--- authoritative: false representation: annotated-page publisher: AstroKube methodology: https://ai-act.astrokube.com/about/ source_verified_on: '2026-09-15' site_content_updated_on: '2026-09-15' title: 'Article 16: Obligations of providers of high-risk AI systems | EU AI Act | AstroKube' description: 'Article 16, EU AI Act: Providers of high-risk AI systems shall: (a) ensure that their high-risk AI systems are compliant with the requirements set out in…' language: en source: https://ai-act.astrokube.com/law/art-16/ --- 1. [Start](https://ai-act.astrokube.com/) 2. [The law](https://ai-act.astrokube.com/law/) 3. Article 16 Chapter III · Section 3 · Obligations of providers and deployers of high-risk AI systems and other parties # Article 16 — Obligations of providers of high-risk AI systems ▼ Primary text, verbatim. Our annotations appear below, visibly separated. Providers of high-risk AI systems shall: (a) ensure that their high-risk AI systems are compliant with the requirements set out in Section 2; (b) indicate on the high-risk AI system or, where that is not possible, on its packaging or its accompanying documentation, as applicable, their name, registered trade name or registered trade mark, the address at which they can be contacted; (c) have a quality management system in place which complies with Article 17; (d) keep the documentation referred to in Article 18; (e) when under their control, keep the logs automatically generated by their high-risk AI systems as referred to in Article 19; (f) ensure that the high-risk AI system undergoes the relevant conformity assessment procedure as referred to in Article 43, prior to its being placed on the market or put into service; (g) draw up an EU declaration of conformity in accordance with Article 47; (h) affix the CE marking to the high-risk AI system or, where that is not possible, on its packaging or its accompanying documentation, to indicate conformity with this Regulation, in accordance with Article 48; (i) comply with the registration obligations referred to in Article 49(1); (j) take the necessary corrective actions and provide information as required in Article 20; (k) upon a reasoned request of a national competent authority, demonstrate the conformity of the high-risk AI system with the requirements set out in Section 2; (l) ensure that the high-risk AI system complies with accessibility requirements in accordance with Directives (EU) 2016/2102 and (EU) 2019/882. This text is meant purely as a documentation tool and has no legal effect. The Union's institutions do not assume any liability for its contents. The authentic versions of the relevant acts, including their preambles, are those published in the Official Journal of the European Union and available in EUR-Lex. [ Recital 66 — interpretive context Requirements should apply to high-risk AI systems as regards risk management, the quality and relevance of data sets used, technical documentation and record-keeping, transparency and the provision of information to deployers, human oversight, and robustness, accuracy and cybersecurity. Those requirements are necessary to effectively mitigate the risks for health, safety and fundamental rights. As no other less… ](https://ai-act.astrokube.com/law/recital-66/) ## What this means for you In your terms · Data and data governance Dataset lineage is yours: where each set came from, how it was prepared, what its gaps are, and the bias examination that was actually run. - Dataset cards with provenance - Bias examination report Failure smells likeSomeone asks which data the model was trained on and the answer is a bucket path, with no record of how the set was assembled or what it was assumed to represent. In your terms · Technical documentation The Annex IV file describes your system, and drift makes it wrong. Generate what can be generated from the source of truth instead of hand-maintaining prose. - Annex IV technical file - Doc generation wired into CI Failure smells likeThe documentation describes the system as it was designed two releases ago, and nothing in the pipeline forces it to move with the code. In your terms · Automatic recording of events Logging capability is a design-time decision, not a config you bolt on later: correlation IDs and event coverage live in the code. - Decision-correlation IDs across services In your terms · Transparency and instructions for deployers Interpretability of output is partly interface design: expose confidence, provenance and known failure modes where the deployer can see them. - Output metadata deployers can read In your terms · Human oversight The stop and override paths have to exist in the architecture, tested like any other critical path. - Kill switch and override, with tests In your terms · Accuracy, robustness and cybersecurity Adversarial input, prompt injection and poisoning resistance are test suites, not adjectives. - Adversarial and injection test suite In your terms · Risk management system Risk treatments become design constraints and test cases; each identified risk should map to something you can point at in the codebase. - Risk-to-control mapping in the design docs ## Obligations derived from this article [Data and data governanceArt. 16(a)](https://ai-act.astrokube.com/explorer/?art=art-16)[Technical documentationArt. 16(a)](https://ai-act.astrokube.com/explorer/?art=art-16)[Automatic recording of eventsArt. 16(a)](https://ai-act.astrokube.com/explorer/?art=art-16)[Transparency and instructions for deployersArt. 16(a)](https://ai-act.astrokube.com/explorer/?art=art-16)[Human oversightArt. 16(a)](https://ai-act.astrokube.com/explorer/?art=art-16)[Accuracy, robustness and cybersecurityArt. 16(a)](https://ai-act.astrokube.com/explorer/?art=art-16)[Risk management systemArt. 