The European Parliament adopted the AI Act on 13 March 2024. After the vote, attention centred on the prohibited practices list and the general-purpose AI provisions, but the obligations that will determine most companies’ compliance costs sit in the high-risk regime. Under the Act’s schedule, high-risk obligations apply from 2 August 2026, with a separate date of 2 August 2027 for products listed in Annex I.
High risk is defined by use
The Act does not classify risk by parameter count or technical approach. It looks at what the system is used for. A system falls into the high-risk category through one of two routes: as a safety component of a product listed in Annex I, or as one of the specific uses set out in the Act. The same model used for internal document summarisation and for recruitment screening can attract entirely different obligations.
That approach creates a practical problem: companies usually have a product first and look for a use description afterwards. Classification has to happen while the product is being defined. Discovering at the conformity-assessment stage that the system needs restructuring multiplies the cost.
Three layers of obligation
The high-risk requirements fall into three layers.
Management systems. A risk management system requires continuous identification, evaluation and mitigation throughout the lifecycle, not a single pre-launch assessment. Data governance requires training, validation and test datasets with appropriate provenance, representativeness and bias controls. A quality management system turns these requirements into auditable processes.
Documentation and records. Technical documentation must explain system design, development, training methods and test results. Record-keeping requires the system to log events automatically so that later reconstruction is possible. Transparency requires supplying deployers with the information they need.
Operational controls. Human oversight must be designed in as effective intervention capability, not a sentence saying someone is responsible. Accuracy, robustness and cybersecurity require acceptable performance under normal and abnormal conditions.
Technical documentation as proof of capability
Reading technical documentation as an expanded manual misses the point. Regulators and notified bodies ask whether the file proves three things: risks were identified, controls were actually implemented, and test results can be reproduced. Documentation that diverges from the development process is the most common failure.
The workable approach binds documentation to the engineering workflow: requirement changes, dataset versions and test records are archived together, and model updates trigger document updates. At conformity assessment or customer diligence, the file then already exists rather than being assembled on request.
CE marking and notified bodies
Some high-risk systems require a notified body in conformity assessment; others can use internal assessment. Where a notified body is involved, the quality management system usually falls within its audit, and on-site review focuses on whether processes actually run, not whether documents are complete.
CE marking is not the end point. Post-market monitoring, incident reporting and change management continue afterwards. For AI companies with fast product cycles, the recurring error is misjudging whether a significant change requires reassessment; build a decision rule into the change process.
Sequence before entering the EU market
The sensible order is classification, then gap analysis, then documentation. Classification determines which procedure applies, gap analysis determines where resources go, and documentation is the output of the first two. Starting with documents usually produces material unrelated to the obligations.
August 2026 looks distant, but notified-body capacity, testing cycles and supply-chain coordination all need scheduling. Companies serving several jurisdictions should align EU requirements with other markets to avoid duplicate work.
For EU market access and high-risk assessment, see our EU AI Act service; for parallel regimes, see multi-jurisdiction compliance; for security and incident response, see cybersecurity compliance.
This article is based on the AI Act adopted by the European Parliament on 13 March 2024 and on public information. It is for reference only and does not constitute legal advice.