What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The EU AI Act gives AI providers and deployers different responsibilities. A provider places an AI system on the EU market or puts it into service; a deployer uses it. The duties then depend on the system’s risk category, intended purpose, lifecycle stage and the organisation’s role in the supply chain. High-risk systems carry the most extensive technical, documentation, oversight and governance requirements, while prohibited practices, transparency-regulated systems and general-purpose AI models follow separate rules.
This guide explains the role-based duties and application dates in the consolidated Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744. It is a practical orientation, not legal advice or a substitute for classifying a particular system against the current legislation.
As an Amazon Associate I earn from qualifying purchases.
Start with the organisation’s role and the system’s purpose
The same company can be a provider for one activity and a deployer for another. A software maker that sells a screening tool is generally acting as a provider. An employer that uses that tool to shortlist applicants is acting as a deployer. A reseller, importer, distributor or other operator can acquire additional responsibilities depending on what it does to the system.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteRole analysis should begin with four questions:
- Who designed, developed or controls the system and its intended purpose?
- Who is placing it on the market or putting it into service, and who is merely using it?
- Has a party put its own name or trademark on the system?
- Has it substantially modified the system or changed its intended purpose so that it becomes high-risk?
Under the value-chain rules, a party that rebrands a high-risk system, substantially modifies it while it remains high-risk, or changes its intended purpose so that it becomes high-risk may be treated as the provider. A modification does not automatically transfer every provider obligation; the specific facts and provisions must be assessed.
#1 Best Overall
The Act’s purpose, stated in Article 1, is to improve the internal market and promote human-centric, trustworthy AI while protecting health, safety, fundamental rights, democracy, the rule of law and the environment from harmful effects. That purpose explains why the regulation combines product-style controls for providers with operational controls for deployers.
Classify the AI activity before using a compliance checklist
The Act is risk-based. Do not assume that every AI feature in a product is “high-risk” or that the obligations for one category apply to another. A defensible classification records the system’s intended purpose, users, affected people, deployment context and the activity that triggers regulation.
Prohibited AI practices
Some practices are prohibited outright, subject to the exceptions and definitions in the regulation. Most prohibitions and the AI-literacy provisions have applied since 2 February 2025, although the legal text identifies specific exceptions to the prohibition start date. A provider or deployer must therefore check whether the use case is prohibited before investing in a high-risk compliance process.
High-risk AI systems
High-risk systems are subject to the Act’s most detailed obligations. The classification can arise under Article 6(2) and Annex III, or under Article 6(1) and Annex I, with different transition dates. High-risk status is not determined only by the model’s technical sophistication; the regulated purpose and context are central.
Transparency-regulated systems
Some systems are not prohibited or high-risk but still have transparency duties. These can include informing people that they are interacting with AI or addressing synthetic audio, image, video or text. The exact requirement depends on the applicable provision and the system’s output.
General-purpose AI models
General-purpose AI models have a separate provider framework. Governance, penalties and obligations for providers of general-purpose AI models began applying on 2 August 2025, subject to the Act’s transition rules. A general-purpose model may also be integrated into a downstream high-risk system, creating additional obligations for the provider or deployer of that system.
What providers of high-risk AI systems must do
Provider obligations attach primarily before a system is placed on the market or put into service, and continue through its lifecycle. The regulation’s chapters and exceptions determine which duties apply to a particular system.
Build and maintain a risk-management system
Providers must establish an ongoing risk-management process for the high-risk system. It should identify and evaluate foreseeable risks, apply appropriate controls, test whether controls work and update the assessment as the system or its context changes. Risk management is not a one-time document prepared only for launch.
Use appropriate data governance
Where training, validation or testing data are relevant to the system, providers must address data governance and management. The controls should cover data quality and suitability for the intended purpose, including processes for identifying and handling relevant errors, gaps or biases. The legal requirements are tied to the system category and applicable exceptions, so a generic data policy is not enough by itself.
Prepare technical documentation and instructions
Providers must prepare technical documentation that demonstrates how the system was designed, developed, tested and controlled. They must also supply instructions for use that enable deployers to understand the system’s capabilities, limitations, operating conditions and required oversight. The documentation should be kept current when the system changes.
