EU AI Act obligations by role and date
What the AI Act, as amended by the Digital Omnibus in July 2026, requires of deployers and providers, with the article behind each duty and when it applies, and the other law that sits beside it. Each duty links to the lines of the AI risk register that cover it.
As at 1 November 2026. This page is not legal advice: read the text of the law against the facts of your own case.
The dates
| Date | What applies | On 1 November 2026 |
|---|---|---|
| 17 January 2025 | DORA: the third-party rules for banks, insurers and investment firms, which reach AI bought as an ICT service | Applies |
| 2 February 2025 | AI Act: prohibited practices and AI literacy | Applies |
| 2 August 2025 | AI Act: general-purpose AI models, and the penalty rules | Applies |
| 31 July 2026 | Ireland: the Regulation of Artificial Intelligence Act 2026 comes into operation | Applies |
| 2 August 2026 | AI Act: transparency for chatbots and AI-generated content, and the Act's general date of application | Applies |
| 2 December 2026 | AI Act: a ninth prohibited practice, AI that generates non-consensual intimate images or child sexual abuse material; the deadline for marking AI-generated content from generators placed on the market before 2 August 2026 | Coming |
| 9 December 2026 | Product liability: software, including AI, is a product for products placed on the market or put into service after this date | Coming |
| 2 December 2027 | AI Act: high-risk uses in Annex III, including credit scoring, life and health insurance pricing and recruitment | Coming |
| 2 August 2028 | AI Act: AI that is, or is a safety component of, a product under Annex I, such as machinery, toys, lifts and medical devices | Coming |
Duties by role
Most organisations are deployers of AI that others build, and many are also providers of systems they built for their own use. A role's duties add to those of every organisation. The lists give the main duties, not every condition and exception: read the article before you rely on it.
- Every organisation that builds, buys or uses AI
- Organisations that use high-risk AI
- Organisations that build high-risk AI
- Providers of general-purpose AI models
- Banks, insurers and other financial entities
- In Ireland
Every organisation that builds, buys or uses AI
Most of this applies now
Any provider or deployer, whatever the risk class of its systems. Under the AI Act a deployer is any organisation that uses an AI system under its authority, including one bought from a vendor.
Check every AI system you build, buy or use against the prohibitions in Article 5, among them manipulation that causes significant harm, social scoring that leads to unjustified detrimental treatment, and emotion recognition at work or in education other than for medical or safety reasons.
Where: AI Act Art 5
When: 2 February 2025; the ninth prohibition from 2 December 2026
Register lines: FAI-04, FAI-05, HUM-08, LEG-02, LEG-04, LEG-08
Take measures to support the AI literacy of your staff and of others who operate or use AI systems on your behalf.
Where: AI Act Art 4, as replaced in 2026
When: 2 February 2025
Providers: design systems that interact with people so that people know they are dealing with an AI, unless that is obvious, and mark generated content in a machine-readable format. Deployers: disclose deepfakes, and AI-generated text published to inform the public on matters of public interest unless a person has reviewed it and holds editorial responsibility, and tell people exposed to emotion recognition or biometric categorisation.
Where: AI Act Art 50, 111(4)
When: 2 August 2026; providers' marking for generators placed on the market before then, 2 December 2026
Register lines: MOD-01, FAI-06, FAI-07, TRA-01, HUM-08, LEG-09, SOC-01, SOC-02
Where AI processes personal data, the controller must have a lawful basis, and an Article 9 condition for special categories such as health data; carry out a data protection impact assessment before processing that is likely to result in a high risk; and use decisions based solely on automated processing that significantly affect people only where Article 22 allows, with safeguards that include human intervention.
Where: GDPR Art 6, 9, 22, 35
When: 25 May 2018
Register lines: DAT-03, FAI-03, TRA-01, TRA-02, TRA-06, LEG-02, LEG-03, LEG-04
Treat AI as a product for liability: the manufacturer is liable to people, whether or not it was at fault, for death, personal injury, damage to other property (not property used only for professional purposes), and the destruction or corruption of data not used for professional purposes, when a defective system causes them, including defects that come from updates, upgrades or machine learning after release. Purely financial loss is not covered.
