We classify your AI systems under Regulation (EU) 2024/1689, build the technical documentation and quality management system it requires, and test your models against the attacks named in Article 15.
For
You receive
The AI Act is built on classification. Article 5 lists prohibited practices, such as building facial recognition databases through untargeted scraping of facial images, or inferring emotions in the workplace and in education institutions other than for medical or safety reasons. An AI system is high-risk under Article 6(1) when it is a safety component of a product, or is itself a product, covered by the legislation listed in Annex I and that product must undergo third-party conformity assessment. It is high-risk under Article 6(2) when it falls in an Annex III use case. By derogation, Article 6(3) takes an Annex III system out of the high-risk category when it poses no significant risk of harm, for example because it only performs a narrow procedural task or a preparatory task. The derogation never applies to systems that profile natural persons, and the provider must document the assessment before placing the system on the market or putting it into service, and register it (Article 6(4) and Article 49(2)).
Annex III point 1 shows why precision matters. It covers remote biometric identification systems, but not biometric verification whose sole purpose is to confirm that a specific natural person is the person he or she claims to be. It also covers biometric categorisation according to sensitive or protected attributes, and emotion recognition. A high-risk system must meet Articles 9 to 15: risk management, data and data governance, technical documentation with at least the content of Annex IV, record-keeping, transparency and information to deployers, human oversight, and accuracy, robustness and cybersecurity. The provider also needs a quality management system under Article 17. Article 15(5) names the AI-specific attacks the technical measures must address where appropriate: data poisoning, model poisoning, adversarial examples or model evasion, confidentiality attacks and model flaws.
Conformity assessment follows Article 43. Annex III points 2 to 8 use internal control (Annex VI). For the biometric systems in point 1, internal control is only available where the provider has applied harmonised standards or common specifications; otherwise a notified body assesses the quality management system and the technical documentation (Annex VII). Article 6(1) systems covered by Section A of Annex I follow the procedure of their sectoral legislation (Article 43(3)). ISO/IEC 42001 helps organise the management system, but certification against it gives no presumption of conformity: under Article 40, only harmonised standards published in the Official Journal do. Where a high-risk AI system is also a product with digital elements under the CRA, meeting the CRA essential requirements, with the Article 15 level of protection demonstrated in the EU declaration of conformity, means it is deemed to comply with the cybersecurity part of Article 15, not with its accuracy and robustness requirements (CRA Article 12, mirrored in AI Act Article 42(3), which Regulation (EU) 2026/1744 introduced). As a rule, the assessment then follows AI Act Article 43.
An inventory of your AI systems, each tested against Article 5, Article 6(1) and Annex I, and Annex III. It records your role as provider or deployer, any Article 25 trigger, the Article 6(3) reasoning written to the standard Article 6(4) requires, and any overlap with the Cyber Resilience Act.
Typical duration: 2 to 4 weeks
A requirement-by-requirement review of your risk management, data governance, logging, instructions for use, human oversight, accuracy, robustness and cybersecurity, and quality management system, with a prioritised remediation plan owned by named teams.
Typical duration: 3 to 6 weeks
A structured technical documentation file covering every Annex IV point, from the general description and development process to validation and testing, cybersecurity measures, the risk management system and the post-market monitoring plan. For products covered by Section A of Annex I, it is built as the single set of documentation Article 11(2) requires.
Typical duration: 6 to 12 weeks
A threat model and test plan for data poisoning, model poisoning, model evasion, confidentiality attacks and model flaws, together with the security of the surrounding system. We design the test plan and can run tests ourselves; where a customer or ETSI TS 119 461 requires an accredited laboratory, we coordinate with the laboratory you choose and link its results to Article 15 and Annex IV.
Typical duration: 4 to 8 weeks
An AI management system designed so that its processes also cover the Article 17 quality management aspects, with policies, procedures, records and an internal audit, ready for audit by the certification body you choose.
Typical duration: 3 to 6 months
Selection of the Article 43 procedure, a draft EU declaration of conformity, registration content, and readiness for a notified body where Annex VII or sectoral legislation requires one.
