Skip to content
AIAssuranceLabs
Menu

Enterprises with many AI use cases

An organisation that runs many AI systems holds both roles under Regulation (EU) 2024/1689: provider for what it builds and places on the market under its own name, deployer for what it buys and uses under its own authority. The obligation set follows each system: Art. 9 and Art. 17 for built high-risk systems, Art. 26 and Art. 27 for deployed ones, Art. 50 for generative and interaction functions. Annex III duties apply from the Annex III application date Deferred, which Regulation (EU) 2026/1744 moved without changing their content. This hub holds the obligation set with dates, evidence, scenarios, guides, services and tools.

The situation

The portfolio holds systems the organisation built, systems it licensed, and AI functions embedded in vendor software that nobody registered as AI. Before any obligation can be tested, each system needs a record of five determinations: the role under Art. 3(3) and Art. 3(4), the Annex III match under Art. 6(2), the Art. 6(3) filter, the Art. 50 function, and any use of a general-purpose AI model under Art. 3(63). The role can change without a purchase: under Art. 25(1) a deployer that puts its name on a high-risk system, substantially modifies it, or changes its intended purpose becomes the provider and takes on Art. 9 to Art. 17. PR-CLS v1.0 records each determination with the article relied on and the rationale, so that the classification of vendor-embedded AI has an owner and a date.

A not-high-risk conclusion under Art. 6(3) exists as a document. Art. 6(4) requires the provider to document the assessment before placing the system on the market or putting it into service and to give it to the national competent authority on request, and Art. 49(2) requires registration in the EU database; the date from which that registration duty applies is an unsettled point shown below. Internal audit tests the governance framework against Art. 17 and against ISO/IEC 42001:2023Published, a published management-system standard, at the same time. The two do not coincide: Art. 17(1) lists points (a) to (m), and the standard's Annex A controls map to points (b), (c), (d), (f), (k), (l) and (m) in the obligation record, which leaves points (a), (e), (g), (h), (i) and (j), from the regulatory strategy to the communication with authorities, to be evidenced against the Act directly. The gap analysis under PR-17-QMS v1.0 records that mapping per point.

Each business unit runs its own tests and the results arrive in different formats, so the risk function cannot compare a robustness report from one unit with an oversight test from another. One traceability matrix format, obligation to test to evidence, gives internal audit, risk and the CISO the same register to read; the traceability matrix tool and the obligation tracker hold that format. AI literacy under Art. 4 applies to the whole organisation already In force, and the amended wording requires providers and deployers to take measures that support the development of AI literacy of their staff and of other persons who operate or use AI systems on their behalf; the evidence is the record of the measures taken. The questions this hub answers:

  • The inventory is incomplete and nobody owns the classification of vendor-embedded AI
  • A not-high-risk decision under Article 6(3) has to be documented in a form that survives an authority's question
  • Internal audit will test the AI governance framework against the Act and against ISO/IEC 42001 at the same time
  • Each business unit runs its own testing, and the evidence is not comparable across systems
  • AI literacy under Article 4 already applies and the training record is thin

Obligations and dates

Each system takes the entry that matches its role and tier, and the table lists the five obligation pages this hub covers together with the articles that have no page.

Portfolio-dependent: each system takes the entry that matches its role and tier. AI literacy under Article 4 follows the ai-literacy entry for the whole organisation. The Article 6(3) registration point is marked verify on the art6-3-registration entry.

Obligations that apply to Enterprises
ObligationApplies fromTestableDocumentationProcessServices
Art. 9Risk management systemDeferred6116
Art. 17Quality management systemDeferred81712
Art. 26Obligations of deployers of high-risk AI systemsDeferred8811
Art. 27Fundamental rights impact assessment for high-risk AI systemsDeferred5104
Art. 50Transparency obligations for providers and deployers of certain AI systemsIn force11128

Also relevant, without an obligation page:

  • Art. 4
  • Art. 6
  • Annex III

Regulation (EU) 2024/1689 sets no numeric threshold in Art. 9, Art. 17, Art. 27 or Art. 50, and in Art. 26 it sets two periods only: log retention of at least six months under Art. 26(6) unless applicable Union or national law provides otherwise, and a limit of 48 hours for the authorisation request of a post-remote biometric identification system under Art. 26(10). No harmonised standard is cited in the Official Journal as of the anchor date, so no presumption of conformity is available for any system in the portfolio. The reference used today sits at the next levels of the hierarchy: prEN 18286Published, the CEN-CENELEC JTC 21 document for the Art. 17 clause structure, at the stage shown and not cited in the Official Journal; ISO/IEC 42001:2023Published for the management-system clauses and Annex A controls; the Commission code of practice and guidelines for Art. 50; and the provider's own justified state of the art. The provider or deployer sets each metric, acceptance criterion and review frequency, justifies it against the context of use, and records the justification; the element-evidence step of PR-17-QMS v1.0 holds that record for each Art. 17(1) point.