Where: Directive (EU) 2024/2853
When: Products placed on the market or put into service after 9 December 2026
Phase 1 of the method records every system in an inventory, with its role and its class under the Act. Register lines LEG-07 to LEG-09 cover a system put in the wrong class, a prohibited practice hidden in a feature, and missed transparency, literacy and registration duties.
Organisations that use high-risk AI
From 2 December 2027
Deployers of the uses listed in Annex III of the AI Act, among them creditworthiness and credit scoring, risk assessment and pricing in life and health insurance, recruitment and worker management, education, and access to essential public services. Systems placed on the market or put into service before then come under these rules only if their design changes significantly afterwards; systems intended for public authorities must comply by 2 August 2030 (Article 111(2)).
Use the system in line with the provider's instructions, and give human oversight to people with the competence, training and authority it needs.
Where: AI Act Art 26(1), 26(2)
When: 2 December 2027
Register lines: MOD-01, MOD-09, MOD-10, TRA-05, TRA-06, HUM-01, HUM-03, HUM-05
Where you control the input data, make sure it is relevant and sufficiently representative for the system's intended purpose.
Where: AI Act Art 26(4)
When: 2 December 2027
Monitor the system in operation. If you have reason to think that using it as instructed may present a risk to health, safety or fundamental rights, suspend it and inform the provider or distributor and the market surveillance authority without undue delay. Report a serious incident immediately, first to the provider.
Where: AI Act Art 26(5)
When: 2 December 2027
Keep the logs the system generates, where they are under your control, for a period that suits its purpose and of at least six months, unless other law provides otherwise.
Where: AI Act Art 26(6)
When: 2 December 2027
Register line: TRA-07
Inform workers' representatives and the workers affected before using the system at work, and tell people when it makes or helps make decisions about them.
Where: AI Act Art 26(7), 26(11)
When: 2 December 2027
Where the GDPR requires a data protection impact assessment, use the provider's information to carry it out. The GDPR duty applies already.
Where: AI Act Art 26(9); GDPR Art 35
When: GDPR now; AI Act from 2 December 2027
Register line: LEG-03
Before first use, carry out a fundamental rights impact assessment if you are a public body, a private body providing public services, or you use AI for credit scoring or for life and health insurance pricing. Send the results to the market surveillance authority, and update the assessment when the facts change.
Where: AI Act Art 27
When: 2 December 2027
When a person affected by a decision based on the system's output asks, explain the role of the AI system and the main elements of the decision, where it has legal or similarly significant effects on them.
Where: AI Act Art 86
When: 2 December 2027
Register line: TRA-02
Take on the provider's duties if you put your name or trademark on a high-risk system already on the market, make a substantial modification that leaves it high-risk, or change the intended purpose of a system so that it becomes high-risk.
Where: AI Act Art 25(1)
When: 2 December 2027
Public authorities: register your use of the system in the EU database before using it. If a system you plan to use is not registered, do not use it, and inform the provider or distributor.
Where: AI Act Art 26(8), 49
When: 2 December 2027
The use-case template in phase 2 records the oversight, logging, notices and impact assessments for each system. The workbook's FRIA sheet maps the six elements of Article 27 to the register and the templates.
Organisations that build high-risk AI
From 2 December 2027; 2 August 2028 for AI in Annex I products
Providers: organisations that develop a high-risk AI system, or have one developed, and place it on the market or put it into service under their own name, including for their own use. A lender that builds its own credit scoring model and uses it is both provider and deployer. Systems placed on the market or put into service before then come under these rules only if their design changes significantly afterwards; systems intended for public authorities must comply by 2 August 2030 (Article 111(2)).
Run a risk management system for the whole lifecycle, starting with the identification and analysis of the known and reasonably foreseeable risks to health, safety and fundamental rights.
Where: AI Act Art 9
When: 2 December 2027
Register lines: MOD-02, MOD-06, MOD-07, MOD-12, HUM-04, HUM-09, OPS-05, OPS-06
Govern training, validation and test data, including examination for possible biases.
