Provider Obligations (Articles 16-22)

Providers of high-risk AI systems bear the most extensive obligations under the AI Act. This chapter provides a comprehensive guide to all provider responsibilities across the entire AI system lifecycle.

Understanding Provider Role and Responsibility

Who is a Provider?

Article 3(3) Definition: A provider is any natural or legal person, public authority, agency, or other body that:

• Develops an AI system or a general-purpose AI model, OR
• Has an AI system or GPAI model developed for it, AND
• Places that system/model on the market or puts it into service under its own name or trademark, whether for payment or free of charge

When Do You Become a Provider?

Core Provider Obligations (Article 16)

The Complete Obligation Framework

Immediate Action Items for Providers

Before Market Placement:

1. Complete all Chapter III, Section 2 requirements (Articles 8-15)
2. Prepare Annex IV technical documentation
3. Implement quality management system per Article 17
4. Conduct conformity assessment per Article 43
5. Issue EU declaration of conformity per Article 47
6. Affix CE marking per Article 48
7. Register in EU database per Article 49

Ongoing Obligations:

1. Maintain quality management system
2. Operate post-market monitoring system
3. Keep logs (when AI is under provider control)
4. Report serious incidents
5. Take corrective actions when needed
6. Cooperate with competent authorities

Quality Management System (Article 17)

QMS Requirements Framework

Article 17(1) mandates a QMS that ensures compliance in a systematic and documented manner. The QMS must address:

QMS Documentation Structure

Level 1 - Policy Documents:

• AI quality policy statement
• Compliance strategy
• Organisational chart with responsibilities

Level 2 - Procedures:

• Design and development procedures
• Testing and validation procedures
• Risk management procedures
• Post-market monitoring procedures
• Incident reporting procedures
• Corrective action procedures
• Document control procedures

Level 3 - Work Instructions:

• Specific technical instructions
• Testing protocols
• Data handling guidelines
• Logging specifications

Level 4 - Records:

• Design review records
• Test results
• Risk assessments
• Incident reports
• Training records

💡 Expert Tip: Align your AI QMS with ISO 9001 (quality management) and ISO/IEC 42001 (AI management systems). While not required, these standards provide proven frameworks that facilitate compliance.

QMS Implementation Checklist

• Define QMS scope and boundaries
• Establish quality policy and objectives
• Assign management representative and responsibilities
• Document all required procedures
• Implement document control system
• Establish competence and training programme
• Create internal audit schedule
• Define management review process
• Implement continuous improvement mechanism

Technical Documentation (Article 11 / Annex IV)

Documentation Requirements Summary

Technical documentation must be drawn up before market placement and kept up-to-date throughout the lifecycle.

Documentation Retention

Post-Market Monitoring (Article 72)

PMS System Requirements

Article 72(1) requires providers to establish and document a post-market monitoring system that is proportionate to:

• The nature of the AI technology
• The risks of the specific high-risk AI system

PMS Data Collection

PMS Plan Elements

The PMS plan must include:

1. Data collection strategy — What data, how collected, from whom
2. Analysis methodology — How data will be evaluated
3. Trigger thresholds — When corrective action required
4. Corrective action procedures — How issues will be addressed
5. Communication protocols — How findings shared with authorities
6. Review schedule — How often PMS plan updated

Incident Reporting (Article 73)

Serious Incident Definition

A serious incident is any incident or malfunctioning that directly or indirectly leads to, or is likely to lead to:

Reporting Timeline

Note: The 15-day deadline runs from the date the provider or deployer becomes aware of the serious incident, not from the date a causal link is established.

Reporting Requirements

Reports must include:

• AI system identification (name, version, registration number)
• Provider identification
• Description of incident
• Date and location of incident
• Assessment of causal link to AI system
• Description of immediate actions taken
• Analysis of root cause (if known)
• Proposed corrective measures

Corrective Actions (Article 16(j))

Non-Conformity Response Framework

When an AI system does not conform to requirements:

Corrective Action Procedure

1. Identify — Detect non-conformity through monitoring, feedback, or audit
2. Assess — Evaluate severity, scope, and impact
3. Contain — Implement immediate containment measures
4. Investigate — Determine root cause
5. Correct — Implement corrective measures
6. Verify — Confirm effectiveness of corrections
7. Prevent — Implement preventive measures
8. Document — Record all actions taken
9. Report — Notify authorities if required

Authorised Representatives (Article 22)

When Required

Non-EU providers must appoint an authorised representative before placing AI systems on the EU market.

Authorised Representative Obligations

The representative must:

Mandate Requirements

The written mandate must specify:

• Representative's identity and contact details
• Provider's identity and contact details
• AI systems covered by the mandate
• Tasks delegated to representative
• Representative's authority limits

Provider Relationships in the Value Chain

Provider-Deployer Interface

Provider-Importer-Distributor Obligations

Compliance Checklist: Provider Obligations

Documentation:

• Technical documentation complete per Annex IV
• EU declaration of conformity prepared
• Instructions for use drafted
• QMS documented

Systems:

• Quality management system implemented
• Post-market monitoring system operational
• Incident reporting procedures established
• Corrective action procedures defined

Market Placement:

• Conformity assessment completed
• CE marking affixed
• EU database registration done
• Authorised representative appointed (if non-EU)

Ongoing:

• Performance monitoring active
• Log retention operational
• Incident reporting functional
• Authority cooperation readiness confirmed