EU AI Act obligations as a register: providers and deployers

Summary

The EU AI Act reads into an obligations register with one row per duty and per party it binds, and its July 2026 amendment, Regulation (EU) 2026/1744 [2], shows why role, system scope, dates and amendment trail are separate fields.

• The EU AI Act, Regulation (EU) 2024/1689, assigns its duties by role. Article 3 defines a provider as a party that develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark, and a deployer as a party using an AI system under its authority [1].
• High-risk systems carry two lists of duties. A system is high-risk under Article 6 when it is, or is a safety component of, a product under the Annex I laws that needs third-party conformity assessment, or when it falls in one of the eight areas of Annex III (derived), and Article 16 then gives its provider 12 points and Article 26 its deployer 12 paragraphs (derived) [1].
• Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026, moved the high-risk dates. Chapter III Sections 1 to 3, the high-risk classification rules, requirements and provider and deployer duties, now apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems, where the 2024 text gave 2 August 2026 (derived) and 2 August 2027 [1, 2, 15].
• Regulation (EU) 2026/1744 as adopted differs from the Commission's proposal, COM(2025) 836. The proposal would have deleted the Article 49(2) registration of systems a provider judges not high-risk, and the act kept it while deleting two of the nine points (derived) of Annex VIII Section B, the information that registration holds [1, 2, 4].
• Role changes move the provider's duties to another party. Under Article 25(1), a distributor, importer, deployer or other third party that puts its name or trademark on a high-risk system, substantially modifies it, or changes a system's intended purpose so that it becomes high-risk is considered its provider, with the Article 16 duties [1].
• Support instruments carry their own legal status. The Commission calls its guidelines not binding [14, 22, 23] and says adherence to its transparency code "does not constitute conclusive evidence of compliance" [19]. Its Implementing Decision (EU) 2026/2274 lists EN 18286:2026, a quality management standard, as a harmonised standard [16, 17].
• Published checks show where coverage thins. In a 2026 study of 12 compliance checkers, Articles 5 and 6 (prohibited practices and high-risk classification) were each covered by 10, Articles 9 to 15 (the high-risk requirements) by 4 or 5 each, and Articles 27 and 49 (the fundamental rights impact assessment and registration) by 3 each [31].

Background

What the Act is. Regulation (EU) 2024/1689 was signed on 13 June 2024 and published in the Official Journal on 12 July 2024 [1]. It entered into force on 1 August 2024 [2, 11]. As published it has 180 recitals, 113 articles and 13 annexes (derived) [1]. Chapter III holds the high-risk rules, with requirements in Section 2 (Articles 8 to 15), operator obligations in Section 3 (16 to 27) and registration in Section 5 (40 to 49) [1].

What changed. The Commission proposed the Digital Omnibus on AI on 19 November 2025 as COM(2025) 836 [4]. The European Parliament adopted its position on 16 June 2026 by 423 votes to 57, with 174 abstentions [6], and the Council adopted the act on 29 June 2026 [5]. It was signed on 8 July 2026 and published on 24 July 2026 as Regulation (EU) 2026/1744 [2, 5], and it entered into force on the third day after publication, 27 July 2026 [2, 15]. Its recital (2) cites delayed standards and delayed national frameworks, which produced "a compliance burden that is heavier than expected" [2]. It has 47 recitals and 43 amendment points (derived) [2].

Who this note is for. Compliance and legal operations staff who keep a register of the Act, and the engineers who build its extraction.

Method

What was examined. The Official Journal texts of both regulations [1, 2], the consolidated text as at 27 July 2026 [3], the proposal [4], the procedure file and the summary of the Parliament's vote [5, 6], seven AI Act Service Desk pages [7-13], 14 Commission pages on guidelines, codes, templates and standards [14-16, 18-28], one implementing decision [17], the LegalRuleML standard [29], four research papers from 2025 and 2026 [30-33] and two pages on the European Legislation Identifier [34, 35].

How. Each provision was read in the 2024 text. Each amendment point of 2026/1744 was then matched to the provisions it changes and checked against the consolidated text and the Service Desk's markers [2, 3, 7]. The fields come from LegalRuleML [29] and the general register method this note applies, with eight fields added for this Act (Finding 12). "Derived" marks a count or date worked out from a cited text. All 35 sources were opened on 8 November 2026. No checker, code signatory, product or vendor is named.