Where: AI Act Art 10
When: 2 December 2027
Register lines: DAT-01, DAT-02, DAT-03, FAI-01, FAI-04, FAI-05
Prepare technical documentation before the system goes on the market and keep it up to date, keep the compliance records for ten years, and design the system to record events automatically and keep its logs.
Where: AI Act Art 11, 12, 18, 19
When: 2 December 2027
Give deployers instructions they can understand and use, and design the system for effective human oversight.
Where: AI Act Art 13, 14
When: 2 December 2027
Register lines: DAT-04, MOD-02, MOD-04, MOD-10, TRA-02, TRA-03, TRA-04, TRA-06, HUM-01, HUM-04, HUM-05, HUM-07, SEC-08
Achieve an appropriate level of accuracy, robustness and cybersecurity.
Where: AI Act Art 15
When: 2 December 2027
Register lines: DAT-01, DAT-06, MOD-03, MOD-08, MOD-13, FAI-04, SEC-01, SEC-02, SEC-03, SEC-04, SEC-05, SEC-07, SEC-09, SEC-11
Run a quality management system, complete the conformity assessment before the system is placed on the market or put into service, including for your own use, and register Annex III systems in the EU database. For credit scoring and insurance pricing the assessment is internal, without a notified body.
Where: AI Act Art 17, 43, 49
When: 2 December 2027
Draw up the EU declaration of conformity and affix the CE marking. If the system does not conform, correct, withdraw, disable or recall it at once, and inform those affected.
Where: AI Act Art 20, 47, 48
When: 2 December 2027
Monitor the system after it is placed on the market under a documented plan, and report serious incidents to the market surveillance authority within the deadlines in Article 73.
Where: AI Act Art 72, 73
When: 2 December 2027
Article 9 starts with identification, and phase 2 of the method is that step: two tracks, top-down and bottom-up, reconciled into one register. Phase 4 scores the risks, and phase 6 keeps the record that the technical documentation draws on.
Providers of general-purpose AI models
Since 2 August 2025; 2 August 2027 for models placed on the market before then
Organisations that develop a general-purpose model, such as a large language model, and place it on the market. Most organisations use these models and are not their providers.
Keep technical documentation, give information to providers who build on the model, have a copyright policy and publish a summary of the training content. Models with systemic risk carry more duties, including evaluation, incident reporting and cybersecurity.
Where: AI Act Art 53, 55, 111(3)
When: 2 August 2025; 2 August 2027 for models placed on the market before then
Most organisations meet these models as deployers or downstream providers. Register line OPS-01 covers dependence on one foundation-model provider.
Banks, insurers and other financial entities
DORA since 17 January 2025; AI Act high-risk duties from 2 December 2027
Financial entities carry the AI Act's duties and their own sector's rules. For high-risk AI used in providing financial services, the market surveillance authority is normally the national financial supervisor, unless the State names another authority (Article 74(6) and (7)).
Where an AI service you buy is an ICT service under DORA, assess its risks before you contract, including concentration risk; record it in the register of information; put DORA's contract terms in the contract; and keep exit strategies for services that support critical or important functions.
Where: DORA Art 28 to 30
When: 17 January 2025
Register lines: MOD-05, MOD-11, SEC-09, SEC-11, LEG-10, LEG-12, OPS-01, OPS-02, OPS-03
Credit scoring of individuals, fraud detection excepted, and risk assessment and pricing in life and health insurance are high-risk uses, so their deployers need a fundamental rights impact assessment before first use.
Where: AI Act Annex III point 5(b), (c); Art 27
When: 2 December 2027
Meet the deployer's monitoring duty through your internal governance under financial services law, and keep the system's logs within the documentation that law requires. The duties to suspend a risky system and to report incidents still apply.
Where: AI Act Art 26(5), 26(6)
When: 2 December 2027
If you build high-risk AI, your internal governance under financial services law meets most of the quality management system duty, but not the risk management system, post-market monitoring or serious incident reporting.
Where: AI Act Art 17(4)
When: 2 December 2027
Register line: MOD-13
Insurers: expect supervisors to apply EIOPA's Opinion on AI governance and risk management, which sets out how insurance law applies to AI systems that are neither prohibited nor high-risk.
