How to make an AI system compliant with the EU AI Act

Article 4 requires every provider and deployer to ensure a sufficient level of AI literacy for the persons involved in the operation and use of AI systems. TrustFlow must verify that training and awareness programmes are in place, both at the organisational level and at the level of each system.

Article 5 defines the AI practices that are strictly prohibited. TrustFlow must make it possible to verify that no AI system in the organisation falls within the scope of these prohibited practices, and that a process for detecting drift is in place.

Article 9 requires an iterative and documented risk management system covering the entire lifecycle. TrustFlow must verify that risks are identified, that residual risks are communicated to deployers, and that mitigation measures are in place.

Article 10 requires rigorous data governance for high-risk AI systems. TrustFlow must verify that the data governance policy is documented (provider) and that input data are relevant and representative (deployer).

Article 11 requires complete technical documentation to be drawn up and kept up to date before placing on the market. TrustFlow must verify that this documentation exists (provider) and that the deployer has obtained and followed the instructions for use.

Article 12 requires high-risk AI systems to allow for the automatic recording of events throughout their lifecycle. TrustFlow must verify the existence of a log retention policy, the proper functioning of logging, and the accessibility of logs.

Article 13 requires high-risk AI systems to be sufficiently transparent so that deployers can interpret the outputs. TrustFlow must verify that the instructions for use are complete and that residual risks are communicated.

Article 14 requires effective human oversight during the use of high-risk AI systems. TrustFlow must verify that an escalation procedure exists, that the system is designed for human oversight, and that the overseers are competent.

Article 15 requires an appropriate level of accuracy, robustness and cybersecurity throughout the lifecycle. TrustFlow must verify the cybersecurity measures, the accuracy and robustness testing, and the resilience against adversarial attacks.

Article 17 requires providers of high-risk AI systems to put in place a quality management system (QMS) covering all aspects of the lifecycle. TrustFlow must verify that this QMS is documented and implemented.

Article 18 requires documentation to be kept for a minimum of 10 years. TrustFlow must verify that the document retention policy is in place.

Article 19 requires the retention of automatically generated logs (minimum 6 months). TrustFlow reuses the verifications of Article 12 (EX-006).

Article 20 requires providers to take immediate corrective actions and to inform the parties concerned in the event of non-conformity. TrustFlow must verify the existence of non-conformity management procedures and the traceability of corrective actions.

Articles 21 and 26(12) require cooperation with competent authorities. TrustFlow must verify that a cooperation procedure is in place and that the documentation is accessible.

Article 47 requires the provider to draw up an EU declaration of conformity and to keep it for 10 years. TrustFlow must verify its existence and retention.

Article 48 requires CE marking on high-risk AI systems. TrustFlow must verify that this marking is affixed.

Article 49 requires registration in the EU database before placing on the market or deployment. TrustFlow must verify this registration.

Article 50 imposes transparency obligations for ALL AI systems (not only high-risk): inform users that they are interacting with an AI, and mark AI-generated content.

Article 26(9) requires the deployer to use the information provided by the provider to carry out a data protection impact assessment (DPIA).

Article 27 requires a fundamental rights impact assessment (FRIA) before any deployment of certain high-risk AI systems. TrustFlow must verify that this assessment is carried out and notified.

Article 72 requires providers of high-risk AI systems to establish and document a proportionate post-market monitoring system, based on a plan integrated into the technical documentation (Annex IV). This system actively collects, documents and analyses operational data (provided by deployers or through other sources) to evaluate whether the system remains continuously compliant with high-risk requirements and to enable detection of drift throughout the lifecycle. Deployers contribute by monitoring the operation of the system in accordance with the instructions for use (Art. 26(5)) and by reporting relevant information back to the provider. The Commission must publish a plan template by 2 February 2026.

Article 73 requires providers of high-risk AI systems to report any serious incident to the market surveillance authorities, with strict deadlines: 15 days maximum as a general rule, 2 days in the event of a widespread infringement or a serious incident within the meaning of Art. 3(49)(b), and 10 days in the event of death. Deployers must report incidents to the provider as soon as they become aware of them. Following the report, the provider shall, without delay, perform the necessary investigations (risk assessment, corrective action) in cooperation with the competent authorities and the notified body. A failure to report under Article 26 (deployer) exposes the party to an administrative fine of up to EUR 15 million or 3% of worldwide turnover (Art. 99(4)).

Article 16(l) requires providers to ensure that the high-risk AI system complies with accessibility requirements. TrustFlow must verify this compliance.

Article 43 defines the conformity assessment procedures. TrustFlow must verify that the appropriate procedure has been followed.

Article 22 requires non-EU providers to appoint an authorised representative in the Union. TrustFlow must verify this appointment and the representative's powers.

Article 25 defines the responsibilities along the value chain. TrustFlow must verify that contractual responsibilities are clear and that the role of each actor is analysed.

Article 26(1) requires the deployer to use the system in accordance with the provider's instructions.

Article 26(4) requires the deployer to ensure the relevance and representativeness of the input data.

Article 26(11) requires natural persons to be informed that they are subject to the use of a high-risk AI system when it makes or assists in making decisions concerning them.

Article 26(7) requires workers' representatives and workers to be informed before the use of a high-risk AI system at the workplace.

Article 53 imposes documentation, transparency and copyright compliance obligations on providers of general-purpose AI (GPAI) models.

Article 55 imposes enhanced obligations on providers of GPAI models with systemic risk: adversarial evaluations, risk mitigation, incident reporting, and cybersecurity.

Article 86 grants persons affected by a decision based on a high-risk AI system (Annex III, excluding point 2) the right to obtain a clear explanation of the role of the AI system in the decision and of its main elements. The deployer must put in place the organisational and technical means to respond to this right. This right is complementary to the information obligation in Article 26(11) (EX-029), which covers prior information, whereas Article 86 covers the a posteriori explanation of a specific decision.