Where sources disagree. Article 40(1) ties the presumption of conformity to the Section 2 requirements and the Chapter V obligations [1], while the Commission's news item ties EN 18286:2026 to "the Article 17 requirements covered by the standard" [16]. The Service Desk's questions on the Digital Omnibus describe the proposal [12]. The Commission's policy page, last updated 19 October 2026, still says the transparency rules "will come into effect in August 2026" [15]. Its transparency guidelines page gives the same date in the present tense: Article 50 "applies from 2 August 2026" [18]. Each source is reported as it reads.

Findings

1. Bearer: operator roles and territorial scope

Roles. Article 3(8) lists six operators (derived), and Article 3 defines five of them (derived) [1]:

A 2025 mapping of the six roles points to "Article 25 provisions ensuring accountability follows control" [33].

Bearer and auxiliary party. LegalRuleML names the role a duty is "primarily directed" at as its bearer, and a role the duty is "related" to as an auxiliary party [29]. Article 26(5) is one row with the deployer as bearer, and the provider, distributor and market surveillance authority it informs as auxiliary parties [1].

Territorial scope. Article 2(1) reaches providers wherever established, deployers in the Union, and providers and deployers in third countries where the system's output is used in the Union [1].

Exclusions as exception rows. Article 2 excludes systems built "for the sole purpose of scientific research and development", testing before placing on the market other than in real world conditions, purely personal use, and free and open-source systems unless high-risk or under Article 5 or 50 [1].

2. System scope: which systems a row covers

A duty's scope is a class of system, held in its own field:

The derogation needs care. Article 6(3) lists four conditions (derived), any one of which suffices, and states that an Annex III system "shall always be considered to be high-risk" where it profiles natural persons [1]. A provider using it "shall document its assessment" before placing the system on the market or putting it into service and is subject to Article 49(2) registration [1]. Those are two rows whose scope is the derogation.

3. Provider rows for high-risk systems

Article 16 as an index. Its 12 points (derived) are short, and several send the reader to a longer article [1]:

Durations and deadlines in linked rows. Documentation is kept for 10 years after placing on the market or putting into service, and logs for "at least six months" [1]. Article 20(1) requires corrective action "immediately" for a system not in conformity [1].

Serious incidents. Article 73 sets a report "not later than 15 days" after the provider or deployer becomes aware, two days for a widespread infringement or a serious and irreversible disruption of critical infrastructure, and 10 days for a death, with an incomplete initial report allowed [1]. For providers under the AI Office's competence, the amended Article 75(1a) sends those reports to the AI Office [2]. The auxiliary party of the Article 73 row therefore depends on the supervisor field.

Amended provider rows. Article 17(2) now names SMEs, start-ups and small mid-cap enterprises (SMCs) in its proportionality rule, and Article 11(1) lets them provide Annex IV documentation "in a simplified manner" on a Commission form [2]. Article 10(5) was deleted, and a new Article 4a governs special categories of personal data for bias detection and correction [2].

Fines tier. Article 99(4)(a) covers Article 16, with fines up to EUR 15 000 000 or 3% of worldwide annual turnover, whichever is higher, and the lower of the two for SMEs [1]. Article 99(6a) applies the lower figure to SMCs [2].

4. Deployer rows

Article 26. Its 12 paragraphs (derived) include these duties [1]:

Rows outside Article 26. Article 27 requires a fundamental rights impact assessment before first use of an Article 6(2) system, except Annex III point 2, by bodies governed by public law, private entities providing public services and deployers of systems in Annex III points 5(b) and (c) [1]. The amended Article 27(4) lets the deployer cross-refer to its data protection impact assessment [2]. Article 49(3) requires public-authority deployers to register their use [1]. Article 50(3) and (4) cover emotion recognition, biometric categorisation and deep fakes, with an exception for text under human review or editorial control [1].

A right and its duty. Article 86(1) gives an affected person "the right to obtain from the deployer clear and meaningful explanations" of a decision based on an Annex III system's output [1]. The row records the person's right and the deployer as bearer of the matching duty (this note's reading).

Fines tier. Article 99(4)(e) covers Article 26, and 99(4)(g) covers Article 50 [1].

5. Role changes as override rows

Article 25(1) moves the Article 16 duties to a distributor, importer, deployer or other third party in three cases: (a) it puts its name or trademark on a high-risk system already placed on the market, (b) it makes a substantial modification so that the system remains high-risk, or (c) it modifies a system's intended purpose so that it becomes high-risk [1]. Article 3(23) defines a substantial modification as an unplanned change that affects compliance with Section 2 or the intended purpose [1].

