Provider obligations checklist — EU AI Act

Develops an AI system / GPAI model (or has one developed) and places it on the market or puts it into service under its own name or trademark. Carries the heaviest obligation load.

11 obligations apply to a provider. Each links to the evidence an auditor expects. Download as checklist (.md).

• ☐ Disclose AI interaction to users — by 2026-08-02
  Evidence: Transparency / disclosure notice
• ☐ Mark AI-generated content machine-readably — by 2026-08-02
  Evidence: Machine-readable content marking
• ☐ Declare accuracy metrics in instructions for use — by 2027-12-02
  Evidence: Accuracy Declaration Record, Instructions for use, Annex IV technical file
• ☐ Evidence robustness / resilience — by 2027-12-02
  Evidence: Robustness test plan & results, Annex IV technical file
• ☐ Evidence AI-specific cybersecurity — by 2027-12-02
  Evidence: AI cybersecurity threat model & evidence, Annex IV technical file
• ☐ Run a lifecycle risk-management system — by 2027-12-02
  Evidence: Risk-management file, Annex IV technical file
• ☐ Govern training, validation and test data — by 2027-12-02
  Evidence: Data-governance records, Annex IV technical file
• ☐ Draw up & maintain the Annex IV technical file — by 2027-12-02
  Evidence: Annex IV technical file, Requirement-to-evidence compliance matrix
• ☐ Classify the system against Article 6 / Annex III — by 2027-12-02
  Evidence: High-risk classification decision record
• ☐ Register in the EU database — by 2027-12-02
  Evidence: EU database registration confirmation
• ☐ Complete conformity assessment before market — by 2027-12-02
  Evidence: EU Declaration of Conformity, Annex IV technical file

Not legal advice. This is a practitioner reference generated from a cited knowledge base built on the primary legal text and official Commission guidance. Verify against the cited primary sources before relying on it for a compliance decision. See editorial standards & methodology.