EU AI Act obligations fall on named roles, cover named classes of system and start on dates that a 2026 amendment moved. This note reads Regulation (EU) 2024/1689 into an obligations register, one row per duty and per party it binds, and records in each row what Regulation (EU) 2026/1744, the Digital Omnibus on AI, changed. It applies the field set from building an obligations register from regulation text to one law. It is research on what the texts say, never legal advice.
The Act as published has 180 recitals, 113 articles and 13 annexes (derived) [1]. The amending act was signed on 8 July 2026, published on 24 July 2026 and entered into force on 27 July 2026, with 43 numbered amendment points (derived) [2, 15]. A row read from the 2024 text carries the old date for every duty in Chapter III Sections 1 to 3 [1, 2].
EU AI Act obligations by role: providers and deployers
Article 3(3) defines a provider as a party that develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark [1]. Article 3(4) defines a deployer as a party "using an AI system under its authority", outside personal non-professional activity [1]. Article 3(8) groups providers, product manufacturers, deployers, authorised representatives, importers and distributors as "operators" [1].
LegalRuleML, an OASIS standard, calls the party a duty is directed at its bearer, and a party the duty involves an auxiliary party [29]. One row holds one duty for one bearer. In Article 26(5) the deployer is the bearer, and the provider and market surveillance authority it informs are auxiliary parties [1].
Which systems a row covers
The class of system is a field of its own. Article 4 covers providers and deployers of all AI systems [1, 2]. Article 5 lists prohibited practices [1]. A system is high-risk under Article 6(1) when it is, or is a safety component of, a product under the Annex I laws that needs third-party conformity assessment, and under Article 6(2) when it falls in one of the eight areas of Annex III (derived) [1].
Article 6(3) lets a provider conclude that an Annex III system poses no significant risk of harm where any one of four conditions (derived) is met, and never for a system that profiles natural persons [1]. That conclusion has rows of its own: Article 6(4) requires the provider to document its assessment before the system is placed on the market or put into service, and makes the provider subject to registration under Article 49(2) [1]. Article 50 adds transparency duties for certain systems, and Chapter V covers general-purpose AI models [1].
Provider rows: Article 16 as an index
Article 16 gives providers of high-risk systems 12 points, (a) to (l) (derived) [1]. The register keeps it as an index row linked to the longer articles it names: the quality management system of Article 17, documentation under Article 18, logs under Article 19, conformity assessment under Article 43, the declaration and CE marking under Articles 47 and 48, and registration under Article 49(1) [1].
The linked rows carry the durations. Documentation is kept for 10 years after the system is placed on the market or put into service, and logs for at least six months [1]. Under Article 73, a serious incident is reported not later than 15 days after awareness, two days for a widespread infringement or a serious and irreversible disruption of critical infrastructure, and 10 days for a death [1]. Breach of Article 16 sits in the tier of fines up to EUR 15 000 000 or 3% of worldwide annual turnover, whichever is higher [1].
Deployer rows: Article 26 and around it
Article 26 has 12 paragraphs (derived) [1]. Deployers use the system in line with its instructions for use, assign human oversight to people "who have the necessary competence, training and authority", keep input data relevant where they control it, monitor operation and keep the logs for at least six months [1].
Other deployer rows sit outside Article 26. Article 27 requires a fundamental rights impact assessment before first use from bodies governed by public law, private entities providing public services and deployers of the systems in Annex III points 5(b) and (c) [1]. Article 50(3) and (4) cover emotion recognition, biometric categorisation and deep fakes [1]. Article 86 gives an affected person a right to an explanation from the deployer [1]. The register holds it as a right row, with the deployer bearing the matching duty (this note's reading).
Role changes are override rows
Under Article 25(1), a distributor, importer, deployer or other third party becomes the provider, with the Article 16 duties, when it puts its name or trademark on a high-risk system already on the market, makes a substantial modification that keeps it high-risk, or changes a system's intended purpose so that it becomes high-risk [1]. LegalRuleML's override, a rule that takes precedence over another [29], fits that move (this note's reading).
