European UnionAI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems)
Regulation (EU) 2024/1689, Article 111(2)
An AI risk obligations rule binding public and private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Market targeting, Operator establishment, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- If you are a provider or deployer of a high-risk AI system intended to be used by public authorities, and the system was placed on the market or put into service before Chapter III applies to it, take the necessary steps to comply with the Regulation's requirements and obligations by , regardless of whether the system is later significantly redesigned.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
Who enforces it
Settledness
- As of
- Open questions
- What design change is 'significant' under Article 111(2), so that a high-risk AI system placed on the market before the application date of Chapter III comes within the Regulation?
What it makes you log
Logging duty
Article 111(2) is a transitional compliance deadline; it names no log or record duty of its own. The record-keeping duties a legacy public-authority-intended system must meet by are Articles 12, 19 and 21(2)'s, each a separate duty of its own.
- Kind
- None
- As of
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
Article 111(2) grandfathers a high-risk AI system already placed on the market or put into service before Chapter III's application date, exempting it from the Regulation unless it is significantly redesigned after that date; the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) updated only the grandfather clause's own reference point, from the fixed date of to the Chapter III application date itself, now or depending on classification route.
In any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by , whether or not the system is significantly redesigned; that sentence, and the date it sets, are unchanged by the Digital Omnibus, appearing in identical substance in both the original 2024 text and the Omnibus's replacement of the paragraph.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .