# High-Risk AI System Obligations

This reference covers the full compliance checklist for high-risk AI systems under the EU AI Act. Only read this file if the project contains a high-risk AI system.

## Table of Contents
1. [Provider Obligations](#provider-obligations)
2. [Deployer Obligations](#deployer-obligations)
3. [Fundamental Rights Impact Assessment (FRIA)](#fria)

---

## Provider Obligations

### Risk Management System (Art. 9)
- Establish and maintain a risk management system throughout the AI system's lifecycle
- Identify and analyze known and reasonably foreseeable risks
- Adopt risk management measures: elimination, mitigation, information/training
- Test against risk management measures before and throughout the lifecycle

### Data Governance (Art. 10)
- Training, validation and testing datasets must be relevant, representative, and free of errors
- Data sets must consider the geographic, contextual, behavioral or functional setting
- Appropriate bias detection and correction measures

### Technical Documentation (Art. 11)
- Draw up technical documentation BEFORE placing the system on the market
- Must demonstrate conformity with requirements
- Include: general description, elements of development, monitoring/functioning info, risk management info

### Record-Keeping / Automatic Logging (Art. 12)
- System must allow automatic recording of events (logs)
- Logging capabilities must ensure traceability of functioning
- Logs must be retained for a period appropriate to the intended purpose (minimum 6 months for deployers)

### Transparency & Information to Deployers (Art. 13)
- AI systems must be designed to be sufficiently transparent for deployers to interpret output
- Instructions for use must include: provider identity, system characteristics, performance metrics, known limitations, human oversight measures, computational resource requirements, maintenance info

### Human Oversight (Art. 14)
- System must be designed for effective human oversight during use
- Humans must be able to: fully understand capacities/limitations, monitor operation, interpret output, decide not to use or override output, intervene or stop the system
- For identification systems: at least two natural persons must verify results before acting

### Accuracy, Robustness & Cybersecurity (Art. 15)
- Levels of accuracy and metrics declared in instructions for use
- Resilient against errors, faults, inconsistencies
- Technical redundancy solutions (failsafes, fallback plans)
- Resilient against unauthorized third parties exploiting vulnerabilities
- Appropriate measures against data poisoning, adversarial examples, model manipulation

### Quality Management System (Art. 17)
- Written policies and procedures for overall quality management
- Data management, design/development techniques, testing before/during/after market
- Risk management, post-market monitoring, incident reporting
- Communication with authorities, record-keeping, resource management

### Conformity Assessment (Art. 43)
- Internal control procedure (Annex VI) for most Annex III systems
- Third-party conformity assessment for biometric systems and critical infrastructure
- CE marking upon successful assessment

### EU Database Registration (Art. 49)
- Providers and deployers must register high-risk AI systems in the EU database before placing on market or putting into service

## Deployer Obligations

### Article 26 — Core deployer duties:
1. Use the AI system according to provider's instructions for use
2. Assign human oversight to competent, trained persons with necessary authority
3. Ensure input data is relevant and sufficiently representative
4. Monitor the AI system's operation based on instructions for use
5. Keep logs generated by the system for at least 6 months
6. Inform workers' representatives and affected workers about high-risk AI use in the workplace
7. Use information from Art. 13 to comply with DPIA obligations under GDPR

### Article 27 — FRIA

## FRIA

The Fundamental Rights Impact Assessment applies to:
- **Public bodies** deploying high-risk AI systems
- **Private entities providing public services** deploying high-risk AI systems
- Deployers of high-risk systems in categories 5(a) (creditworthiness) and 5(b) (insurance risk assessment)

A FRIA must include:
1. Description of the deployer's processes where the AI system will be used
2. Period and frequency of intended use
3. Categories of natural persons and groups likely to be affected
4. Specific risks of harm likely to impact identified categories of persons/groups
5. Description of human oversight measures
6. Measures to be taken in case of materialization of risks
7. Governance and complaint mechanisms

The FRIA must be completed BEFORE first use of the high-risk AI system. Notify the national market surveillance authority of the results.

If using a DPIA under GDPR Art. 35, the FRIA can complement it rather than duplicate it.