The 2026 amendment rewrote two of these rows. Article 25(2) now lists the initial provider's cooperation: technical documentation, known limitations and failure modes, and targeted technical access for testing and validation [2]. Article 25(4) now reaches a supplier of an "AI model", and a new Article 99(4)(da) puts both paragraphs in the fines tier [2].
Dates, as published and as amended
| Row | 2024 text | As amended |
|---|---|---|
| Chapters I and II, including Articles 4 and 5 | 2 February 2025 [1] | Unchanged for existing points [2, 7] |
| New Article 5(1) points (ba) and (bb) | None | 2 December 2026 [2] |
| Chapter V, general-purpose AI models | 2 August 2025 [1] | Unchanged [7] |
| Article 50, transparency | 2 August 2026 (derived) [1] | Unchanged [18] |
| Chapter III Sections 1 to 3, Annex III systems | 2 August 2026 (derived) [1] | 2 December 2027 [2] |
| Chapter III Sections 1 to 3, Annex I systems | 2 August 2027 [1] | 2 August 2028 [2] |
Article 111 adds transitional rows: general-purpose AI models placed on the market before 2 August 2025 comply by 2 August 2027, and high-risk systems for public authorities by 2 August 2030 [1, 2]. A new Article 111(4) gives providers of generative systems placed on the market before 2 August 2026 until 2 December 2026 to meet Article 50(2) [2]. Read literally, Article 113 gives Articles 49 and 73 the general date of 2 August 2026 (derived) [1, 2]. The register records each date as the text gives it.
Proposed text is a separate field
The Commission's proposal, COM(2025) 836 of 19 November 2025, differs from the act adopted [2, 4]. Its Article 4 would have moved the bearer: the Commission and Member States "shall encourage" providers and deployers [4]. The adopted text keeps the duty on providers and deployers, to "take measures to support the development of AI literacy" [2]. The proposal would have deleted Article 49(2) and all of Annex VIII Section B, and the act kept Article 49(2) and deleted points 7 and 9 of that section [2, 4]. On 8 November 2026, the AI Act Service Desk's questions on the Digital Omnibus still described the proposal [12].
Guidance, codes and standards are linked sources
The Commission calls its high-risk guidelines "not legally binding" [14], and its guidelines on prohibited practices "non-binding" [22]. On 8 November 2026 its pages presented the classification guidelines that Article 6(5) required by 2 February 2026 as "draft Guidelines" [1, 13]. Adherence to the transparency code "does not constitute conclusive evidence of compliance" [19]. Implementing Decision (EU) 2026/2274 published the reference of EN 18286:2026, a quality management standard [17]. Article 40(1) speaks of presumed conformity with the Chapter III Section 2 requirements, and the Commission's news item of "the Article 17 requirements covered by the standard" [1, 16]. A register links each instrument with its status in its own words.
A worked row: deployer log retention
| Field | Value |
|---|---|
| Citation | Article 26(6), first subparagraph [1] |
| Source version | Official Journal text of 12 July 2024, consolidated text of 27 July 2026 with no amendment marker [1, 3, 8] |
| Bearer | Deployer of a high-risk system [1] |
| Action | Keep the logs the system generates automatically [1] |
| Condition | "to the extent such logs are under their control" [1] |
| Duration | At least six months, appropriate to the intended purpose [1] |
| Exception | Union or national law providing otherwise, in particular on personal data protection [1] |
| Applies from | 2 December 2027 for Annex III systems, 2 August 2028 for Annex I systems [2] |
| Fines tier | Article 99(4)(e) [1] |
Every field is tied to its phrase, as in the Rule 201 worked example.
Checking the register
A 2026 study of 12 compliance checkers found Articles 5 and 6 covered by 10 of them, Articles 9 to 15 by 4 or 5 each, and Articles 27 and 49 by 3 each [31]. In a 2026 survey with 15 respondents, documented checklist, table or wiki reviews were a dominant practice, at 40% [32]. Recall of obligations can be scored against a labeled sample, as in testing document extraction accuracy before you buy. In Rillor's document and regulation intelligence work, when a rule changes, the new version of the text is compared with the one each row was read from, and rows tied to a changed passage go back to review.
Read the full report
The full report adds the provider and deployer rows article by article, the transitional dates, the amendment trail, the proposal compared point by point, two worked rows and the complete source list.