What Article 16 Regulates and Who It Applies To
Article 16 of Regulation (EU) 2024/1689 lists the obligations of providers of high-risk artificial intelligence systems. It is not an autonomous list of all technical requirements applicable to the system: it establishes who must ensure compliance and what organizational and documentary actions the provider must assume, alongside other obligations provided for in the Regulation.
The first task is to correctly identify the organization's role. Article 16 is directed at the provider, while Article 26 establishes duties for the deployer, i.e., the one who uses the system under their authority. Article 25 contemplates cases where other entities may be considered providers, for example, in certain modifications or changes of function. Therefore, the contractual label of a company does not by itself resolve its legal role.
The Eight Provider Obligations
Article 16 contains eight letters. In summary, the provider must ensure that the system meets the applicable requirements of Chapter III, Section 2; indicate its name or brand and a contact address; have a quality management system; retain the corresponding documentation; retain automatically generated records when they are under their control; complete the applicable conformity assessment; prepare the EU declaration of conformity and affix the CE marking; and comply with the registration obligations provided for.
The text refers to other articles to determine what it means to fulfill each task. For example, the content and retention of technical documentation are specified in Article 11 and Annex IV; quality management, in Article 17; conformity assessment, in Article 43; and the declaration and marking, in Articles 47 and 48. Therefore, Article 16 should not be read as a substitute for those provisions, but as the assignment of responsibilities to the provider.
Obligation and Evidence That Should Be Locatable
| Article 16 | Control or Verifiable Evidence |
|---|---|
| a) Compliance with applicable requirements | Matrix relating applicable requirements with tests, responsible parties, and verification status. |
| b) Identification and contact | Name or brand and contact address visible on the system, packaging, or documentation, as appropriate. |
| c) Quality management | Procedures and records attesting to the system required by Article 17. |
| d) Technical documentation | Updated file in accordance with Article 11 and Annex IV, with version control. |
| e) Automatic records | Retention policy, access, and evidence of which records the provider controls. |
| f) Conformity assessment | File and result of the applicable assessment, with documented corrective actions. |
| g) Declaration and CE marking | EU declaration of conformity and evidence of marking in accordance with the relevant articles. |
| h) Registration | Record of the required registration and data consistent with the commercialized version. |
How to Convert Obligations into Demonstrable Controls
Article 16 does not prescribe a management tool, a unique file format, or a specific technical model. Proof of compliance must be built around the specific obligation and the provisions to which it refers. A useful traceability matrix identifies each requirement, the document or control supporting it, the responsible person, the review date, and any pending limitations.
The documentation must correspond to the version actually placed on the market. A correct file for a previous version may cease to be sufficient after changes in design, data, intended purpose, or components. The team should maintain a change control process that determines when to review tests, documentation, conformity assessment, and registration. This recommendation is an operational practice: Article 16 assigns obligations, but does not by itself detail the internal engineering flow.
Practical Verification Cycle
Recommended process to organize evidence without confusing it with a literal sequence imposed by Article 16.
- 01Define who acts as the provider for each system and version, and document any change of role in accordance with the Regulation.
- 02Open a matrix of the eight letters of Article 16 and link each one with its complementary provisions and evidence.
- 03Check that technical documentation, records, declaration, marking, and registration data refer to the same version and intended purpose.
- 04Assign responsible parties and review dates; record deficiencies, decisions, and corrective actions.
- 05Before commercializing or substantially modifying the system, review which obligations and procedures must be updated.
Provider and Deployer: Division of Tasks
Article 16 assigns the provider tasks linked to system compliance before and during its placement on the market or into service, including documentation, conformity assessment, and applicable registration. Article 26 deals with the one who deploys the system. Among its obligations are using it in accordance with instructions for use, assigning human supervision to competent and authorized persons, monitoring its operation, and, where appropriate, suspending use and reporting risks or incidents in accordance with the Regulation.
The division does not mean that information flows automatically or that all responsibility falls on one party. The provider must provide necessary instructions and information in the applicable terms; the deployer must operate the system in accordance with them and attend to their own duties. In contracts and incident procedures, it is advisable to specify channels, responsible parties, internal deadlines, and minimum data for escalating problems, without presenting these private agreements as substitutes for legal obligations.
