Artificial intelligence

AI Act: obligations for providers, deployers, importers and distributors by level of risk

Phased application from 2 February 2025. The system inventory, the organisation's role and the risk classification determine the obligations.

Let's talkStarting assessment

The EU Artificial Intelligence Act classifies AI systems by level of risk and assigns different obligations to providers, deployers, importers and distributors. It applies in phases: the first step for any organisation is knowing which systems it uses, in which role and with what risk.

Who it applies to

  • Those who develop or place AI systems or models on the market (providers).
  • Those who use AI systems in their professional activity (deployers), including systems bought from third parties.
  • Importers and distributors of AI systems in the Union.

What it requires

  1. 01

    Prohibited practices

    Ban on the AI practices listed in Article 5, already in force.

  2. 02

    AI literacy

    Measures to ensure a sufficient level of competence among staff using AI systems.

  3. 03

    High-risk systems

    Risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness.

  4. 04

    Deployer obligations

    Use according to instructions, human oversight, monitoring, log retention and, in some cases, a fundamental rights impact assessment.

  5. 05

    Transparency

    Information to people interacting with AI systems or with generated content.

  6. 06

    General-purpose models

    Documentation, a copyright policy and, for models with systemic risk, additional obligations.

Timeline

  1. 1 Aug 2024Entry into force.
  2. 2 Feb 2025Prohibited practices and AI literacy.
  3. 2 Aug 2025Obligations for general-purpose AI models and governance.
  4. 2026–2027Progressive application of the other obligations, including those on high-risk systems.

Some deadlines for high-risk systems are subject to amendment proposals at EU level: the timeline should be checked against the version in force.

EVIDEVO

How EVIDEVO manages controls and evidence for AI Act

AI system inventory

Every system has an owner, the organisation's role, a risk classification and its rationale.

Obligations by role and risk

Applicable requirements are activated according to role and risk classification, with the dates of the application timeline.

Assessments and decisions on record

Impact assessments, human oversight measures and decisions are recorded with date and author.

Link to ISO/IEC 42001

The inventory and assessments are the same ones used for the ISO/IEC 42001 management system requirements.

Data for illustrative purposes only, not real

What can be exported

  • AI system inventory with classification
  • Evidence by obligation and by system
  • Log of decisions and assessments

Capabilities for AI Act

How to determine whether AI Act applies

Sector, size and services define the scope. The starting assessment identifies it and sets the priorities.

Starting assessment

Frameworks that share evidence

Informational summary, updated October 2026. Not legal advice: applicability and obligations should be checked against the official text and the specific case.

A thirty-minute presentation based on the organisation's scope.

It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.

Let's talk