AI Act
EU AI Act: from obligation to evidence.
Compliance starts with the actual use, the entity acting, the role it assumes and the version in service. We then build the chain from requirement to control, test, evidence and decision.
From actual use to evidence
- 01
Qualify
System and role
- 02
Connect
Requirement and control
- 03
Evidence
Result and follow-up
Every requirement has an owner.
Qualification
Qualify the system and your organisation’s role
Qualification starts from the system actually put into service or used, not from the model name or the classification announced by a supplier. We examine separately prohibited practices, high risk, transparency and the general-purpose model regime — these regimes overlap — and we establish, for each legal entity, whether it is a provider, deployer, importer or distributor. Rebranding or a change of intended purpose can transfer the provider’s obligations to you.
Controls
Connect every requirement to a testable control
A policy does not demonstrate that a control works. The compliance matrix links each requirement to the risk addressed, the owner, the technical or organisational mechanism, the test procedure, the result and the retained evidence. For a provider: risk management, data quality, technical documentation, logs, robustness, quality system, EU declaration. For a deployer: instructions, human oversight, monitoring, log retention, impact assessment where required.
Monitoring
Keep compliance alive against the production version
The file evolves with the system. Versions, performance, incidents, changes, complaints and corrective measures stay attached to the production baseline. Any significant modification triggers an impact review and, where necessary, a fresh qualification of role or risk. This service combines with AI production assurance.
TimelineThe deadlines that concern you, by regime
The dates below were checked on 5 September 2026 in the consolidated regulation. Each deadline is linked to its primary source.
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited practices; AI literacy duty (Art. 4) |
| 2 August 2025 | Obligations for providers of general-purpose AI models |
| 2 August 2026 | General application; transparency (Art. 50) |
| 2 December 2026 | Prohibitions added to Article 5 by Regulation (EU) 2026/1744 |
| 2 December 2027 | High-risk systems under Annex III |
| 2 August 2028 | High-risk systems embedded in Annex I products |
2 February 2025
- Prohibited practices; AI literacy duty (Art. 4)
2 August 2025
- Obligations for providers of general-purpose AI models
2 August 2026
- General application; transparency (Art. 50)
2 December 2026
- Prohibitions added to Article 5 by Regulation (EU) 2026/1744
2 December 2027
- High-risk systems under Annex III
2 August 2028
- High-risk systems embedded in Annex I products
Limits
What we are not
TRARDI Group is neither a conformity-assessment body nor a notified body. We prepare and test the technical, organisational and documentary arrangement; questions of legal interpretation are identified and referred to your counsel. The GDPR and sector-specific law continue to apply according to the processing concerned.
Sources and references
- Regulation (EU) 2024/1689 — consolidated text (new tab)
Roles, requirements, post-deployment monitoring and current timeline.
- European Commission — EU AI Act application and timeline (new tab)
Risk regimes, requirements, governance and deadlines following the AI Omnibus.
- European Commission — EU AI Act enforcement framework (new tab)
Competent authorities, enforcement powers and implementation timeline.
- CNIL — practical guidance on AI systems (new tab)
GDPR qualification, purpose, legal basis, impact assessment, design, information and security.
Frequently asked questions
Is a company that buys an AI tool merely a user?
No. Under the EU AI Act, it may be the deployer of the system. Rebranding, a substantial modification or a change of intended purpose may also transfer the provider’s obligations to it.
Does the risk category determine every obligation?
No. The entity’s role, prohibited practices, high-risk rules, transparency, general-purpose AI models and other applicable law — including the GDPR and sector-specific law — must be examined separately.
Does TRARDI Group issue EU AI Act certification?
No. We prepare and test the technical, organisational and documentary arrangement. Where a conformity assessment or a notified body is required, that falls to the authorised actors.
When was this page checked?
The content and timeline were checked on 5 September 2026 in the consolidated regulation; the primary sources are published on the page.
First conversation
Which system must you qualify before December 2027?
State the system, its use and your presumed role. We reply with a first reasoned qualification and what it implies.