Indicative Operational Division
| Provider — Article 16 | Deployer — Article 26 |
|---|---|
| Ensures the system meets applicable requirements and completes the conformity tasks that correspond to it. | Uses the system in accordance with instructions and controls its use in the real context. |
| Maintains the required technical documentation and quality management system. | Assigns adequate human supervision and retains competence and authority to intervene. |
| Complies with applicable identification, declaration, marking, and registration obligations. | Monitors operation, retains records under their control, and acts on risks in accordance with the Regulation. |
| Manages their communication and cooperation obligations provided for in the Regulation. | Communicates incidents or risks to those concerned and may have their own information duties. |
Monitoring, Records, and Incidents: Avoiding Imprecise Attributions
Article 16 distinguishes retaining automatically generated records when they are under the provider's control from other monitoring or notification tasks that appear in related provisions. It should not be summarized as a general and identical obligation to 'supervise' use in any environment: Article 26 imposes operational obligations on the deployer, while Article 16 refers the provider to their corresponding obligations in the Regulation as a whole.
The notification of serious incidents and cooperation with authorities are regulated in other provisions of the Regulation. In particular, Article 16 does not by itself contain the complete procedure, its recipients, or all its deadlines. The provider must map the applicable normative references, prepare an escalation channel, and retain evidence of required communications. When the applicability of an obligation depends on specific circumstances, it must be confirmed with the full and current text, not inferred from a generic checklist.
Application Dates and Sanctions: Confirm Before Scheduling
Regulation (EU) 2024/1689 entered into force on August 1, 2024, and establishes a phased application. General application is scheduled from August 2, 2026, while certain chapters and provisions apply earlier or later according to the calendar of Article 113 and its amendments. The exact date for a specific system must be verified along with its transitional provisions and its category: it is not safe to deduce that all obligations of Article 16 begin simultaneously for all systems.
Article 99 establishes administrative fines for non-compliance with the Regulation, with maximum amounts that vary depending on the infringement and, for companies, may be expressed as a fixed amount or a percentage of the total worldwide annual turnover of the previous financial year, applying the higher amount where so provided by the article. Not all infringements of Article 16 necessarily carry the same maximum. The competent authority must consider the circumstances and criteria of the Regulation. Before using a figure in a business decision, one must review the exact category of the infringement, the applicable sanctioning article, and any relevant special rules.
Compliance Checklist and Common Errors
An effective review must separate what the Regulation imposes from internal decisions that help demonstrate it. Legal obligations are the tasks listed in Article 16 and the requirements of the articles to which it refers. Recommended practices, for example, assigning a responsible person per letter, using an evidence matrix, and scheduling periodic reviews: these should not be presented as formats expressly prescribed by Article 16.
It is also advisable to avoid three errors: treating the provider and the deployer as if they were the same actor; assuming that the list in Article 16 contains all technical requirements; and attributing to Article 16 dates, incident procedures, or sanctions that are detailed in other articles. The article does not by itself oblige the use of a specific model or technology. The applicability of specific obligations depends on the system configuration and the rest of the Regulation.
Final Checklist: Legal Obligation vs. Recommended Practice
| Check | Nature | Evidence or Action |
|---|---|---|
| Identify and document the provider role. | Legal, according to the Regulation and facts. | Analysis of functions, contracts, brand, modifications, and intended purpose. |
| Cover the eight letters of Article 16. | Legal. | Matrix with status, applicable reference, and locatable evidence. |
| Maintain documentation and quality in accordance with their specific articles. | Legal; internal formats vary. | Versioned file and management records in accordance with Article 11, Annex IV, and Article 17. |
| Assign an owner and review date to each evidence. | Recommended practice. | RACI or internal register of responsible parties and reviews. |
| Agree on exchange channels with deployers. | Recommended practice to facilitate compliance; does not replace legal obligations. | Procedure for inquiries, risk and incident escalation. |
| Verify dates and sanctions in current text before approving the plan. | Recommended legal control. | Review of the applicable calendar and the corresponding sanctioning article. |
Practical Decision Before Closing a Review
Use these questions as a final filter; a negative or uncertain answer must generate a review action, not a presumption of compliance.
- 01Is the actual provider identified for this version and this intended purpose?
- 02Does each obligation of Article 16 have current evidence and a responsible person?
- 03Does the evidence refer to the correct complementary articles and not only to Article 16?
- 04Are the provider's controls distinguished from the deployment obligations of Article 26?
- 05Have dates, exceptions, and sanctions been validated in the applicable official text?
Open questions
- The provided sources include the text of Article 16 and references to Articles 25 and Chapter III, but do not provide specific links to Articles 26, 99, and 113. The detailed comparison, calendar, and sanctions must be cross-checked with the official consolidated text before making legal decisions.
- The application of obligations and dates may depend on the system category, transitional provisions, regulatory amendments, and specific circumstances of commercialization or deployment.
- Record control, provider status, and communication obligations depend on facts and applicable provisions; they cannot be determined solely by the contractual name of the parties.
Keep exploring
Sources consulted
Corrections and transparency
If you spot incorrect or outdated information, send us a correction with the page and source we should review.
Submit a correction