Providers must meet the full set of provider duties for high-risk AI

Practical action

Map each Article 16 point to an owner and an evidence location in a compliance matrix for every high-risk system.

Who does it apply to?

Any provider placing a high-risk AI system on the EU market or putting it into service, wherever established.

Actors

Provider / developer

Sectors

Cross-sector / all sectors

Use cases

AI in hiring and employmentBiometrics and facial recognitionAI in finance, credit and insuranceSafety-critical and infrastructure

Applies from: 2 December 2027

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesPolicyExecutive sponsor for AI · annual
  AI governance policy and accountability structure

  Serves 16 recorded duties · evidence: AI policy, Board or executive approval of the AI policy, AI governance forum minutes

  Assigns each provider duty to a named owner with a reporting line.

• supportsPolicyQuality lead · annual
  Quality management system for AI development and supply

  Serves 3 recorded duties · evidence: AI quality management system manual, Internal audit of the AI management system, Management review minutes

  The QMS is where most Article 16 duties are operated.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• AI System Inventory

  Register · XLSX and DOCX · v6

• EU AI Act Role and Risk Classifier

  Checklist · XLSX · v4

• AI Acceptable Use Policy

  Policy · DOCX · v1

• AI Governance Policy and RACI

  Policy · DOCX and XLSX · v5

All 12 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every European Union duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Providers must meet the full set of provider duties for high-risk AI (EU AI Act)” [AIPT-OBL-0023, verified 26 September 2026]. https://aipolicytracker.org/id/AIPT-OBL-0023 (accessed 8 November 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0023: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, Official Journal of the European Union, https://eur-lex.europa.eu/eli/reg/2024/1689/oj.

@misc{aipolicytracker2026_providersmustmeetthefull,
  author       = {{AIPolicyTracker}},
  title        = {{Providers must meet the full set of provider duties for high-risk AI (EU AI Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/eu-ai-act-art-16-provider-obligations}},
  url          = {https://aipolicytracker.org/obligations/eu-ai-act-art-16-provider-obligations},
  urldate      = {2026-11-08},
  note         = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}

Change history

Similar obligations in other instruments

• Use high-risk AI as instructed, monitor it and inform affected people — EU AI Act, European Union
• Providers must supply conformity evidence and log access to authorities on request — EU AI Act, European Union
• Non-EU providers must appoint an EU authorised representative for high-risk AI — EU AI Act, European Union
• Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI — EU AI Act, European Union
• Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually — EU AI Act, European Union
• Providers of GPAI models must notify the Commission within two weeks of meeting the systemic-risk threshold — EU AI Act, European Union
• Non-EU providers of GPAI models must appoint an EU authorised representative — EU AI Act, European Union
• Frontier developers must protect employees who report catastrophic-risk concerns — California SB 53, California (United States)