Where: EIOPA Opinion
When: 6 August 2025
Register line: LEG-10
Phase 1 maps the sector rules beside the Act. Register lines OPS-01, MOD-05 and LEG-12 carry DORA's third-party articles, and LEG-10 covers sector rules that are missed.
In Ireland
In operation since 31 July 2026
The Regulation of Artificial Intelligence Act 2026 gives effect to the AI Act in Irish law. It was signed on 21 July 2026 and came into operation on 31 July 2026, apart from two paragraphs of one definition in section 78 (S.I. No. 403/2026).
It sets up Oifig IS na hÉireann, the AI Office of Ireland, as an independent statutory body. The Office coordinates the authorities that supervise the AI Act and is the single point of contact for the European Commission, sector regulators and the public.
Where: Regulation of Artificial Intelligence Act 2026
When: 31 July 2026
It gives market surveillance authorities an enforcement toolkit that runs from notices to prohibition and seizure, and then to fines and prosecution, with independent adjudication. It amends the Central Bank Act 1942 and the Competition and Consumer Protection Act 2014 so that AI Act sanctions can be imposed under them.
Where: Regulation of Artificial Intelligence Act 2026
When: 31 July 2026
Fines under the AI Act
| Breach | Article | Maximum fine |
|---|---|---|
| A prohibited practice | Art 99(3) | €35 million or 7% of total worldwide annual turnover |
| A breach of the obligations of providers (Article 16), deployers (Article 26), authorised representatives, importers or distributors, or of the transparency duties (Article 50) | Art 99(4) | €15 million or 3% |
| Incorrect, incomplete or misleading information given to authorities or notified bodies in reply to a request | Art 99(5) | €7.5 million or 1% |
| A provider of a general-purpose AI model, fined by the Commission, from 2 August 2026 | Art 101 | €15 million or 3% |
Turnover is that of the preceding financial year. The maximum is the higher of the two amounts, or the lower for SMEs, including start-ups (Article 99(6)), and for small mid-caps on the fines in Article 99(4) and (5) (Article 99(6a)). In Ireland, the Regulation of Artificial Intelligence Act 2026 sets the rules for imposing them.
What the Digital Omnibus changed
Regulation (EU) 2026/1744 amended the AI Act before most of its duties applied.
- It entered into force on 27 July 2026.
- It moved the rules for high-risk uses in Annex III to 2 December 2027, and for high-risk AI in products under Annex I to 2 August 2028.
- It added a ninth prohibited practice, AI systems that generate non-consensual sexually explicit or intimate content or child sexual abuse material, which applies from 2 December 2026.
- It gave providers of content generators placed on the market before 2 August 2026 until 2 December 2026 to mark their output (Article 111(4)).
- It replaced the AI literacy duty in Article 4. Providers and deployers must take measures to support the AI literacy of their staff and of others who use AI on their behalf, without a guaranteed level, and the Commission and Member States take a larger role.
- It allows special categories of personal data to be processed to detect and correct bias.
- It extended some simplifications for SMEs to small mid-cap companies, and simplified the registration of exempted systems in the EU database.
- It widened the AI Office's oversight of some systems built on general-purpose models.
AI Act articles in the register
Every article of the AI Act that a register line cites, with the lines that cite it. Read it in both directions: from an article to the risks behind it, and from a line to the duties it supports.