Three points in this obligation set are unsettled; each block shows both readings with the working reading marked.

What an assessor or authority will ask for

A market surveillance authority acting under Art. 74, or the internal audit function ahead of it, asks for the portfolio register first and the per-system evidence second.

  1. AI system inventory with role, risk tier, Article 50 function and GPAI use recorded per system
  2. Article 6(3) assessment record per system that claims the filter, with the rationale and the registration status
  3. Obligation register per high-risk system with applicability dates from the regulation data
  4. QMS gap analysis against Article 17, prEN 18286 and ISO/IEC 42001 Annex A
  5. One traceability matrix format used across systems: obligation to test to evidence
  6. AI literacy measures record under Article 4

The list maps onto the artifact families specified with synthetic samples on the deliverables page: the register or checklist for the inventory and the obligation register with applicability dates from the regulation data; the assessment memo from PR-CLS for each Art. 6(3) record, with the condition relied on and the registration status; the findings register from PR-17-QMS for the QMS gap analysis against Art. 17; the traceability matrix in one format across systems; and the test report from PR-14-OVR for each deployed high-risk system's oversight verification under Art. 26. The AI literacy measures record under Art. 4 is the organisation's own document; a review checks that it names the measures, the persons in scope and the date of each measure.

Scenarios

Each scenario page tagged for enterprises states the sequence of events, the evidence list and the consequence of inaction with its article reference.

Guides

Each guide tagged for enterprises holds a real command, configuration or synthetic example and a threshold or pitfall with its source.

Services

Five services test the portfolio's evidence; the scope limits are stated on what we cannot do, and the compliance decision for each system remains with the organisation in its role as provider or deployer, its notified body where one is required, and its counsel.

Protocols

Each protocol is versioned and published in full on the methodology index with the derivation from the standards it cites and the limits of what it shows.

Tools and templates

The classifier, the obligation tracker, the checklist and the traceability matrix run in the browser, nothing is sent to a server, and their rules are published on the tool logic page; the evidence pack index and the other templates are on the templates page.

Questions

How far is your organisation with the EU AI Act?

The position of an organisation is readable from four records. First, an inventory that lists every AI system with its role, Annex III match, Art. 6(3) filter, Art. 50 function and general-purpose model use. Second, a classification record per system under PR-CLS with the article relied on. Third, an obligation register per high-risk system with the applicability date from the regulation data. Fourth, one traceability matrix per system from obligation to test to evidence. The first missing record marks the next step.

What are the four EU AI Act risk tiers?

Regulation (EU) 2024/1689 names no tiers; its structure gives four sets of rules. Art. 5 prohibits listed practices. Art. 6 with Annex I and Annex III classifies high-risk systems, which carry Chapter III Sections 2 and 3, Art. 8 to 27. Art. 50 places transparency duties on systems that interact with people, generate synthetic content, recognise emotions, categorise biometrics or produce deep fakes. Every other system carries Art. 4 only, with voluntary codes of conduct under Art. 95. General-purpose AI models under Art. 53 to 55 form a separate layer.

What is an AI Act management system?

Art. 17(1) requires a provider of a high-risk AI system to put in place a quality management system documented in written policies, procedures and instructions, covering points (a) to (m), among them regulatory strategy, design control, verification and testing, data management, risk management, post-market monitoring, incident reporting, record keeping and an accountability framework. ISO/IEC 42001:2023, a published international standard, supplies a management-system structure that maps to seven of those points in the obligation record. Neither document is cited in the Official Journal, so no presumption of conformity follows from either.

What does AI Act Article 4 require?

Art. 4(1), as amended by Regulation (EU) 2026/1744, requires providers and deployers of AI systems to take measures to support the development of AI literacy of their staff and of other persons who operate or use AI systems on their behalf. The amended text adds that no specific level of AI literacy of any individual is owed. The duty applies to the whole organisation in both roles. The record that evidences it names the measures, the persons in scope and the date of each measure.

Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.

Ask about scopehello@aiassurancelabs.com