When do high-risk AI obligations apply: the runway after the Omnibus
A provider of a system listed in Annex III of Regulation (EU) 2024/1689 carries the Chapter III Section 2 requirements, Art. 9 to Art. 15 and Art. 17, from the Annex III application date in the regulation data Deferred. Regulation (EU) 2026/1744 moved the date and left the requirements unchanged. Under Art. 9(8), 11(1) and 17(1), the risk management file, the tests, the quality management system and the Annex IV file exist before placing on the market. The page gives the sequence, the evidence file and the consequence of inaction.
Where this starts
The product matches an Annex III point: recruitment screening under point 4, admission to education under point 3, creditworthiness evaluation under point 5(b), or emergency-call triage under point 5(d). Art. 6(2) classifies the system as high-risk unless one of the Art. 6(3) conditions applies, and the provider then carries the whole of Chapter III Section 2 plus the Annex IV technical file and the Art. 43 conformity assessment. Amended Art. 113(c)(i) applies Chapter III Sections 1, 2 and 3 from the Annex III date "as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III". The regulation entry records the change as a date change only: the obligations are unchanged in content.
Two things follow from that record. First, the amended text has applied since the Omnibus entered into force In force, so the register a provider works from is the consolidated post-Omnibus text and not the original. Second, each of the three articles on this page names a moment before the application date at which its output has to exist. Art. 9(8) requires testing against prior defined metrics and probabilistic thresholds "in any event" before the system is placed on the market or put into service. Art. 11(1) requires the technical documentation to be drawn up before placing on the market and kept up to date. Art. 17(1) requires a quality management system documented in written policies, procedures and instructions, and Art. 17(1)(d) requires examination, test and validation procedures with their frequency, which means the tests run more than once before the file is closed.
Most of the requirements state no numeric level. Art. 9(8) leaves the metrics and thresholds to the provider with the single condition that they fit the intended purpose, and Art. 9(5) asks that residual risk is judged acceptable without an acceptance level. No harmonised standard is cited in the Official Journal of the European Union as of the anchor date, so no presumption of conformity is available, and the provider sets each threshold from the next levels of the hierarchy and justifies it against the context of use: prEN 18228Enquiry for the Art. 9 cycle, prEN 18286Published and ISO/IEC 42001:2023Published for the Art. 17 clause structure, prEN 18229-2Draft for the form in which Annex IV declares accuracy and robustness values, and ISO/IEC 23894:2023Published for the risk process. The justification is itself a record the assessor reads. For Annex III points 2 to 8, Art. 43(2) sets the conformity assessment procedure at internal control under Annex VI, so the file the provider assembles is the file a market surveillance authority reads under Art. 74. Art. 111(2) applies the requirements to a system already on the market before the Annex III date only where the system undergoes significant changes in design after that date; a system placed on the market after that date carries the full set from the start.
The sequence
The steps run in the order the file is read: classification, register, risk management, tests, quality management system, Annex IV, conformity assessment.
Confirm the Annex III match per function and record any Art. 6(3) condition claimed.
Record Classification memo with the Annex III point, the Art. 6(3) result and the Art. 6(4) documentation
[Art. 6(2), 6(3) and 6(4); PR-CLS steps 12 to 17]
Compile the obligation register with each applicable article and its regulation entry id.
Record Obligation register with the regulation entry id for each application date
[Art. 113(c)(i); PR-CLS step 39]
Open the risk management file with each hazard, its misuse conditions and its acceptance criterion.
Record Hazard register and residual risk acceptance record per hazard and overall
[Art. 9(2)(a), 9(2)(b) and 9(5)]
Declare each test metric and threshold before the run, with the reason it fits the purpose.
Record Prior defined metrics and probabilistic thresholds declaration, dated before the test run
[Art. 9(8)]
Run the risk-driven tests and record the result against each declared threshold.
Record Risk-driven test report with a result per operating condition and per misuse condition
[Art. 9(6) and 9(8); PR-15-ROB steps 14 to 21 and 43]
Write the procedure for each Art. 17(1) aspect, with the test frequency that point (d) requires.
Record Quality management system manual with written policies, procedures and instructions
[Art. 17(1)(a) to (m)]
Sample records for the current version and one earlier version against each procedure.
Record QMS gap analysis report with each aspect marked conforms, partial, gap or not applicable
[Art. 17(1); PR-17-QMS steps 9 to 36]
Assemble the Annex IV sections from the test reports and compare each declared value with its report.