LegalRuleML defines an override as "an indication that a Legal Rule takes precedence over another Legal Rule" [29]. In this note's reading, Article 25(1) works as one: a trigger row that, when met, gives the new bearer the provider rows, and Article 25(2) removes the initial provider as provider "of that specific AI system" [1].

The amendment changed the linked rows. Article 25(2) now lists the cooperation owed to the new provider: technical documentation for assessing compliance with Article 16, known limitations and failure modes, and targeted technical access for testing and validation [2]. Article 25(4) now covers a third party that supplies "an AI system, AI model, tools, services, components, or processes" [2]. A new Article 99(4)(da) puts Article 25(2) and (4) in the fines tier [2].

6. Splitting provisions into rows

A 2026 study of Articles 8 to 15 used modal verbs as delimiters and found 111 candidate requirements [30]. Four exclusions reduced them to 107, 100, 94 and finally 87: Article 8 as imposing no obligation of its own (4 removed), statements with "may", read as permissions (7), statements whose subject is the Commission, notified bodies or the Act itself (6), and statements that only scope those that follow (7) [30]. Of the 87, 27 addressed risks specific to the systems, 40 required a process and 20 required an artefact [30]. The study reflects the text as of May 2026 [30].

A register keeps more than that set. A "may" statement is a permission row, linked to its parent: the amended Article 27(4) and Article 11(1) are examples [2]. Commission duties, such as the classification guidelines due under Article 6(5), are rows with the Commission as bearer, kept apart from operator rows [1]. LegalRuleML's constitutive statements, which define concepts, fit Article 3, and its penalty statements fit Article 99 [29].

7. Dates as published and as amended

Article 111 adds transitional rows. Annex X large-scale IT systems placed on the market before 2 August 2027 are brought into compliance by 31 December 2030 [1]. General-purpose AI models placed before 2 August 2025 comply by 2 August 2027 [1]. High-risk systems placed before the Chapter III date are covered only after significant design changes, and public-authority systems by 2 August 2030 [2]. Providers of generative systems placed before 2 August 2026 comply with Article 50(2) by 2 December 2026 [2].

Article 4 shows why application and enforcement need separate dates. The Commission states that it has applied since 2 February 2025 and that "The supervision and enforcement rules apply from 2 August 2026 onwards" [21].

Read literally, Article 113 gives Article 49 and Article 73 the general date of 2 August 2026, while the Section 3 duties that point to them apply from 2 December 2027 or 2 August 2028 (derived) [1, 2]. No source reviewed says how authorities read that sequence, so the register records each date as the text gives it and links the rows.

8. Source version and amendment trail

Which text binds. The consolidated text states that it "has no legal effect" and that the authentic versions are those published in the Official Journal [3]. It marks original passages ▼B and amended ones ▼M1 [3].

Markers checked. The Service Desk shows that text with "NEW" and "AMENDED" markers [7]. Its Article 4 page carried three AMENDED markers [10], the Article 50 page one, on paragraph 7 [9], the Article 113 page markers on points (a), (c) and (d) [7], and the Article 26 page none [8]. 2026/1744 has no amendment point for Articles 16, 26 or 49, or for Article 6(4) (derived) [2].

Identifiers. The European Legislation Identifier is a standard "that makes it easier to identify and describe legislation across Europe" [35]. The Official Journal cites the Act as http://data.europa.eu/eli/reg/2024/1689/oj [17], and its ELI entry on EUR-Lex opens the Act [34].

Rows the amendment touched. Among the rows this note covers, the amendment touched Article 4, new 4a, Article 5(1)(ba) and (bb), Article 10, Article 11(1), Article 17(2), Article 25(2) and (4), Article 27(4) and (5), Article 50(7), Article 72(3), Article 75, Article 99, Article 111, Article 113 and Annex VIII Section B points 7 and 9 [2]. Each row records its original text, the 2026/1744 point that changed it and the consolidated version read.

9. Proposed text against adopted text

The Article 4 row changes bearer twice: providers and deployers in 2024, the Commission and Member States in the proposal, and providers and deployers again in the act. A register that copied the proposal into the row in force would have shown a moved bearer that never took effect.

Official explainers can trail the law. On 8 November 2026 the Service Desk's Digital Omnibus answers still asked "Why is the European Commission proposing to amend the AI Act?" and tied the high-risk dates to the availability of standards [12]. The proposed-changes field for these rows is closed: the procedure file reads "Procedure completed" [5].

