Article 16 sets the obligations of providers of high-risk AI systems, including ensuring the system complies with the Chapter III Section 2 requirements, indicating name, trade name or trademark and contact address on the system or its packaging or accompanying documentation, having a quality management system under Article 17, keeping documentation under Article 18, keeping automatically generated logs under Article 19 where the provider controls them, taking corrective action under Article 20 where the system is not in conformity, cooperating with authorities under Article 21, carrying out the conformity assessment, drawing up the EU declaration of conformity and affixing CE marking where required, and registering the system under Article 49. The duties apply together, and the article should be read with Articles 17 to 21 and the conformity provisions.
What is the core duty in Article 16?
The core duty is to ensure that a high-risk AI system complies with the requirements in Chapter III Section 2 before it is placed on the market or put into service, and to maintain that compliance while the system is on the market. Compliance is not a one-off declaration at release. It requires the risk management, data governance, documentation, logging, transparency, oversight, accuracy, robustness and cybersecurity work in Articles 8 to 15 to be designed, tested and evidenced, and it requires the provider to act where the system ceases to comply. A provider that treats Article 16 as a checklist to be signed at release, without the underlying evidence, has not met the duty, even if the declaration is drawn up.
What identification and information duties apply?
Article 16 requires the provider to indicate its name, registered trade name or registered trademark, and its address at which it can be contacted, on the high-risk system or, where that is not possible, on its packaging or accompanying documentation. The identification duty matters for deployers, authorities and affected persons who need to know who is responsible for the system. Importers have a parallel duty to indicate their own contact details, and distributors must verify that the provider and importer information is present. The contact information should be kept current, and a change of provider identity, for example through a corporate change or a rebranding, should trigger a review of the identification on the system and in its documentation.
For the broader regulatory framework, see provider responsibilities.
How do quality, documentation and logs fit together?
Article 16 requires a quality management system under Article 17, documentation keeping under Article 18, and keeping automatically generated logs under Article 19 where the provider controls them. The quality management system provides the organisational framework: policies, procedures, responsibilities, and review. Documentation keeping requires the technical documentation, the quality management documentation, and the conformity records to be kept for ten years after the system is placed on the market or put into service, and made available to authorities on request. Logs provide the operational trace: the automatically generated logs that the system produces must be kept for a period appropriate to the intended purpose, at least six months unless Union or national law provides otherwise. The three duties together create the evidence chain from design to operation.
What happens where a system is not in conformity?
Article 16, read with Article 20, requires a provider that considers or has reason to consider that a high-risk system is not in conformity to take corrective action immediately, to bring the system into conformity, withdraw it, disable it, or recall it, as appropriate, and to inform the distributors, deployers, authorised representative and importers concerned, and the market surveillance authority of the Member State where the system was placed on the market, where the non-conformity presents a risk. The duty is triggered by considering or having reason to consider non-conformity, not only by proof of harm. A provider should therefore have an incident and non-conformity process that can assess a report, decide on corrective action, and communicate with the value chain and the authority without delay.
How do conformity, declaration, marking and registration follow?
Article 16 requires the provider to carry out the conformity assessment procedure in Article 43, draw up the EU declaration of conformity in Article 47, affix the CE marking in Article 48, and comply with the registration obligation in Article 49, where those provisions apply to the system and the route chosen. For Annex I Section A products, the conformity procedure is the product procedure. For Annex III systems, the route depends on the system and the standards applied, and can involve internal control or a notified body. The declaration, marking and registration are the visible outcomes of the conformity work, not substitutes for it. A system must not be marked or declared conforming before the underlying requirements are met and evidenced.
Continue with Article 17 quality management.
What does this guide not decide?
This guide explains Article 16 as a whole. It does not decide whether a particular system is high-risk, which conformity route applies, or whether a particular provider has met its duties. Those questions need the classification, the conformity route, and the evidence for each duty, read against Articles 16 to 21 and 43 to 49 in the consolidated text. Provider duties carry the main burden of the high-risk regime, so borderline or consequential cases should be confirmed with a competent authority or legal adviser, and with a notified body where one is involved, before the system is placed on the market.
Frequently asked questions
How long must provider documentation be kept?
Article 18 requires documentation, including technical documentation and quality management documentation, to be kept for ten years after the high-risk system is placed on the market or put into service, and to be made available to national competent authorities on request.
Must logs be kept for ten years as well?
No. Logs under Article 19 are kept for a period appropriate to the intended purpose, at least six months, unless Union or national law provides otherwise. The ten-year period applies to documentation under Article 18, not to every log.
Does Article 16 apply to non-high-risk systems?
Article 16 is addressed to providers of high-risk AI systems. Providers of non-high-risk systems can still face duties under Articles 4, 5, 50 and Chapter V, and under other law, but the Article 16 duty set is tied to high-risk status.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