Management systems, control evidence and what certification bodies ask to see before they sign.
Article 47 makes the provider answer for every high-risk requirement. What the signatory under Annex V point 8 commits to, and what Article 99 attaches.
Under Article 5(1a) of the AI Act, an image generator is prohibited when its safeguards cannot be shown to work. What a regulator can demand to see.
Articles 57 to 62 create national sandboxes and, after the 2026 omnibus, a Union level one. The exit report and the fine shield are the parts with value.
Article 43 gives most Annex III systems an internal control route under Annex VI. Biometrics is the exception, and Annex I products follow their own law.
Article 72 requires a documented system collecting performance data across the whole lifetime, and the plan itself sits in the Annex IV technical file.
You cannot classify systems you cannot see, and the AI Act obligations all start with classification. Four detection sources, ranked by what they miss.
Data governance for high-risk systems covers origin, preparation, assumptions, bias examination and gaps. Most teams can evidence two of those five.
38 controls in nine areas against four functions and 72 subcategories. One is certifiable, one is not, and procurement asks for the certificate.
Annex IV runs to nine points and point two alone has seven sub-points. The evidence either exists as an artefact or the control exists only in the policy.
Article 27 binds public bodies, private providers of public services, and two Annex III uses. A DPIA can be reused, but it does not replace the assessment.
Most AI vendor questionnaires test whether a supplier has a policy. These test whether it can hand you the artefacts your own obligations will require.