16(a)](https://ai-act.astrokube.com/explorer/?art=art-16) ## Scenarios that touch this provision ### A CV-screening feature in your product Illustrative You are about to ship a feature that ranks and filters job applications for the companies that use your hiring product. ### Your role ProviderDeployer ### Where it lands High risk Deferred 2 Dec 2027 ### Decided by Annex III, point 4(a): systems intended to be used for the recruitment or selection of natural persons, in particular to analyse and filter job applications and to evaluate candidates. What applies - [Risk management system](https://ai-act.astrokube.com/explorer/?q=art-9-risk-management) - [Data and data governance](https://ai-act.astrokube.com/explorer/?q=art-10-data-governance) - [Technical documentation](https://ai-act.astrokube.com/explorer/?q=art-11-technical-documentation) - [Automatic recording of events](https://ai-act.astrokube.com/explorer/?q=art-12-logging) - [Transparency and instructions for deployers](https://ai-act.astrokube.com/explorer/?q=art-13-instructions-for-use) - [Human oversight](https://ai-act.astrokube.com/explorer/?q=art-14-human-oversight) - [Accuracy, robustness and cybersecurity](https://ai-act.astrokube.com/explorer/?q=art-15-accuracy-robustness) - [Conformity assessment](https://ai-act.astrokube.com/explorer/?q=art-43-conformity-assessment) - [EU declaration of conformity and CE marking](https://ai-act.astrokube.com/explorer/?q=art-47-48-declaration-ce-marking) - [Registration in the EU database](https://ai-act.astrokube.com/explorer/?q=art-49-registration) - [Keeping the automatically generated logs](https://ai-act.astrokube.com/explorer/?q=art-19-log-retention) - [Post-market monitoring](https://ai-act.astrokube.com/explorer/?q=art-72-post-market-monitoring) - [Serious incident reporting](https://ai-act.astrokube.com/explorer/?q=art-73-incident-reporting) What you have to be able to produce - Adversarial and injection test suite - Annex IV technical file - Authority notification runbook - Bias examination report - Conformity route decision per system - Dataset cards with provenance - Decision-correlation IDs across services - Declared accuracy levels and metrics - Doc generation wired into CI - Documentation format decision on record - Escalation path for emergent risk - EU declaration of conformity per system - Field-data review cadence - Field-risk signal feed into the register - Foreseeable-misuse analysis per release - Incident classification with regulatory branch - Inference event schema - Instructions for use per system - Kill switch and override, with tests - Living risk register with review cadence - Model performance SLOs with alerts - Named reporting roles - Output metadata deployers can read - Oversight runbook - Oversight UX with override path - Per-run lineage records - Post-market monitoring plan - Registration entries per system - Replay runbook - Representativeness note for the target population - Resource, lifetime and maintenance inputs for the instructions - Restore test on aged logs - Retention budget and DPO sign-off - Retention policy meeting the six-month floor - Risk-to-control mapping in the design docs - Stated assumptions per data set - Tamper-evident log storage - Versioned field telemetry What would change the answer - The Article 6(3) derogation is the only way out, and a system that performs profiling of natural persons never qualifies. Ranking candidates is hard to argue as a narrow procedural task. - Your customers are deployers of this system and carry Article 26 duties, including keeping the logs under their control and telling candidates they are subject to it. - A customer who puts its own brand on your feature becomes its provider under Article 25(1)(a), and you stop being it. [EU Annex III, point 4(a)](https://ai-act.astrokube.com/law/annex-iii/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") [EU Art. 6(2), (3)](https://ai-act.astrokube.com/law/art-6/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") [EU Art. 16](https://ai-act.astrokube.com/law/art-16/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") [EU Art. 26](https://ai-act.astrokube.com/law/art-26/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") [EU Art. 25(1)](https://ai-act.astrokube.com/law/art-25/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") A scenario describes a system we made up, not yours. It is not a classification of your system and not legal advice. Pending review by a named legal reviewer. ## If you would rather not read the law The basics page explains the Regulation's own categories in order: scope, role, tier, date. The engineering view groups the obligations by the platform capability they demand. [Start with the basics →](https://ai-act.astrokube.com/basics/) [Open the engineering view →](https://ai-act.astrokube.com/engineering/) ## About this provision ### Status Upcoming 2 Dec 2027 Moved from ~2 Aug 2026~ ### Regime High-risk ### Binds ProviderDeployer ### Type Article · Chapter III · Section 3 ### Amended by Not amended ### Recitals [66](https://ai-act.astrokube.com/law/recital-66/) ### Related [Article 25](https://ai-act.astrokube.com/law/art-25/) [Article 43](https://ai-act.astrokube.com/law/art-43/) [Article 47](https://ai-act.astrokube.com/law/art-47/) ### Cited capture regulation-2024-1689/en-2026-08-18.html sha256 8f0b656302f9864c… [Authentic text (EUR-Lex) →](http://data.europa.eu/eli/reg/2024/1689/oj) [This version (EUR-Lex) →](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1689-20260727) ### Machine readable [/law/art-16.md](https://ai-act.astrokube.com/law/art-16.md) [/api/law.json](https://ai-act.astrokube.com/api/law.json) ### Found an error? [Write to us →](https://astrokube.com/contact)