Why now · the regulation, factually
The obligations land in waves.
Three are already in force. The big one, high-risk systems, lands on 2 December 2027. An Annex IV file takes months, so the work starts now, and the companies that buy from you have started asking.
The timeline · as amended by Regulation (EU) 2026/1744
Prohibited practices, AI literacy
Unacceptable-risk uses banned (Art. 5). Staff operating AI must be AI-literate (Art. 4), whatever the risk level.
General-purpose AI
Obligations for providers of GPAI models (Arts. 53–55), governance, and the penalty regime.
Transparency (Art. 50)
Chatbots must say so, synthetic content and deepfakes must be marked. Marking of systems placed on the market before this date: from 2 Dec 2026.
Annex III high-risk systems
Credit scoring, insurance pricing, recruitment, education, essential services, biometrics. Technical documentation, risk management, logging, oversight, conformity assessment, registration.
Annex I embedded high-risk
AI as a safety component of products under Union harmonisation legislation (machinery, medical devices, vehicles).
An Annex IV file takes months to assemble. The companies that buy from you have already started asking for it.
Provider or deployer: which file is yours →Always confirm against the Official Journal before a compliance decision. Euridium is decision support, not a legal verdict.
Your role decides your file
Build it, or use it: two different files.
You build the system: provider
You develop the model or the system and put it on the market under your name. Your file is the heavy one.
- Technical documentation (Annex IV, Art. 11)
- Risk management, data governance, logging (Arts. 9, 10, 12)
- Human oversight, accuracy, robustness (Arts. 14, 15)
- Conformity assessment, CE marking, registration (Arts. 43, 48, 49)
You use the system: deployer
You run someone else’s system under your own authority: a bank using a scoring model, an employer using a screening tool. Lighter, but not light.
- Use as instructed, human oversight, logs (Art. 26)
- Fundamental-rights impact assessment for credit and insurance (Art. 27)
- Inform workers and affected persons
- Verify your provider’s file before you rely on it
A deployer that rebrands, repurposes or substantially modifies a system becomes its provider (Art. 25). The assessment catches this; most spreadsheets do not.
Does it apply to you?
Six questions, two minutes. Whether you are in scope, in which role, and at what risk level. No account, nothing leaves your browser.