Enable record-keeping and traceability
High-risk providers must design for automatic logging and record-keeping where required. Logs support monitoring, investigation and accountability across the lifecycle. Providers should define retention, access and protection arrangements that align with the Act and other applicable law.
Provide information and human-oversight instructions
Instructions must tell deployers what human oversight is required and what competence, authority and resources the responsible people need. A provider should explain foreseeable failure modes, performance limits and circumstances in which the system should be suspended or its output reviewed.
Meet accuracy, robustness and cybersecurity requirements
The system must meet the applicable requirements for accuracy, robustness and cybersecurity. Providers should address resilience to errors, inconsistent inputs, unauthorised manipulation and other reasonably foreseeable threats. Claims about performance must be tied to the intended purpose and operating conditions rather than presented as universal accuracy guarantees.
Operate a quality-management system
A quality-management system must cover the processes needed to design, develop, test, document, release and monitor the high-risk system. It should allocate responsibilities, control changes and preserve evidence that required procedures were followed.
Complete conformity assessment and registration where required
Before placing a high-risk system on the market or putting it into service, the provider must complete the relevant conformity-assessment process. Registration is required where the Act provides for it. The provider must then apply the required marking or other compliance information and retain the supporting records for the legally specified period.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteMonitor, report and correct problems
After deployment, providers must operate post-market monitoring and take corrective action when a system is non-compliant or presents a risk. Corrective action can include bringing the system into conformity, withdrawing it, recalling it or informing affected authorities and operators, depending on the circumstances. Serious incidents and risks must be escalated through the channels and time frames required by the regulation.
What deployers must do when they use high-risk AI
Deployers are organisations or people using an AI system under their authority, rather than placing it on the market. Their duties focus on controlled operation in the real context where people may be affected.
Follow the provider’s instructions
Deployers must use the system in accordance with its instructions for use and take appropriate technical and organisational measures. Changing the purpose, inputs, thresholds or operating environment can create new risks and may alter the organisation’s legal role.
Assign competent human oversight
A deployer must assign human oversight to people with the competence, training, authority and support needed to interpret outputs and intervene. Oversight must be meaningful: staff should be able to question, override or stop the system when its output is unsafe, unreliable or outside the approved use.
Free tools Windows power users keep installed
One-click scans. No signup required.
Monitor operation and retain logs under the deployer’s control
Deployers must monitor performance and operation. Where automatically generated logs are under their control, they must retain them as required by the Act. Monitoring should detect drift, unusual error patterns, misuse and changes in the population or environment on which the system operates.
Best Value
Provide notices in applicable workplaces and user contexts
The Act contains workplace-notice and other transparency duties in specified situations. A deployer should identify when people must be told that an AI system is being used, what role it plays and how they can obtain relevant information or human review. These duties are context-specific and should not be reduced to a single notice template.
Complete impact assessments where the law requires them
Certain public-sector or essential-service deployers must carry out an impact assessment before using a high-risk system, with the scope and exceptions set by the relevant provision. The assessment should address the effects on affected people and fundamental rights and be updated when the use changes.
React to risks, incidents and non-compliance
If a deployer identifies a serious risk, a serious incident or a system that is not operating as required, it must take the action specified by the Act. Depending on the case, that can mean stopping use, isolating the system, informing the provider or authorities, preserving relevant records and cooperating with corrective measures.
Provider and deployer duties compared
| Question | Provider | Deployer |
|---|---|---|
| Primary activity | Places the system on the market or puts it into service. | Uses the system under its authority. |
| Main focus | System design, conformity, documentation, quality and lifecycle safety. | Controlled operation, oversight, monitoring and response in context. |
| High-risk evidence | Risk management, data governance, technical file, logs, QMS and conformity records. | Instructions followed, competent oversight, monitoring records and required assessments. |
| When the role can change | A downstream party can become provider by rebranding, substantial modification or a purpose change that makes the system high-risk. | A deployer can also perform another regulated role if it markets or substantially changes the system. |
| Lifecycle responsibility | Post-market monitoring and corrective action. | Operational monitoring, incident escalation and cooperation with the provider. |
Application dates and transition rules
The Act does not have one universal compliance deadline. The following dates are the EUR-Lex summary’s category-specific baseline, read with the amendments adopted in Regulation (EU) 2026/1744.