10. Guidance, codes and standards as linked sources

Guidelines. The Commission describes its guidelines on prohibited practices as "non-binding, with authoritative interpretations reserved for the Court of Justice of the European Union (CJEU)" [22], and its guidelines on the system definition as "not binding" [23]. Its high-risk guidelines page calls them "not legally binding" [14]. Article 6(5) set 2 February 2026 for the classification guidelines [1], and on 8 November 2026 the Service Desk page still referred to "The full draft Guidelines" [13]. The Commission's guidelines on the scope of obligations for providers of general-purpose AI models date from 18 July 2025 [24].

Codes of practice. The General-Purpose AI Code of Practice was published on 10 July 2025, and the Commission and the AI Board confirmed it as "an adequate voluntary tool" for its providers, with chapters for Article 53 and for Article 55 [25]. On 8 July 2026 the Commission concluded that the transparency code "adequately covers" Article 50(2), (4) and (5), and the AI Board adopted its adequacy assessment the following day [19]. The Commission adds that adherence "does not constitute conclusive evidence of compliance" [19] and that "the transparency requirements under article 50 of the AI Act are legal obligations" [20]. The amended Article 50(7) asks the Commission to assess whether adherence to such codes is adequate [2].

Templates. The training content template gives "a common minimal baseline" for the summary in Article 53(1)(d) [1, 26]. Article 73(7) set 2 August 2025 for serious incident guidance [1]. The Commission issued draft guidance and a reporting template on 26 September 2025, with feedback closing on 7 November 2025 [27]. On 8 November 2026 its overview page, last updated 31 July 2026, listed a reporting template among published items and a fundamental rights impact assessment template among further work [28]. The amended Article 72(3) sets 2 September 2027 for post-market monitoring guidance [2].

Harmonised standards. Implementing Decision (EU) 2026/2274 of 12 October 2026, published on 14 October 2026, lists EN 18286:2026 for quality management systems, under standardisation request C(2025) 3871 [17]. Presumption of conformity runs from the publication of the reference [17]. The Commission's news item of 19 October 2026 says further harmonised standards are "expected to follow" [16].

11. Checking a register of the Act

A 2026 study of 12 compliance checkers selected 18 articles and measured coverage [31]. Articles 5 and 6 were covered by 10 checkers each, Article 16 by 6, Article 26 by 5, Articles 9 to 15 by 4 or 5 each, and Articles 27 and 49 by 3 each [31]. The authors found that some checkers "do not determine the role" of the user, noted that many obligations "depend on the provider's stated purpose and the deployer's actual use", and judged the tools "early-stage orientation tools" [31]. The authors inspected their initial set of 45 checkers in September 2025, before 2026/1744 was adopted (derived) [31].

A 2026 study with 10 expert interviews and 15 survey respondents found documented checklist, table or wiki reviews at 40%, with automated evidence collection and checks in CI/CD pipelines absent from the practices reported [32]. Of respondents, 27% systematically monitor developments, 47% spend less than 10 hours a month on mapping and validating obligations, and 60% named faithful source citations as a trust enabler [32]. The sample is small.

Three register checks follow from these gaps. Every row has a bearer from Article 3. Every Article 16 and Article 26 point has its linked row. Article 27 and Article 49 rows exist wherever their scope applies.

12. Worked rows and the fields added for this Act

Row 1: deployer log retention.

Row 2: a date change. Under the 2024 text, Article 16(a) for a provider of an Annex III system was set to apply from 2 August 2026 (derived), and as amended it applies from 2 December 2027 [1, 2]. The duty's wording did not change [2].

Row 3: a content change. The Article 49(2) duty stays, while its Annex VIII Section B content loses point 7, the short summary of grounds, and point 9, the Member States list [2].

Added fields.

Implications

For compliance and legal operations teams.

1. Give every row one Article 3 role as bearer [1, 29].
2. Hold system scope apart from the duty, since the same duty text applies to Annex I and Annex III systems on different dates [1, 2].
3. Keep Article 16 and Article 26 as index rows linked to their longer articles [1].
4. Store role changes as override rows triggered by Article 25(1) [1, 29].
5. Record each date as Article 113 or 111 gives it, and enforcement dates apart from application [1, 2, 21].
6. Cite the Official Journal text and the consolidated version read, with the 2026/1744 point for each change [2, 3].
7. Keep proposed text in its own field until adoption [4, 5].
8. Link guidelines, codes and standards with their status in the Commission's own words [14, 19, 22].

