their own Deferred. Section 1 holds the classification rules in Art. 6 and 7, Section 2 holds the requirements in Art. 8 to 15, and Section 3 holds the provider obligations in Art. 16 to 22, including the quality management system in Art. 17. The Art. 6(5) carve-out leaves the Commission's duty to issue classification guidelines outside the deferral; the Commission guidelines on high-risk classificationDraft are the document a provider reads for the Art. 6(3) conditions.
The amended text itself has applied since the Omnibus entered into force In force. The entry for that date records the effect in one sentence: the Omnibus moved application dates and amended provisions; it did not remove obligations. A provider that also runs a general-purpose model or a system under Art. 50 carries those duties today.
| Item | Articles | Applies from | Omnibus change |
|---|---|---|---|
| Annex III standalone high-risk obligations | Art. 6(2); Chapter III Sections 1 to 3 | Deferred | Amended Art. 113(c)(i); obligations unchanged in content |
| Annex I product-embedded high-risk obligations | Art. 6(1); Chapter III Sections 1 to 3 | Deferred | Amended Art. 113(c)(ii) |
| Amended text in force | Art. 113(d) | In force | Amendments apply from that day unless a later date is set |
| Article 50 transparency obligations | Art. 50 | In force | No change to the application date |
| GPAI obligations | Art. 53 to 55 | In force | No change |
Art. 111(2) governs systems already on the market. A high-risk system placed on the market or put into service before the Annex III date falls under the Regulation only where it undergoes a significant change in design after that date; systems intended for use by public authorities carry a later date in the same paragraph, recorded on the regulation entry. A system placed on the market after the Annex III date carries the full set from its first day. Whether a change is significant is a judgement the provider records in the Art. 17(1)(a) modification record.
The entry records the obligations as unchanged in content, and the consolidated text bears that out for the three articles on this page: Art. 17(1) points (a) to (m) carry no amendment note, and Art. 9 and Art. 11 keep their structure. One simplification reaches the smaller provider: Art. 11(1), third subparagraph, opens the simplified technical documentation form to SMEs, including start-ups, and small mid-cap enterprises, and notified bodies accept the form for the conformity assessment. The form is the Commission's to establish; until it is issued, Annex IV sections 1 to 9 remain the checklist.
What changes for a provider or deployer
Each of the three articles names a moment before the application date at which its record has to exist. Art. 9(8) requires testing against prior defined metrics and probabilistic thresholds, "in any event" before the system is placed on the market or put into service. Art. 11(1) requires the technical documentation to be drawn up before placing on the market and kept up to date. Art. 17(1)(d) requires examination, test and validation procedures with the frequency of each, and Art. 9(2) requires the risk management system to run as a continuous iterative process that is reviewed and updated. These records carry dates that an assessor compares. A metrics declaration dated after the test run cannot show the prior definition Art. 9(8) asks for, and a single test record cannot show the frequency Art. 17(1)(d) asks for. The interval to the Annex III date is spent producing dated records in sequence; a file assembled in one pass at the end does not reconstruct them.
No harmonised standard is cited in the Official Journal of the European Union as of the anchor date, so no presumption of conformity under Art. 40 is available and the provider sets each threshold from the next levels of the hierarchy and justifies it against the context of use. prEN 18228Enquiry supplies the risk identification, estimation and evaluation steps for the Art. 9 cycle. prEN 18286Published and ISO/IEC 42001:2023Published supply the clause structure and the records an Art. 17 review checks. prEN 18229-2Draft supplies the form in which Annex IV declares accuracy and robustness levels. A draft is evidence for the method chosen; the provider's written justification of each value is itself a record the assessor reads under Annex IV section 4.
AIAssuranceLabs tests against these requirements and prepares the evidence within the limits at what we cannot do; the conformity assessment, the declaration of conformity and the registration remain the provider's acts. PR-17-QMS v1.0 samples records for the current version and one earlier version against each Art. 17(1) procedure and each Art. 9 paragraph, and produces the QMS gap analysis report and the risk management system review record. PR-11-DOC v1.0 builds the Annex IV checklist with one row per sub-point, compares each declared value with the unrounded value in its test report, and produces the Annex IV gap and consistency report. Both outputs sit in the evidence pack with an index naming each item, its version and its source protocol; the technical documentation service delivers the assembled sections with a source map for the provider's review.
What to do now
- Confirm the classification under Art. 6(2) and record any Art. 6(3) condition claimed, as Art. 6(4) requires; the runway scenario gives the sequence from that memo to the Annex VI internal control.
- Rebuild the obligation register from the consolidated post-Omnibus text, with the regulation entry id against each application date.
- Date the acceptance criteria under Art. 9(5) and the metrics and thresholds under Art. 9(8) before the first test run; the Art. 9 obligation page lists the testable elements and the artifacts.
- Write the procedure for each Art. 17(1) aspect, with the frequency point (d) requires, and start the record trail so that a second-cycle sample exists; the Art. 17 obligation page gives the split between documentation, process and testable elements.
- Assemble Annex IV from dated and signed test reports as section 2(g) requires; the Annex IV assembly guide gives the manifest, the frozen file set and the completeness check.
- For a system already on the market, record the Art. 111(2) design-change decision in the Art. 17(1)(a) modification record, with the reason.
Related pages
The obligation pages, the two protocols, the guides and the services below carry the detail for each step above.
- Protocols
- Guides
- Services
- ICP hubs
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.