Provider Obligations – Art. 16–21
Complete Catalogue of Obligations
Art. 16 summarises all obligations that a provider of high-risk AI systems must fulfil:
| Obligation | Article | Description |
|---|---|---|
| Ensure conformity | Art. 16(a) | System complies with Art. 8–15 |
| Labelling | Art. 16(b) | Name, brand, contact address on system or packaging |
| QMS | Art. 16(c) + Art. 17 | Implement a quality management system |
| Retain documentation | Art. 16(d) + Art. 18 | Retain technical documentation for 10 years |
| Retain logs | Art. 16(e) + Art. 19 | Retain automatically generated logs |
| Conformity assessment | Art. 16(f) + Art. 43 | Carry out before placing on the market |
| EU declaration of conformity | Art. 16(g) + Art. 47 | Draw up and keep available |
| CE marking | Art. 16(h) + Art. 48 | Affix (on system, packaging or accompanying documentation) |
| Registration | Art. 16(i) + Art. 49 | Register in the EU database |
| Corrective measures | Art. 16(j) + Art. 20 | In case of non-conformity: correction, recall, deactivation |
| Cooperation with authorities | Art. 21 | Demonstrate conformity upon request |
Retention Periods
- Technical documentation: 10 years after placing on the market (Art. 18)
- Automatic logs: To the extent under the provider's control (Art. 19)
- EU declaration of conformity: 10 years (Art. 47)
Post-Market Monitoring
Providers must establish a post-market monitoring system (Art. 72), proportionate to the risk level. For high-risk AI, this system must actively and systematically collect and analyse relevant data on the system's performance.