Record Annex IV technical documentation set and the gap and consistency report
[Art. 11(1) and Annex IV; PR-11-DOC steps 14 to 35]
Complete the Annex VI internal control, draw up the declaration of conformity and register the system.
Record Internal control record, EU declaration of conformity and EU database registration record
[Art. 43(2) and Annex VI; Art. 47 to 49]
The last step stays with the provider. AIAssuranceLabs tests against the requirements and prepares the evidence for steps 1 to 8; the declaration of conformity, the CE marking under Art. 48 and the registration under Art. 49 are the provider's acts.
Evidence this situation ends with
| Artifact | Answers | Produced by |
|---|---|---|
| Assessment memo (PR-CLS output) | Art. 6(2): the Annex III point matched and any Art. 6(3) condition claimed | PR-CLS v1.0 |
| Obligation register (PR-CLS output) | Art. 113(c)(i): which article applies to the system from which regulation entry | PR-CLS v1.0 |
| Risk management file (Art. 9(1)) | Art. 9(1) and 9(5): the risks identified, the measures adopted and the residual risk judgement | the provider |
| Prior defined metrics and probabilistic thresholds declaration (Art. 9(8)) | Art. 9(8): each metric and threshold was defined before the test run, with its rationale | the provider |
| Risk-driven test report (PR-15-ROB output) | Art. 9(6) and 9(8): the result per operating condition and per misuse condition against the declared threshold | PR-15-ROB v1.0 |
| QMS gap analysis report (PR-17-QMS output) | Art. 17(1)(a) to (m): which aspect has a written procedure and sampled records behind it | PR-17-QMS v1.0 |
| Annex IV technical documentation set (Annex IV sections 1 to 9) | Art. 11(1): the documentation exists before placing on the market and holds every Annex IV element | the provider |
| Annex IV gap and consistency report (PR-11-DOC output) | Annex IV sections 2(g), 3 and 4: each declared value matches a dated and signed test report for the same version | PR-11-DOC v1.0 |
Each artifact type is specified with a synthetic sample on the deliverables page: the assessment memo and the register follow the assessment memo and the register or checklist specifications, the test report follows the test report specification, and the two gap reports follow the findings register specification. The obligation pages for Art. 9, Art. 11 and Art. 17 list the full artifact set per article.
If nothing is done
A system placed on the market after the Annex III date without the Art. 9 file, the Art. 11 documentation and the Art. 17 system is a high-risk system that does not meet Chapter III Section 2. Under Art. 79, a market surveillance authority that finds such a system can require the provider to take corrective action, withdraw the system from the market or recall it, and can restrict or prohibit its availability where the provider does not act. Art. 99(4) sets the penalty tier for an infringement of the provider obligations under Art. 16, which include the Section 2 requirements, the Annex IV documentation and the quality management system. A request for the technical documentation under Art. 74 or Art. 79 then finds a file that is missing or that shows metrics defined after the results were known, and Art. 9(8) makes that a gap in itself. The action that follows on the provider's side is the sequence above, run before placing on the market rather than after a request, with each record dated so the order can be shown.
Services, guides and tools for this situation
The classification and readiness assessment service produces the memo and the obligation register, and the technical documentation and evidence-pack preparation service assembles the Annex IV file and the consistency report, within the limits set out on what we cannot do. The obligation tracker builds the same register in the browser from the regulation data, and the Annex III provider hub lists the full obligation set with its dates.
- Services
- Guides
- Tools
- ICP hubs
Questions
When does the EU AI Act take effect?
Regulation (EU) 2024/1689 entered into force on the twentieth day after its publication in the Official Journal, and its provisions apply in stages set by Art. 113. The prohibitions in Art. 5 as originally adopted, the AI literacy duty in Art. 4, the transparency duties in Art. 50 and the general-purpose AI duties in Art. 53 to 55 already apply. The high-risk requirements for Annex III systems apply from the date in amended Art. 113(c)(i). The regulation page renders every date from the regulation data with its source.
When will the EU AI Act take effect?
Regulation (EU) 2026/1744, the Digital Omnibus on AI, set the remaining application dates: the Annex III high-risk requirements under amended Art. 113(c)(i), the Annex I product-embedded requirements under Art. 113(c)(ii), the inserted Art. 5 prohibitions and the national sandboxes under Art. 57(1). Each deferred item keeps the content adopted in the original text; only the date moved. Art. 111(2) applies the high-risk requirements to a system already on the market only where it undergoes significant changes in design after the Annex III date.
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.