Inspect 12 fictional AI systems, their deterministic risk classification, mapped obligations and the official source behind every conclusion.
Example data — read-only. This is a fictional register for a made-up company (“Meridian Group”). Nothing here is real customer data. Open any system to see its risk class and the obligations that follow, each linked to its source on EUR-Lex. Ready to map your own AI?Create your register →Get an instant snapshot
12
AI systems
9
frameworks covered
81
obligations mapped
1
change to review
Regulatory change · impact on this register
what changed · who it hits · what to do
High-risk implementation timeline — amended dates now in force
Regulation (EU) 2026/1744 entered into force on 27 July 2026. Annex III requirements apply from 2 December 2027; Annex I embedded-product requirements from 2 August 2028. What to do: re-baseline each affected system against the applicable track and preserve the prior planning decision in the audit trail.
Art. 12 + 19: the provider builds in automatic logging and keeps the logs under its control. Art. 26(6): the deployer keeps the logs under its control for a period appropriate to the intended purpose, of at least six months, unless Union or national law provides otherwise.
Art. 14: the provider designs the system so that natural persons can oversee it effectively. Art. 26(2): the deployer assigns oversight to natural persons who have the necessary competence, training and authority, and gives them the necessary support.
Art. 12 + 19: the provider builds in automatic logging and keeps the logs under its control. Art. 26(6): the deployer keeps the logs under its control for a period appropriate to the intended purpose, of at least six months, unless Union or national law provides otherwise.
Art. 14: the provider designs the system so that natural persons can oversee it effectively. Art. 26(2): the deployer assigns oversight to natural persons who have the necessary competence, training and authority, and gives them the necessary support.
GPAI in useCustomer-service chatbotdeployer6 obligations
Answers customer questions using an external language model.
Risk of becoming a provider
Whoever develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark is its provider; so is whoever develops a general-purpose AI model, or has it developed, and places it on the market under its own name or trademark (Art. 3(3)). Under Art. 25(1) you also become the provider of a high-risk AI system if you put your name or trademark on a high-risk system already on the market, make a substantial modification to it so that it remains high-risk, or change the intended purpose of an AI system, including a general-purpose AI system, so that it becomes high-risk.
Not a duty of yours: Art. 53 places documentation and information duties on the model provider, including towards providers that integrate the model into their own AI systems. Checking that your supplier meets them is how you can rely on it.
Art. 50(1) and (2) bind the provider, not the deployer. If you developed the system yourself, for example a chatbot built on a third-party model, and put it into service under your own name, you are its provider (Art. 3(3)) and those duties are yours. If you use another party's system, paragraphs 1 and 2 do not place that duty on you.
Art. 12 + 19: the provider builds in automatic logging and keeps the logs under its control. Art. 26(6): the deployer keeps the logs under its control for a period appropriate to the intended purpose, of at least six months, unless Union or national law provides otherwise.
Art. 14: the provider designs the system so that natural persons can oversee it effectively. Art. 26(2): the deployer assigns oversight to natural persons who have the necessary competence, training and authority, and gives them the necessary support.
High risk (Annex III/I)Access control with facial recognitiondeployer10 obligations
Biometric access to the office building (not public, not real-time remote).
Explanation of individual decisions on request
Art. 86: a person affected by a decision you take on the basis of the output of an Annex III high-risk AI system (other than point 2), which produces legal effects or similarly significantly affects them in a way they consider to have an adverse impact on their health, safety or fundamental rights, has the right to obtain from you clear and meaningful explanations of the role of the AI system in the decision-making procedure and of the main elements of the decision. This does not apply where Union law, or national law in compliance with Union law, provides exceptions or restrictions, and it applies only to the extent that Union law does not otherwise provide this right.
Art. 27: before first use, deployers that are bodies governed by public law or private entities providing public services, and any deployer of an Annex III point 5(b) or (c) system (creditworthiness or credit score; risk assessment and pricing in life and health insurance), assess the impact on fundamental rights and notify the market surveillance authority of the results. Systems in Annex III point 2 (critical infrastructure) are excluded. Since Regulation (EU) 2026/1744 you may cross-refer to, or include, the relevant parts of your data protection impact assessment.
Art. 26(11): deployers of an Annex III high-risk AI system that makes or assists in making decisions related to natural persons inform those persons that they are subject to its use. This applies without prejudice to Art. 50.
Art. 26(4): to the extent the deployer exercises control over the input data, it ensures that the input data is relevant and sufficiently representative in view of the intended purpose of the high-risk AI system.
Art. 12 + 19: the provider builds in automatic logging and keeps the logs under its control. Art. 26(6): the deployer keeps the logs under its control for a period appropriate to the intended purpose, of at least six months, unless Union or national law provides otherwise.
Art. 14: the provider designs the system so that natural persons can oversee it effectively. Art. 26(2): the deployer assigns oversight to natural persons who have the necessary competence, training and authority, and gives them the necessary support.
Art. 26(1) and (5): use the system in line with the instructions for use and monitor its operation on that basis. If use in line with the instructions may present a risk, inform the provider or distributor and the market surveillance authority without undue delay and suspend use. If you identify a serious incident, immediately inform first the provider, and then the importer or distributor and the relevant market surveillance authorities; if you cannot reach the provider, Art. 73 applies mutatis mutandis.
Art. 12 + 19: the provider builds in automatic logging and keeps the logs under its control. Art. 26(6): the deployer keeps the logs under its control for a period appropriate to the intended purpose, of at least six months, unless Union or national law provides otherwise.
Art. 14: the provider designs the system so that natural persons can oversee it effectively. Art. 26(2): the deployer assigns oversight to natural persons who have the necessary competence, training and authority, and gives them the necessary support.
GPAI in useTranslation assistant (external language model)deployer5 obligations
Translates internal documents using a third-party GPAI model.
Risk of becoming a provider
Whoever develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark is its provider; so is whoever develops a general-purpose AI model, or has it developed, and places it on the market under its own name or trademark (Art. 3(3)). Under Art. 25(1) you also become the provider of a high-risk AI system if you put your name or trademark on a high-risk system already on the market, make a substantial modification to it so that it remains high-risk, or change the intended purpose of an AI system, including a general-purpose AI system, so that it becomes high-risk.
Not a duty of yours: Art. 53 places documentation and information duties on the model provider, including towards providers that integrate the model into their own AI systems. Checking that your supplier meets them is how you can rely on it.
You’ve seen how Meridian’s register works. Take two minutes to make a first, guided snapshot of one of your own systems — likely touchpoints and the questions worth resolving. Nothing is stored on our servers.
No one can guarantee compliance. No vendor, advisor or tool can —
not even those who claim to. Only a competent supervisory authority or court
decides in the end. This result is an expectation of likely attention points
under review, not an approval.
The standards are still moving. For high-risk systems the harmonised
standards are not yet finalised and interpretations shift. Every conclusion below
therefore carries its source and a version stamp, so you can see what it rests on
and that it moves with the law.