EU Artificial Intelligence Act (Regulation (EU) 2024/1689), high-risk obligations
High-risk AI systems must have a risk management system, automatic event logging, human oversight that lets a person intervene or stop the system, accuracy and robustness including resilience to manipulation, and serious-incident reporting.
Scope. Reaches a US company that places an AI system on the EU market or whose system's output is used in the EU (Article 2). Listed for that reach, not as a US rule.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Independent audit log C-V1 | Required by the text | Article 12: automatic recording of events over the system's lifetime | high | 1 case |
| Human takeover with a time window C-R3 | Required by the text | Article 14: human oversight with the ability to intervene, interrupt, or stop | high | 2 cases |
| Retrieved content as data C-I1 | Implied | Article 15: resilience against attempts to alter use or performance through manipulated inputs | medium | 5 cases |
| Degraded-input detection C-I3 | Implied | Article 15: accuracy and robustness, including against errors and inconsistencies | medium | 3 cases |
| Reporting integrity C-V2 | Required by the text | Article 73: serious incident reporting to market surveillance authorities | high | 1 case |