EU AI Act Art. 16 — Obligations of providers of high-risk AI systems
Article 16 is the provider's to-do list: comply with the core requirements, put your name on the system, run a quality management system, keep documentation and logs, run the conformity assessment, sign the EU declaration, apply CE marking, and register the system in the EU database.
At a glance
What this article requires
- Providers must ensure their systems meet all Section 2 requirements (Art. 8).
- They must indicate their name and contact details on the system or its packaging.
- They must run a quality management system (Art. 17) and keep documentation (Art. 18) and logs (Art. 12).
- They must run the conformity assessment (Art. 43), sign the EU declaration (Art. 47), affix CE marking (Art. 48), and register in the EU database (Art. 49).
- They must take corrective actions, cooperate with authorities, and meet accessibility requirements.
Scope
Who this applies to
Providers — whoever develops a high-risk AI system and places it on the EU market or puts it into service, including deployers who modify systems enough to become providers (Art. 26(9)).
Obligations
What you must actually do
Build the compliance machine
The quality management system (Art. 17) is the backbone that produces the documentation, logs, and evidence the rest of Article 16 requires.
Run the conformity route before market entry
Complete the Art. 43 assessment, sign the EU declaration of conformity (Art. 47), and affix CE marking (Art. 48) before placing the system on the market.
Register before you launch
Register the system in the EU database (Art. 49) and keep the record updated when the system changes.
Action plan
Practical first steps
- 1
Turn Article 16 into a launch checklist with owners and deadlines.
- 2
Decide your conformity route early — biometrics have stricter, third-party routes.
- 3
Prepare the EU database registration fields as soon as the system design is frozen, well before go-live.
Penalty exposure
Provider obligation failures sit in the general tier: up to €15 million or 3% of global annual turnover.
FAQ
Questions about Art. 16
Am I a provider if I build AI only for internal use?
If you develop high-risk AI and put it into service in the EU — even internally — you are a provider and bear the full Article 16 obligations.
What if I buy a high-risk system and customise it?
Light configuration is deployer territory. If you materially modify the system or change its intended purpose, you step into the provider role under Art. 26(9) and inherit Article 16.
Sources
Citations & further reading
Related
More article explainers
Wondering which articles apply to your AI?
Describe your system in the free Risk Scanner and get a preliminary risk read with the obligations that likely apply — in seconds.
Check my use casePreliminary EU AI Act clarity summary. Not legal advice.