| Article | Heading | Register lines |
|---|---|---|
| Article 4 | AI literacy | HUM-02, HUM-05, LEG-09, OPS-07 |
| Article 5 | Prohibited AI practices | FAI-04, FAI-05, HUM-08, LEG-02, LEG-04, LEG-08 |
| Article 6 | Classification rules for high-risk AI systems | MOD-14, LEG-07 |
| Article 9 | Risk management system | MOD-02, MOD-06, MOD-07, MOD-12, HUM-04, HUM-09, OPS-05, OPS-06 |
| Article 10 | Data and data governance | DAT-01, DAT-02, DAT-03, FAI-01, FAI-04, FAI-05 |
| Article 11 | Technical documentation | TRA-03, TRA-08 |
| Article 12 | Record-keeping | MOD-04, TRA-07 |
| Article 13 | Transparency and provision of information to deployers | DAT-04, MOD-04, TRA-02, TRA-03, TRA-04, HUM-04 |
| Article 14 | Human oversight | MOD-02, MOD-10, TRA-06, HUM-01, HUM-05, HUM-07, SEC-08 |
| Article 15 | Accuracy, robustness and cybersecurity | DAT-01, DAT-06, MOD-03, MOD-08, MOD-13, FAI-04, SEC-01, SEC-02, SEC-03, SEC-04, SEC-05, SEC-07, SEC-09, SEC-11 |
| Article 17 | Quality management system | MOD-13 |
| Article 18 | Documentation keeping | OPS-10 |
| Article 19 | Automatically generated logs | TRA-07 |
| Article 25 | Responsibilities along the AI value chain | DAT-04, MOD-05, TRA-04, TRA-05, HUM-03, LEG-07, LEG-12, OPS-05 |
| Article 26 | Obligations of deployers of high-risk AI systems | DAT-05, DAT-06, MOD-01, MOD-05, MOD-09, MOD-10, FAI-01, TRA-01, TRA-05, TRA-06, TRA-07, HUM-01, HUM-03, HUM-05, LEG-02, LEG-03, LEG-09, OPS-07, OPS-08, SOC-04 |
| Article 27 | Fundamental rights impact assessment | FAI-02, FAI-03, LEG-03 |
| Article 43 | Conformity assessment | OPS-05, OPS-06 |
| Article 49 | Registration | LEG-07, LEG-09 |
| Article 50 | Transparency obligations for certain AI systems | MOD-01, FAI-06, FAI-07, TRA-01, HUM-08, LEG-09, SOC-01, SOC-02 |
| Article 53 | Obligations of providers of general-purpose AI models | DAT-03, DAT-04, TRA-04, LEG-06 |
| Article 55 | Obligations of providers of general-purpose AI models with systemic risk | HUM-09 |
| Article 72 | Post-market monitoring | DAT-05, MOD-06, TRA-08, OPS-05 |
| Article 86 | Right to explanation of individual decision-making | TRA-02 |
| Article 95 | Codes of conduct for voluntary application | SOC-03 |
| Article 99 | Penalties | LEG-07, LEG-08 |
| Article 113 | Entry into force and application | LEG-09 |
| Annex III | High-risk uses | FAI-01, FAI-02, FAI-03, LEG-04 |
Other law the register cites
| Law | Articles cited | Register lines |
|---|---|---|
| GDPR Regulation (EU) 2016/679, since 25 May 2018 | Art 5, 6, 8, 9, 10, 12, 13, 14, 15, 16, 17, 21, 22, 30, 32, 33, 35 | DAT-03, DAT-07, DAT-08, FAI-03, TRA-01, TRA-02, TRA-05, TRA-06, SEC-06, SEC-10, LEG-01, LEG-02, LEG-03, LEG-04, LEG-05, LEG-13, OPS-07 |
| DORA Regulation (EU) 2022/2554, since 17 January 2025 | Art 6, 9, 11, 28, 29, 30 | MOD-05, MOD-11, SEC-09, SEC-11, LEG-10, LEG-12, OPS-01, OPS-02, OPS-03 |
| NIS2 Directive (EU) 2022/2555; Member States were to apply their rules from 18 October 2024, and for financial entities DORA's equivalent rules apply instead | Art 21 | DAT-08, SEC-07, SEC-09, SEC-10 |
| Product Liability Directive Directive (EU) 2024/2853, for products placed on the market or put into service after 9 December 2026 | Cited without an article | MOD-14, HUM-09, LEG-11 |
| EBA and EIOPA EIOPA Opinion on AI governance and risk management, 6 August 2025; EBA report on the AI Act's implications for banking and payments, 21 November 2025 | Cited without an article | LEG-10 |
Questions about the AI Act
When does the EU AI Act apply?
