If you're a Provider — what's specific to your role

For: provider
Tier: free+
Time: ~12 min

Why you'd do this

Provider (Art. 3(3)) carries the heaviest obligation load under EU AI Act — 184 actionable obligations across 40 articles. Your role-filter view in the dashboard hides the rest, but the work remaining is still substantial. This chapter walks the 6 workflows that consume the most setup time, in the order you typically meet them.

Before you start

Read the Concept Primer chapter first — it defines the role and explains how risk classification gates which articles apply to you
Have your AI system's intended-use documentation handy — most Provider obligations cite back to it (Art. 13, Art. 17, Art. 72)
If you're a non-EU Provider placing your AI on the EU market, you ALSO need an Authorised Representative (Art. 22) — see that persona addendum, the AR carries delegated obligations on your behalf

Step 1

Workflow 1 — Classification (Art. 5, 6, 50)

Before any other Provider obligation kicks in, the AI system has to be classified. You do not pick a class: the Profiling Wizard asks the Art. 5 practices, the Annex I legislation, the Annex III use cases, the Art. 6(3) conditions and the Art. 50 functions, and concludes the result from your answers. The result determines which articles apply at all:

Prohibited practice (Art. 5) → cease and desist; no compliance work to do, the system can't be marketed in the EU
High-risk (Art. 6, Annex I and Annex III) → full Art. 8-27 + 43 stack (the largest part of your obligations)
Not high-risk — Article 50 transparency trigger identified → the Art. 50 transparency obligations (inform users, label deepfakes, etc.)
Not high-risk — no Article 50 transparency trigger identified → no specific obligations

See the chapter Profiling Wizard deep dive for the questions and for where the result is shown.

Step 2

Workflow 2 — Technical documentation (Art. 11 + Annex IV)

Annex IV lists 9 sections of mandatory technical documentation: general description, design specs, training-data methodology, validation procedures, risk-mgmt evidence, change log, post-market monitoring plan, instructions for use, and the EU declaration of conformity itself.

ComplianceLint's Compliance All-in-One Pack export (Business+) produces a regulator-ready bundle that covers Annex IV — see the chapter Compliance All-in-One Pack. For free/starter/pro tiers, the per-article PDFs cover the same content but you assemble them yourself.

Note: the single-document path (Art. 11(2)) applies where your high-risk AI system is related to a product covered by Annex I, Section A (for example a medical device or a toy) and is placed on the market or put into service: one set of technical documentation contains the Annex IV information and the information required by that product legislation. The Profiling Wizard (Starter+) records whether your high-risk AI system is related to a product covered by Annex I, Section A.

Step 3

Workflow 3 — Quality management system (Art. 17)

Providers must establish a documented QMS covering: change control, data management, post-market monitoring procedures, examination and review processes, accountability assignment, and the entire AI lifecycle from design through retirement.

QMS evidence in ComplianceLint is collected through the Human Gates questionnaire for Art. 17 (Pro+ tier). The questionnaire walks all 13 sub-clauses; your answers persist through scans (do not need to re-enter on each scan).

If your organisation is an SME, including a start-up, and has no partner or linked enterprises within the meaning of Recommendation 2003/361/EC, Art. 63(1) lets you comply with certain elements of the QMS in a simplified manner; the Commission shall develop guidelines identifying the elements of the QMS that may be complied with in a simplified manner, and Art. 63(2) keeps every other obligation (including Arts. 9-15, 72 and 73). SMCs are not covered by Art. 63. Separately, Art. 17(2) requires the QMS to be proportionate to the size of your organisation (SMEs, start-ups and SMCs in particular), without lowering the rigour needed for compliance.

Step 4

Workflow 4 — Conformity assessment (Art. 43)

Before placing a high-risk AI on the EU market, Providers must complete a conformity assessment. Two routes exist depending on Annex III sub-category:

Self-assessment based on internal control (Annex VI) — available for most Annex III categories where harmonised standards exist or have been applied in full
Third-party (notified body) assessment (Annex VII) — required for biometrics (Art. 6(1) + Annex III §1) and any case where harmonised standards weren't fully applied

The dashboard's per-article view for Art. 43 surfaces which route applies based on your declared Annex III sub-category. ComplianceLint generates the EU Declaration of Conformity (Pro+ via Human Gates → Declaration PDF) and the Technical Documentation (same path → Technical Doc PDF) — both are regulator-facing artifacts.

Note: notified body certification itself is OUTSIDE ComplianceLint's scope. We produce the dossier; you submit it to the body.

Step 5

Workflow 5 — Post-market monitoring (Art. 72) + serious-incident reporting (Art. 73)

Once your AI is on the market, you must operate a documented post-market monitoring system: collect performance data over the system's lifetime, analyse it, and feed findings back into your QMS. Serious incidents (Art. 73) — defined as those leading to death, serious health harm, infrastructure disruption, fundamental rights breach, or property damage — must be reported to the market-surveillance authority within 15 days of becoming aware (Art. 73(2)) — or 2 days for widespread / fatal incidents.

ComplianceLint's role here is procedural — the Human Gates questionnaires for Art. 72 and Art. 73 collect your monitoring plan and incident-response procedures. Actual incident reporting happens through national-authority portals, not ComplianceLint.

Step 6

Workflow 6 — GPAI obligations (Art. 51-55) — only if you're a GPAI provider

If your AI system is a General-Purpose AI model (Art. 3(63)) — broadly: a model capable of competently performing a wide range of distinct tasks, not narrowly scoped — the Art. 51-55 obligations (28) come on top. The general-purpose AI model question in the Profiling Wizard (Starter+) switches them on or off.

