Your AI vendor's model is systemic risk. What can you demand?
Article 55 duties run from the model provider to the AI Office, not to you. A buyer gets Article 53(1)(b) documentation and what the contract adds.
What the operative text of a law requires, which article says so, and the date it applies from.
Article 55 duties run from the model provider to the AI Office, not to you. A buyer gets Article 53(1)(b) documentation and what the contract adds.
Article 49 puts Annex III systems in a public EU database. What competitors will see, what stays restricted, and when the duty to register bites.
An EU reseller of a non-EU vendor's high-risk AI system has four checks to run before shipping, and a missing authorised representative stops the sale.
Article 6(3) lets a provider conclude that a listed system is not high risk. The conclusion has to be documented and registered before the system ships.
SB 26-189 repeals and reenacts the Colorado AI Act as an automated decision-making statute from 1 January 2027, with documentation and notice duties.
Regulation (EU) 2026/1744 added a ban on AI generated intimate imagery and CSAM to Article 5. It applies whether or not you run anything high risk.
A person in the loop is not oversight. Article 14 requires that the person can interpret, override and stop, and that the design makes it possible.
The AI Act sets three serious incident deadlines, not one. Which applies depends on the harm, and the fastest gives a provider two days to notify.
The AI Act amendment moved two dates and left the rest untouched. Prohibitions, GPAI duties and Article 50 transparency all apply today, delay or no delay.
Four duties, two on providers and two on deployers. Machine-readable marking, deepfake disclosure, and a 2 December 2026 cutoff for legacy systems.
Put your name on it, modify it substantially, or change its purpose so it becomes high risk. Any of the three moves the provider obligations onto you.
Chapter V binds providers of general purpose models, not their users. Fine tuning and rebranding are the two routes by which a user acquires those duties.
Article 4 binds providers and deployers alike and has no threshold, no exemption for small firms and no template. It also has no penalty of its own.