Blog
Regulatory analysis of the AI Act and the GDPR for SMEs
Annex III high-risk applies from 2 December 2027
The Digital Omnibus moved the Annex III high-risk obligations from August 2026 to 2 December 2027. What that date covers, and why the old one still circulates.
When you stop being the deployer and become the provider: the three scenarios under Article 25
This whole series explains obligations that don't fall on you because they belong to the provider. Article 25 says when they do — and there are three closed-list circumstances, not a grey area.
Serious incidents: the provider reports, but the clock starts when you find out
Article 73 requires the provider of a high-risk system to report serious incidents. Under Article 26(5), the deployer informs first the provider and then the importer or distributor and the authority; if it cannot reach the provider, Article 73 applies to it mutatis mutandis.
Post-market monitoring: the system belongs to the provider, the information is yours
Article 72 requires the provider to establish a post-market monitoring system. The deploying company doesn't build it, but Article 26(5) requires it to monitor operation, inform in accordance with that article and, where applicable, suspend use.
What an authority can ask you: the article that usually gets cited belongs to the provider, not you
Article 21 — cooperation with the authorities — binds providers, and sets no deadline. What reaches the deployer is Article 26(12). The difference changes what can be demanded of you, and what can't.
Annex IV is not an obligation: it's the index of someone else's document
Annex IV turns up on task lists for companies deploying AI. It imposes nothing on anyone: it specifies what the technical documentation Article 11 requires from the provider must contain.
Minimal risk or high risk: what each one requires, article by article
The difference between the two classifications isn't one of degree. A minimal-risk system is resolved with Article 4. A high-risk one opens the whole of Article 26, and none of its obligations is met on its own.
Keeping ten years of documentation you don't generate
Article 18 requires five documents to be kept for ten years from the moment the system is placed on the market. All five are produced or received by the provider, and the clock starts from an event the deploying company had no part in.
What a system cannot do for you, and what it can: where the line is
A system holds the record, the relationships between decisions, and detection of what has expired. It does not hold the decision or the accountability. The line is sharp, and it's worth knowing where it falls before you buy anything.
The Article 17 quality management system isn't yours to set up
Article 17 requires a documented quality management system for high-risk AI systems. It applies to providers, and its content is about product design and development — nothing a deploying company can put in place.