Typical duration: 4 to 8 weeks
For a system that is not high-risk, a reasoned classification report you can defend before customers and the market surveillance authority. Where an Annex III system relies on Article 6(3), the report is the assessment Article 6(4) requires and includes the content for registration under Article 49(2). It comes with the evidence pack customers ask for as deployers and, for banks, the information they need for due diligence on ICT third-party service providers under Article 28(4) of Regulation (EU) 2022/2554 (DORA).
Typical duration: 2 to 4 weeks
Check two routes. Under Article 6(1), it is high-risk if it is a safety component of a product, or is itself a product, covered by the Annex I legislation and that product requires third-party conformity assessment. AI used solely for non-safety aspects such as user assistance, performance optimisation or convenience is not a safety component, unless its failure or malfunctioning would endanger health and safety (Article 6(1a) and (1b), introduced by Regulation (EU) 2026/1744). Under Article 6(2), it is high-risk if it falls in an Annex III use case, unless the Article 6(3) derogation applies. Annex III systems that profile natural persons are always high-risk.
Not as remote biometric identification. Annex III point 1(a) excludes AI systems intended for biometric verification whose sole purpose is to confirm that a specific natural person is the person he or she claims to be, such as confirming identity to unlock a device or access a service. The exclusion is narrow: the same product can still be high-risk if it also performs biometric categorisation by sensitive or protected attributes or emotion recognition, or if it qualifies under Article 6(1).
For a high-risk biometric system, Article 15(5) requires resilience against attempts by unauthorised third parties to alter its use, outputs or performance by exploiting system vulnerabilities. In face verification and liveness detection, presentation attacks at the camera and injection attacks into the capture process are exactly that. We map the results of presentation attack detection testing under ISO/IEC 30107-3 and injection attack detection testing under CEN/TS 18099 to Article 15 and Annex IV, and structure them so that the same evidence answers the security due diligence of your banking customers. ETSI TS 119 461, the identity proofing specification for trust services, references both documents and requires that detection to be tested by an accredited laboratory. Where the product only performs biometric verification and is not high-risk, Article 15 is not a legal obligation, but the same evidence still answers your customers' questions. Data protection work, such as the conditions for processing biometric data under Article 9 GDPR or a data protection impact assessment under Article 35, is outside our scope; we coordinate with your data protection advisers.
At least: a general description of the system and its intended purpose; a detailed description of its elements and development, including pre-trained components, design choices, architecture, data, human oversight, validation and testing, and cybersecurity measures; information on monitoring, functioning and control; the appropriateness of the performance metrics; the risk management system; changes over the lifecycle; the harmonised standards applied or the alternative solutions used; a copy of the EU declaration of conformity; and the post-market monitoring plan. It must be drawn up before the system is placed on the market and kept up to date (Article 11). SMEs may use the Commission's simplified form, and Regulation (EU) 2026/1744 extended that option to small mid-cap enterprises (Article 11(1)).
High-risk AI systems must be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting vulnerabilities, with measures appropriate to the circumstances and the risks. Where appropriate, these include measures to prevent, detect, respond to, resolve and control data poisoning, model poisoning, adversarial examples or model evasion, confidentiality attacks and model flaws. Article 42(2) gives a presumption of conformity with these requirements to systems certified, or covered by a statement of conformity, under a cybersecurity scheme adopted under Regulation (EU) 2019/881 whose reference is published in the Official Journal, to the extent the certificate or statement covers them.
No. ISO/IEC 42001 is a management system standard and a good way to organise AI governance and the Article 17 quality management system. Under Article 40, presumption of conformity comes only from harmonised standards whose references are published in the Official Journal, and ISO/IEC 42001 certification does not give it. You still need the Annex IV documentation, the product-level requirements of Articles 9 to 15 and the Article 43 conformity assessment.
Most prohibitions in Article 5 have applied since 2 February 2025, and the obligations for providers of general-purpose AI models since 2 August 2025. Under Article 113 as amended by Regulation (EU) 2026/1744, the classification rules and the requirements and obligations for high-risk systems (Chapter III, Sections 1 to 3) apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Article 6(1) systems.