For engineers and reviewers. Keep "may" statements as permission rows and Commission duties as separate rows [30], test coverage where the checker study found gaps [31], and review rows changed by 2026/1744 first [2].

Rillor reads obligations registers from the regulation text, one row per obligation, and every row links to the passage it came from. When a rule changes, rows tied to a changed passage go back to review, and each row keeps its source version and every change since.

Limits of this analysis

• This is research, never legal advice. It records how the texts read and does not say whether any system is high-risk or any party a provider.
• Dates are given as the texts state them on 8 November 2026. How authorities read the dates of Articles 49 and 73 against the later Chapter III dates is outside the sources reviewed.
• The consolidated text has no legal effect, and the Service Desk displays it [3, 7]. Commission pages change after their viewing date, and some carried stale wording on 8 November 2026 [12, 15].
• No final serious incident guidance, fundamental rights impact assessment template or harmonised standard for Articles 9 to 15 was found [16, 17, 27, 28].
• Article 40(1) and the Commission's statement on EN 18286:2026 are reported as written and not reconciled [1, 16].
• The research samples are small: 12 checkers, chosen from a set inspected in September 2025 [31], and 10 interviews and 15 survey responses [32]. The requirements study counts the 2024 text [30].
• Counts marked "derived" are this note's own and may differ from other counts of the same text.