| Date | What applies | Qualification |
|---|---|---|
| 2 February 2025 | AI-literacy provisions and most prohibitions. | Specific exceptions apply to the prohibition start date. |
| 2 August 2025 | Governance, penalties and obligations for providers of general-purpose AI models. | Subject to the Act’s transition provisions. |
| 2 August 2026 | General application of the Regulation. | Exceptions and delayed category-specific requirements remain. |
| 2 December 2026 | Article 50(2) steps for providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content and placed on the market before 2 August 2026. | Created by Regulation (EU) 2026/1744; check the consolidated wording. |
| 2 December 2027 | High-risk requirements for systems classified under Article 6(2) and Annex III. | Category-specific transition date. |
| 2 August 2028 | High-risk requirements for systems under Article 6(1) and Annex I. | Category-specific transition date. |
| 2 August 2030 | Necessary compliance steps for providers and deployers of high-risk systems intended for use by public authorities. | Applies under the amended transition rules. |
Article 111 also addresses systems placed on the market or put into service before the relevant application date and systems undergoing significant design changes. A system’s launch date alone therefore does not answer whether the current duties apply; examine the category, the transition provision and whether a significant change has occurred.
A practical implementation sequence
- Inventory the systems. Record each model, application, vendor, version, intended purpose, users, affected groups, deployment location and launch date.
- Map roles. Identify provider, deployer, importer, distributor and any party whose branding, modification or purpose change could trigger provider treatment.
- Classify each use. Check prohibited practices, high-risk categories, transparency rules and general-purpose-model provisions separately.
- Map the date. Apply the relevant start date and Article 111 transition rule rather than relying on the 2 August 2026 headline date.
- Collect provider evidence. Obtain instructions, technical documentation, risk information, conformity records, logging details, security information and incident contacts.
- Design operational controls. Define human oversight, approval limits, monitoring metrics, log retention, access control, staff training and escalation paths.
- Assess affected people and context. For applicable public-sector or essential-service uses, complete the required impact assessment before operation.
- Test and approve. Verify that the system performs within its intended conditions, that staff can intervene and that the approved purpose matches actual use.
- Monitor continuously. Review logs, incidents, complaints, drift, security events and material changes; update controls and documentation.
- Reassess after changes. A new model, data source, threshold, user group or purpose can change the classification, role or applicable deadline.
Common mistakes that create exposure
- Treating every AI tool as high-risk: this obscures the separate rules for prohibitions, transparency and general-purpose models.
- Treating no one as the provider: branding, substantial modification or a purpose change can make a downstream operator the provider.
- Using the provider’s documentation without operational controls: deployers still need competent oversight, monitoring and incident procedures.
- Using one deadline for all systems: the 2025, 2026, 2027, 2028 and 2030 dates apply to different provisions and categories.
- Assuming a contract transfers statutory duties: contracts can allocate work, but the Act’s role definitions and value-chain rules still matter.
- Ignoring intended-purpose drift: a system approved for one task may become high-risk when used for a different decision or population.
- Failing to preserve evidence: missing logs, version records, instructions or incident documentation make it difficult to demonstrate controlled use.
- Relying on an old timeline graphic: Regulation (EU) 2026/1744 changed specified provisions and transition dates, so use the current consolidated text.
How to keep the legal position current
Use the consolidated EUR-Lex text of Regulation (EU) 2024/1689, dated 27 July 2026 in the current reference set, together with Regulation (EU) 2026/1744. Check the articles and annexes that match the system’s classification instead of relying on a summary page. Commission guidance, harmonised standards and codes of practice may add important implementation detail, but their status and scope must be verified for the relevant system and date.
For a live deployment, obtain advice from a qualified EU regulatory professional. The Act interacts with data-protection, product-safety, employment, consumer-protection and sector-specific rules; satisfying one framework does not automatically satisfy the others.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
