Twelve duties, one article
Art. 16 of the AI Act (EU) 2024/1689 brings together what providers of high-risk AI systems must do. The article itself is essentially a list – the real substance sits in the articles it refers to. Understanding Art. 16 means reading those cross-references alongside it:
- Meet the requirements set out in Section 2 (point a) – this is the substantive core (risk management, data, documentation, transparency, human oversight, accuracy/robustness/cybersecurity).
- Labelling requirements: name, registered trade name or trademark, and contact address on the system, its packaging or in the documentation (b).
- Quality management system under Art. 17 (c).
- Retain technical documentation under Art. 18 (d).
- Retain logs generated automatically under Art. 19, to the extent they are under the provider’s control (e).
- Undergo the conformity assessment procedure under Art. 43 before placing the system on the market or putting it into service (f).
- Issue an EU declaration of conformity under Art. 47 (g).
- Affix the CE marking under Art. 48 (h).
- Register under Art. 49(1) (i).
- Take corrective action and comply with information duties under Art. 20 in cases of non-conformity (j).
- Demonstrate compliance to national authorities on reasoned request (k).
- Accessibility in line with Directives (EU) 2016/2102 and (EU) 2019/882 (l).
The pattern is clear: Art. 16 is not an end in itself, but a table of contents for an entire compliance system that ties together quality management, documentation, conformity assessment and market surveillance.
When these duties actually apply
The “Digital Omnibus on AI” has pushed back the deadlines for high-risk AI systems. For systems classified as high-risk under Annex III (for example in recruitment, creditworthiness assessment or biometric identification), the duties under Art. 16 now apply from 2 December 2027 – originally the date was 2 August 2026. For high-risk AI systems that are products or safety components falling under EU product law pursuant to Annex I, the deadline shifts to 2 August 2028 (rather than 2 August 2027).
Importantly, this postponement does not affect the prohibitions under Art. 5 or AI literacy under Art. 4 (in force since 2 February 2025), nor the GPAI obligations, governance structures and penalties (in force since 2 August 2025). The transparency obligations under Art. 50 also follow their own timeline from 2 August 2026, with a grace period until 2 December 2026 for systems already on the market. Art. 16 concerns high-risk systems exclusively – and their deadline is now considerably later than originally planned.
Why the extended deadline is not a breather
There’s a common misjudgement between “the deadline has moved” and “we have time” – one that often surfaces too late in practice. The duties listed in Art. 16 build on one another: a quality management system under Art. 17 cannot be assembled in a few weeks if it is meant to cover development processes, data management and change management across the entire lifecycle. Technical documentation under Art. 18 needs to be produced alongside development, not reconstructed afterwards. And conformity assessment under Art. 43 presupposes that the requirements of Section 2 are already demonstrably met – it is the last step in a longer chain, not the starting point.
Typical gaps we come across in practice:
- A QMS that exists only on paper: processes are documented but not actually followed, or not tailored to the specific AI system.
- Documentation produced retrospectively: rather than growing alongside the development process, it gets cobbled together shortly before the assessment – with corresponding gaps.
- The registration duty under Art. 49(1) gets overlooked, because organisationally it often sits with compliance or legal rather than the development team.
- Accessibility under point (l) treated as an IT matter rather than part of AI compliance – even though Art. 16 explicitly refers to the relevant directives.
What this means for your planning
The postponed deadlines – 2 December 2027 for Annex III systems, 2 August 2028 for Annex I products – buy more lead time, but the effort required for each duty does not change. Starting to build a QMS and establish documentation processes now means having solid evidence in place once the deadline arrives, rather than facing time pressure at the last minute. Waiting simply defers the risk.
Whether your system falls under Art. 16 at all depends on its classification under Annex III or Annex I – and that is often less clear-cut than it first appears. Our free risk check at /einstufung gives you an initial assessment of whether, and in which category, your AI system should be classified.