Sources

1. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal text. European Parliament and Council of the European Union, 13 June 2024, Official Journal L, 12 July 2024, viewed 8 November 2026. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202401689
2. Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI). European Parliament and Council of the European Union, 8 July 2026, Official Journal L, 24 July 2026, viewed 8 November 2026. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744
3. Regulation (EU) 2024/1689, consolidated text 02024R1689-20260727. Publications Office of the European Union, EUR-Lex, 27 July 2026, viewed 8 November 2026. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727
4. Proposal for a Regulation amending Regulations (EU) 2024/1689 and (EU) 2018/1139 (Digital Omnibus on AI), COM(2025) 836 final, procedure 2025/0359(COD). European Commission, 19 November 2025, viewed 8 November 2026. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52025PC0836
5. Procedure file 2025/0359(COD), Digital Omnibus on AI. European Parliament, Legislative Observatory, viewed 8 November 2026. https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025/0359(COD)
6. Summary of the legislative resolution of 16 June 2026, procedure 2025/0359(COD). European Parliament, Legislative Observatory, 16 June 2026, viewed 8 November 2026. https://oeil.europarl.europa.eu/oeil/en/document-summary?id=1905596
7. Article 113: Entry into force and application. European Commission, AI Act Service Desk, text as at 27 July 2026, viewed 8 November 2026. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113
8. Article 26: Obligations of deployers of high-risk AI systems. European Commission, AI Act Service Desk, viewed 8 November 2026. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26
9. Article 50: Transparency obligations for providers and deployers of certain AI systems. European Commission, AI Act Service Desk, viewed 8 November 2026. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50
10. Article 4: AI literacy. European Commission, AI Act Service Desk, viewed 8 November 2026. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4
11. Timeline for the Implementation of the EU AI Act. European Commission, AI Act Service Desk, viewed 8 November 2026. https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act
12. Frequently Asked Questions, category Digital Omnibus. European Commission, AI Act Service Desk, viewed 8 November 2026. https://ai-act-service-desk.ec.europa.eu/en/faq?combine=&faq_category_id=99
13. Guidelines on the classification of high-risk AI systems. European Commission, AI Act Service Desk, viewed 8 November 2026. https://ai-act-service-desk.ec.europa.eu/en/guidelines-classification-high-risk-ai-systems
14. Guidelines for providers and deployers of AI high-risk systems. European Commission, Shaping Europe's digital future, last updated 19 October 2026, viewed 8 November 2026. https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-high-risk-systems
15. AI Act. European Commission, Shaping Europe's digital future, last updated 19 October 2026, viewed 8 November 2026. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
16. First harmonised standard supporting the AI Act published in the Official Journal. European Commission, Shaping Europe's digital future, 19 October 2026, viewed 8 November 2026. https://digital-strategy.ec.europa.eu/en/library/first-harmonised-standard-supporting-ai-act-published-official-journal
17. Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 on the harmonised standards for high-risk AI systems drafted in support of Regulation (EU) 2024/1689. European Commission, Official Journal L, 14 October 2026, viewed 8 November 2026. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202602274
18. Guidelines on transparency obligations for providers and deployers of certain AI systems. European Commission, Shaping Europe's digital future, last updated 6 August 2026, viewed 8 November 2026. https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations
19. Commission opinion on the assessment of the Code of Practice on Transparency of AI-generated Content. European Commission, Shaping Europe's digital future, 9 July 2026, viewed 8 November 2026. https://digital-strategy.ec.europa.eu/en/library/commission-opinion-assessment-code-practice-transparency-ai-generated-content
20. Code of Practice on Transparency of AI-generated Content. European Commission, Shaping Europe's digital future, last updated 19 October 2026, viewed 8 November 2026. https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content
21. AI Literacy - Questions & Answers. European Commission, Shaping Europe's digital future, last updated 20 October 2026, viewed 8 November 2026. https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers
22. Commission publishes the Guidelines on prohibited artificial intelligence (AI) practices, as defined by the AI Act. European Commission, Shaping Europe's digital future, 4 February 2025, viewed 8 November 2026. https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibited-artificial-intelligence-ai-practices-defined-ai-act
23. The Commission publishes guidelines on AI system definition to facilitate the first AI Act's rules application. European Commission, Shaping Europe's digital future, 6 February 2025, last updated 5 November 2026, viewed 8 November 2026. https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-ai-system-definition-facilitate-first-ai-acts-rules-application
24. Guidelines on the scope of obligations for providers of general-purpose AI models under the AI Act. European Commission, Shaping Europe's digital future, 18 July 2025, viewed 8 November 2026. https://digital-strategy.ec.europa.eu/en/library/guidelines-scope-obligations-providers-general-purpose-ai-models-under-ai-act
25. The General-Purpose AI Code of Practice. European Commission, Shaping Europe's digital future, last updated 7 October 2026, viewed 8 November 2026. https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai
26. Explanatory Notice and Template for the Public Summary of Training Content for general-purpose AI models. European Commission, Shaping Europe's digital future, 24 July 2025, viewed 8 November 2026. https://digital-strategy.ec.europa.eu/en/library/explanatory-notice-and-template-public-summary-training-content-general-purpose-ai-models
27. AI Act: Commission issues draft guidance and reporting template on serious AI incidents, and seeks stakeholders' feedback. European Commission, Shaping Europe's digital future, 26 September 2025, viewed 8 November 2026. https://digital-strategy.ec.europa.eu/en/consultations/ai-act-commission-issues-draft-guidance-and-reporting-template-serious-ai-incidents-and-seeks
28. Supporting the implementation of the AI Act with clear guidelines. European Commission, Shaping Europe's digital future, last updated 31 July 2026, viewed 8 November 2026. https://digital-strategy.ec.europa.eu/en/news/supporting-implementation-ai-act-clear-guidelines
29. LegalRuleML Core Specification Version 1.0. OASIS Standard, OASIS, 30 August 2021, viewed 8 November 2026. https://docs.oasis-open.org/legalruleml/legalruleml-core-spec/v1.0/legalruleml-core-spec-v1.0.html
30. From Legal Text to AI-specific Risk Sources: A Systematic Analysis of the EU AI Act's High-Risk Requirements. Ronald Schnitzer, Mike Auer, Rumpa Choudhury and others, arXiv 2609.13535, version 1, 11 September 2026, viewed 8 November 2026. https://arxiv.org/abs/2609.13535
31. An Empirical Study and Assessment of EU AI Act Compliance Checkers. Zhen Tao, Alize Kahraman, Shidong Pan and others, arXiv 2609.36228, version 1, 28 September 2026, viewed 8 November 2026. https://arxiv.org/abs/2609.36228
32. From Obligation to Specification: A Survey on Validating EU AI Act Requirements in RE. T. Y. Emmy Lai, Sven Giesselbach, Matthias Koch and Héctor Allende-Cid, arXiv 2607.21608, version 1, 18 May 2026, viewed 8 November 2026. https://arxiv.org/abs/2607.21608
33. Subject Roles in the EU AI Act: Mapping and Regulatory Implications. Nicola Fabiano, arXiv 2510.13591, version 1, 15 October 2025, viewed 8 November 2026. https://arxiv.org/abs/2510.13591
34. Regulation (EU) 2024/1689, ELI entry. Publications Office of the European Union, EUR-Lex, viewed 8 November 2026. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
35. European Legislation Identifier (ELI). Publications Office of the European Union, EU Vocabularies, viewed 8 November 2026. https://op.europa.eu/en/web/eu-vocabularies/eli