Reference
Obligations by Article
What each article of the EU AI Act actually requires, who it binds, and when it starts to apply. Filter by your role to see only what is relevant to you.
AI Literacy
Providers and deployers must take measures to ensure a sufficient level of AI literacy among their staff and anyone operating AI systems on their behalf, taking into account technical knowledge, experience, and the context of use.
Prohibited AI practices
Article 5 lists AI practices banned in the Union because they are considered contrary to Union values and fundamental rights. The prohibitions have applied since 2 February 2025.
Classification rules for high-risk AI systems
Article 6 sets out when an AI system counts as high-risk: as a safety component of a product covered by Annex I harmonised legislation, or through the use cases listed in Annex III.
Risk management system
Providers of high-risk AI systems must establish, implement, document, and maintain a risk management system that runs continuously across the whole lifecycle of the system.
Data and data governance
High-risk AI systems trained with data must be developed on training, validation, and testing datasets that meet defined quality criteria and are subject to appropriate governance practices.
Technical documentation
Providers must draw up technical documentation before the high-risk AI system is placed on the market and keep it up to date, demonstrating that the system meets the requirements of the Regulation.
Record-keeping and automatic logging
High-risk AI systems must technically allow the automatic recording of events over their lifetime, so that functioning can be traced and risk situations identified.
Transparency and information to deployers
High-risk AI systems must be sufficiently transparent for deployers to interpret their output and use them appropriately, and must be accompanied by clear instructions for use.
Human oversight
High-risk AI systems must be designed so that natural persons can effectively oversee them while in use, with oversight measures built in by the provider and applied by the deployer.
Accuracy, robustness and cybersecurity
High-risk AI systems must achieve an appropriate level of accuracy, robustness, and cybersecurity and perform consistently in those respects throughout their lifecycle.
Obligations of providers of high-risk AI systems
Article 16 consolidates what providers of high-risk AI systems must do before and after placing a system on the market.
Quality management system
Providers of high-risk AI systems must put in place a documented quality management system covering strategy, procedures, and responsibilities for regulatory compliance.
Obligations of importers
Importers must verify the conformity of a high-risk AI system before placing it on the Union market and must not place it if they consider it non-conforming.
Obligations of distributors
Distributors must check that a high-risk AI system carries the required marking and documentation before making it available, and act when it does not.
Obligations of deployers of high-risk AI systems
Deployers of high-risk AI systems must use them in line with the instructions for use and take organisational measures to keep the system under control.
Fundamental rights impact assessment (FRIA)
Certain deployers must carry out an assessment of the impact on fundamental rights before putting a high-risk AI system into use.
Conformity assessment
Before a high-risk AI system is placed on the market, the provider must complete the applicable conformity assessment procedure.
EU declaration of conformity
The provider must draw up a written, machine-readable EU declaration of conformity for each high-risk AI system and keep it available for ten years.
CE marking
High-risk AI systems must bear CE marking to indicate conformity with the Regulation, affixed visibly, legibly, and indelibly.
Registration in the EU database
Providers of high-risk AI systems — and certain deployers that are public authorities — must register in the EU database before placing the system on the market or putting it into use.
Transparency obligations for certain AI systems
Article 50 sets transparency duties for AI systems that interact with people or generate synthetic content. It is the provision that matters most for online shops publishing AI-generated or AI-altered product photos, and it applies from 2 August 2026.
Obligations of providers of GPAI models
Providers of general-purpose AI models must document their model, inform downstream providers, respect copyright, and publish a summary of training content. These duties have applied since 2 August 2025.
Post-market monitoring
Providers of high-risk AI systems must establish and document a post-market monitoring system proportionate to the nature and risks of the system.
Content of technical documentation
Annex IV lists the minimum information the technical documentation of a high-risk AI system must contain.
This page is a plain-language summary for orientation only. It is not legal advice — the binding text is Regulation (EU) 2024/1689.
Label your AI product photos before August 2026
EU AI Label adds CoP-aligned EU AI icons to AI-generated and AI-modified product photos on Shopify and WordPress, and keeps the metadata log your Compliance Hub needs.
Advising clients on the AI Act?
We work with agencies rolling out Article 50 transparency across client stores. Book a short call to talk through the setup.