What obligations does the EU AI Act place on high-risk AI providers?

Q: What obligations does the EU AI Act place on high-risk AI providers?

The Act imposes technical documentation (Art. 11), record-keeping (Art. 12), transparency (Art. 13), human oversight (Art. 14), accuracy/robustness/cybersecurity (Art. 15), and conformity assessment (Art. 43) — six of which can be answered by a single signed per-axis measurement pipeline, with human oversight remaining a design choice.

EU AI Act High-Risk Provider Obligations: What a Verified Measurement Credential Answers

The EU AI Act (Regulation 2024/1689) imposes layered duties on providers of high-risk AI systems: technical documentation (Art. 11), record-keeping (Art. 12), transparency (Art. 13), human oversight (Art. 14), accuracy/robustness/cybersecurity (Art. 15), and conformity assessment (Art. 43). For a verification-first operator, these are not separate workstreams — they are outputs of a single measurement pipeline. A verified measurement credential, signed per-axis (governance, safety, care, jail-resistance, sandbox-escape), supplies auditable answers to six of the seven technical obligations: it proves the system was measured, documents the measurement method, records the boundary instrumentation, and publishes incident timelines. The remaining obligation — human oversight — is a design choice that measurement does not replace, but it does inform: a system with a published care score of 0.535 and a documented affect gap needs more oversight, not less.

The Council of AI positions the verified measurement credential as the common denominator for high-risk compliance: one signed JSON object that a notified body can audit, a regulator can verify offline, and a purchaser can check before deployment. The question shifts from 'Did you write a risk assessment?' (shelfware) to 'Can we verify your measurements?' (operational). The EU AI Act conformity assessment clock is running; providers who show up with signed per-axis evidence arrive with a head start.

Standards and sources referenced

EU AI Act (Regulation 2024/1689), Art. 11–17, 43
Council of AI Containment Incident Index (CONTAINMENT_INCIDENT_INDEX.json)
CSOAI Verified Measurement Credential standard (DEFONEOS-SEAL)
GSPC Governance Board v2 (237 public items, EU AI Act risk-tier classification)