Key GPAI-specific obligations:

Art. 51 — Classification thresholds: declare whether your model crosses the systemic-risk FLOPs threshold (10²⁵ FLOPs training compute)
Art. 53 — Provider obligations: technical documentation covering architecture + training data summaries; copyright policy compliance; downstream-provider documentation
Art. 54 — Authorised representative: GPAI providers established outside the EU MUST appoint one (the obligation is stricter than for non-GPAI Providers)
Art. 55 — Systemic-risk additional obligations: model evaluation, adversarial testing, incident tracking, cybersecurity protection — all enforceable from 2025-08-02

If your model is not a general-purpose AI model, answer No to the GPAI question in the Profiling Wizard — the dashboard marks the Art. 51-55 obligations as not applicable. The Art. 54 duties of an authorised representative stay visible if you answered that you are one.

What can go wrong

Dashboard shows all 255 obligations for your repo even though your AI system is not high-risk — You're on the Free tier — applicability customization (auto-NA based on profile signals) is gated to Starter+ (applicabilityCustomization flag). Free shows the worst-case universal view. Either upgrade or ask your AI to mark each non-applicable finding as a rebuttal (it invokes cl_update_finding(action="rebut") per finding).
You're a non-EU Provider and unsure which obligations transfer to your Authorised Representative — Per Art. 22(3) + Art. 25, the AR is responsible for: keeping the EU declaration of conformity + technical doc available to authorities (10y), cooperating with authorities, terminating the mandate if Provider acts contrary to AI Act. Your CORE design + risk + post-market obligations stay with you as Provider. The AR is your EU contact point, not a co-Provider.

Last updated: 2026-10-29

If you're a Provider — what's specific to your role

For: provider
Tier: free+
Time: ~12 min

Why you'd do this

Before you start

Read the Concept Primer chapter first — it defines the role and explains how risk classification gates which articles apply to you
Have your AI system's intended-use documentation handy — most Provider obligations cite back to it (Art. 13, Art. 17, Art. 72)
If you're a non-EU Provider placing your AI on the EU market, you ALSO need an Authorised Representative (Art. 22) — see that persona addendum, the AR carries delegated obligations on your behalf

Step 1

Workflow 1 — Classification (Art. 5, 6, 50)

Prohibited practice (Art. 5) → cease and desist; no compliance work to do, the system can't be marketed in the EU
High-risk (Art. 6, Annex I and Annex III) → full Art. 8-27 + 43 stack (the largest part of your obligations)
Not high-risk — Article 50 transparency trigger identified → the Art. 50 transparency obligations (inform users, label deepfakes, etc.)
Not high-risk — no Article 50 transparency trigger identified → no specific obligations

See the chapter Profiling Wizard deep dive for the questions and for where the result is shown.

Step 2

Workflow 2 — Technical documentation (Art. 11 + Annex IV)

Step 3

Workflow 3 — Quality management system (Art. 17)

Step 4

Workflow 4 — Conformity assessment (Art. 43)

Before placing a high-risk AI on the EU market, Providers must complete a conformity assessment. Two routes exist depending on Annex III sub-category:

Self-assessment based on internal control (Annex VI) — available for most Annex III categories where harmonised standards exist or have been applied in full
Third-party (notified body) assessment (Annex VII) — required for biometrics (Art. 6(1) + Annex III §1) and any case where harmonised standards weren't fully applied

Note: notified body certification itself is OUTSIDE ComplianceLint's scope. We produce the dossier; you submit it to the body.

Step 5

Workflow 5 — Post-market monitoring (Art. 72) + serious-incident reporting (Art. 73)

Step 6

Workflow 6 — GPAI obligations (Art. 51-55) — only if you're a GPAI provider

Key GPAI-specific obligations:

Art. 51 — Classification thresholds: declare whether your model crosses the systemic-risk FLOPs threshold (10²⁵ FLOPs training compute)
Art. 53 — Provider obligations: technical documentation covering architecture + training data summaries; copyright policy compliance; downstream-provider documentation
Art. 54 — Authorised representative: GPAI providers established outside the EU MUST appoint one (the obligation is stricter than for non-GPAI Providers)
Art. 55 — Systemic-risk additional obligations: model evaluation, adversarial testing, incident tracking, cybersecurity protection — all enforceable from 2025-08-02

What can go wrong

Dashboard shows all 255 obligations for your repo even though your AI system is not high-risk — You're on the Free tier — applicability customization (auto-NA based on profile signals) is gated to Starter+ (applicabilityCustomization flag). Free shows the worst-case universal view. Either upgrade or ask your AI to mark each non-applicable finding as a rebuttal (it invokes cl_update_finding(action="rebut") per finding).
You're a non-EU Provider and unsure which obligations transfer to your Authorised Representative — Per Art. 22(3) + Art. 25, the AR is responsible for: keeping the EU declaration of conformity + technical doc available to authorities (10y), cooperating with authorities, terminating the mandate if Provider acts contrary to AI Act. Your CORE design + risk + post-market obligations stay with you as Provider. The AR is your EU contact point, not a co-Provider.

Last updated: 2026-10-29

If you're a Provider — what's specific to your role

Why you'd do this

Before you start

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

What can go wrong

Related

If you're a Provider — what's specific to your role

Why you'd do this

Before you start

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

What can go wrong

Related