European UnionAI Act, Article 16 (obligations of providers of high-risk AI systems)
Regulation (EU) 2024/1689, Article 16
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting, Place of effect
- Obligation class
- Governance, Disclosure, DPIA, Licensing
- Audit expectation
- on_request
- Who audits it
- Regulator
As of .
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- If you are the provider of a high-risk AI system, indicate your name, registered trade name or registered trade mark and the address at which you can be contacted on the system or, where that is not possible, on its packaging or its accompanying documentation.no control in the NIST AI RMF
- Upon a reasoned request of a national competent authority, demonstrate that your high-risk AI system conforms with the Chapter III, Section 2 requirements.NIST AI RMFGOVERN 1.1
- Ensure that your high-risk AI system complies with accessibility requirements in accordance with Directives (EU) 2016/2102 and (EU) 2019/882.no control in the NIST AI RMF
- Ensure the system undergoes the relevant conformity assessment procedure under Article 43 before you place it on the market or put it into service, draw up an EU declaration of conformity under Article 47, affix the CE marking under Article 48, and comply with the registration obligations of Article 49(1).NIST AI RMFMANAGE 1.1NIST AI RMFGOVERN 1.1
- Article 16 also makes these your obligations as provider, each set out in its own Article: compliance with the Chapter III, Section 2 requirements, a quality management system under Article 17, keeping the documentation referred to in Article 18, keeping the logs referred to in Article 19 when they are under your control, and the corrective actions and information required by Article 20.
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- MANAGE 1.1A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-10Intellectual Property
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Private right of actionNo
Penalty structure
Article 99(4)(a): non-compliance with the obligations of providers under Article 16 is fined up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. Article 16 is the Article that point (a) names, so every obligation this row lists is fined on that scale; Article 99(6) requires the lower of the two amounts for an SME, including a start-up; Article 99(6a), inserted by Regulation (EU) 2026/1744, gives the same lower-of treatment to a small mid-cap enterprise, since both apply to paragraph 4 fines.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 3
Who enforces it
Settledness
- As of
- Open questions
- Does Article 16, point (l), require a high-risk AI system to meet the accessibility requirements of Directives (EU) 2016/2102 and (EU) 2019/882 where the system is not itself a product, service, website or mobile application within those Directives' own scope?
What it makes you log
Who may demand the log
Regulator
Logging duty
Point (k) requires the provider to demonstrate the system's conformity upon a reasoned request of a national competent authority, which cannot be done without a record of how conformity was established. Article 16 does not itself say what must be kept or for how long: points (d) and (e) make Article 18's documentation keeping and Article 19's log keeping the provider's obligations, and their contents and periods are set in those Articles.
- Kind
- Implicit
- As of
- Provision
- Article 16, point (k)
- Trigger
- high_risk_systems
What this law does
Article 16 lists the obligations of providers of high-risk AI systems, and most of its points make a duty set out in another Article the provider's own: compliance with the Chapter III, Section 2 requirements (point (a)), a quality management system complying with Article 17 (point (c)), keeping the documentation referred to in Article 18 (point (d)), keeping the logs referred to in Article 19 when they are under the provider's control (point (e)), and the corrective actions and information required by Article 20 (point (j)).
Article 16, points (f) to (i), require the provider to ensure the system undergoes the relevant conformity assessment procedure under Article 43 before it is placed on the market or put into service, to draw up an EU declaration of conformity under Article 47, to affix the CE marking under Article 48, and to comply with the registration obligations of Article 49(1).
Article 16 also requires the provider to indicate its name, registered trade name or registered trade mark and the address at which it can be contacted on the system or, where that is not possible, on its packaging or accompanying documentation (point (b)), to demonstrate the system's conformity with the Section 2 requirements upon a reasoned request of a national competent authority (point (k)), and to ensure the system complies with accessibility requirements in accordance with Directives (EU) 2016/2102 and (EU) 2019/882 (point (l)).
Article 99(4), point (a), sets the administrative fine for non-compliance with the obligations of providers pursuant to Article 16.
Article 16 sits in Chapter III, Section 3, so like Article 12 it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) wrote into Article 113: for a system classified as high-risk under Article 6(2) and Annex III, and for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general application date.
Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by .
Article 16 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes biometric data.