It entered into force on 1 August 2024 and applies in stages. The prohibitions and the AI literacy duty have applied since 2 February 2025, and the prohibition added in 2026 applies from 2 December 2026. The rules for general-purpose AI models have applied since 2 August 2025, and most of the rest, including the transparency duties, since 2 August 2026. After the Digital Omnibus, the rules for high-risk uses listed in Annex III apply from 2 December 2027, and those for AI in products under Annex I from 2 August 2028. High-risk systems already on the market are caught only if their design changes significantly afterwards, except systems for public authorities, which must comply by 2 August 2030.
Is my organisation a provider or a deployer?
A deployer uses an AI system under its own authority. A provider develops a system, or has one developed, and places it on the market or puts it into service under its own name, including for its own use. A bank that builds its own credit scoring model and uses it is both. A deployer becomes the provider of a high-risk system if it puts its name on it, substantially modifies it, or changes its intended purpose so that it becomes high-risk (Article 25).
Is credit scoring high-risk under the EU AI Act?
Yes. Annex III lists AI systems used to evaluate the creditworthiness of natural persons or establish their credit score, except systems used to detect financial fraud, and systems used for risk assessment and pricing in life and health insurance. An Annex III system that profiles individuals is always high-risk. Deployers of both must carry out a fundamental rights impact assessment before first use.
Who must carry out a fundamental rights impact assessment?
Under Article 27, before first use: deployers that are bodies governed by public law, private bodies providing public services, and deployers of high-risk systems for credit scoring or for life and health insurance pricing. The assessment covers the process, how long and how often the system is used, the people affected, the specific risks of harm to them, human oversight, and the measures to take if the risks materialise. The deployer must notify the market surveillance authority of the results.
What does Article 4 on AI literacy require now?
As replaced by the Digital Omnibus in 2026, Article 4 requires providers and deployers to take measures to support the AI literacy of their staff and of others who operate or use AI systems on their behalf, taking account of their knowledge, experience and training and the context of use. It does not require a specific level of literacy.
What are the fines under the EU AI Act?
Up to €35 million or 7% of total worldwide annual turnover in the preceding financial year, whichever is higher, for a prohibited practice; up to €15 million or 3% for a breach of the obligations of providers, deployers, authorised representatives, importers or distributors listed in Article 99(4), or of the transparency duties; and up to €7.5 million or 1% for incorrect, incomplete or misleading information given to authorities or notified bodies in reply to a request. For SMEs the lower of the two amounts applies, and for small mid-caps on the last two. The Commission can fine providers of general-purpose AI models up to €15 million or 3% from 2 August 2026 (Article 101).
Who supervises the AI Act in Ireland?
The Regulation of Artificial Intelligence Act 2026, in operation since 31 July 2026, sets up the AI Office of Ireland as the central coordinating authority and single point of contact, with several market surveillance authorities. For high-risk AI used by financial institutions in providing financial services, Article 74(6) makes the national financial supervisor the market surveillance authority, unless the State identifies another authority under Article 74(7).
Does the EU AI Act apply to AI we buy from a vendor?
Yes. Using a bought system under your own authority makes you its deployer, with the deployer's duties. If the system is high-risk, the provider's instructions, logs and information become part of your own compliance. Financial entities within DORA's scope must also apply its ICT third-party rules where the vendor provides an ICT service.
Meet the duties with the method
The book sets out the method that finds and documents the risks behind these duties. The workbook holds the register, the system inventory, the use-case template and a mapping of the fundamental rights impact assessment to the register.
Sources
- Regulation (EU) 2024/1689, the AI Act, Official Journal text
- Regulation (EU) 2026/1744, the Digital Omnibus on AI
- European Commission, the AI Act policy page and its dates
- European Commission, AI Omnibus enters into force
- Department of Enterprise, Tourism and Employment, release on the Regulation of Artificial Intelligence Act 2026, 30 July 2026
- S.I. No. 403/2026, Regulation of Artificial Intelligence Act 2026 (Commencement) Order 2026
- Regulation (EU) 2016/679, the GDPR
- Regulation (EU) 2022/2554, DORA
- Directive (EU) 2024/2853 on liability for defective products
Get the book and the register
Your files are ready. The links are personal to your email address and work for 7 days. A copy is on its way to your inbox.
Start with Chapter 1, then Appendix A for the register. Questions about the method are welcome at rory@eonriskservices.com.