High-risk AI obligations: a deployer and provider checklist

Once a system is high-risk under the EU AI Act, the hard part is operationalising Chapter III duties across the value chain. Roles matter: provider, deployer, importer, distributor, and authorised representatives each carry distinct responsibilities.

This is a practitioner checklist aligned to the Act’s themes. Confirm specifics with counsel for your facts.

Provider-side themes

• Risk management system — iterative identification and mitigation of risks to health, safety and fundamental rights across the lifecycle.
• Data and data governance — training, validation and testing data meeting quality criteria appropriate to the intended purpose.
• Technical documentation — sufficient for authorities and notified bodies to assess compliance (Annex IV style content).
• Record-keeping / logs — automatic logging capabilities to a level that supports post-market monitoring and incident analysis.
• Transparency to deployers — instructions for use that enable deployers to meet their duties.
• Human oversight — design measures so natural persons can oversee the system effectively.
• Accuracy, robustness, cybersecurity — appropriate performance and resilience against errors and attacks.
• Quality management / conformity — procedures and, where required, third-party involvement before CE marking and placing on the market.

Deployer-side themes

Deployers are not passive consumers. Typical expectations include:

• Using the system according to instructions for use.
• Assigning human oversight to competent people.
• Ensuring input data is relevant and sufficiently representative for the use context.
• Monitoring operation and suspending use when risk materialises.
• Keeping logs under their control for an appropriate period.
• Carrying out a fundamental rights impact assessment where the Act requires one for certain deployers and use cases.
• Informing workers and their representatives when high-risk AI is used in the workplace, where required.

Evidence you will be asked for

Auditors and authorities rarely accept narrative alone. Useful artefacts include: intended-purpose statements, data lineage summaries, evaluation reports (fairness, robustness, security), oversight playbooks, change logs, and incident records. Hash-chained evidence storage helps show that artefacts were not silently rewritten after an incident.

Sequencing that works in practice

1. Freeze intended purpose and role (provider vs deployer).
2. Classify against Annex III / Annex I.
3. Open a conformity / FRIA workstream in parallel with engineering.
4. Attach evidence to each control — not a single PDF dump at the end.
5. Reassess when purpose, model or population shifts.

V77 Trust’s assessment, evidence vault, FRIA/DPIA templates and auditor workspace are built around that sequence.