Obligations for High-Risk Systems

How are obligations for high-risk AI systems different from limited-risk systems?

The technical and operational requirements the AI system must satisfy are detailed in Articles 8-15 of the EU AI Act.

These include:

• risk management;

• data governance;

• logging;

• human oversight; and

• technical documentation.

The responsibilities of the businesses involved throughout the AI system’s lifecycle (providers, deployers, importers and distributors) are detailed in Articles 16-29 of the EU AI Act.

These include:

• conformity assessments;

• quality management systems;

• post-market monitoring; and

• incident reports.

Additional obligations apply to specific sub-categories of high-risk AI systems such as biometric identification and categorisation systems and law enforcement systems.

Note that limited risk systems do not have as many obligations attached to them as high risk systems. The obligations around limited risk systems centre on disclosure and employee AI literacy.

What are the penalties for non-compliance?

Non-compliance with the obligations relating to high-risk AI systems (other than prohibited practices) can result in fines of up to EUR 15 million or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher or, in the case of SMEs, whichever is lower.

The Act refers to the EU Commission’s definition of SMEs. This details that a ‘medium-sized’ enterprise must have:

• Fewer than 250 employees; and

• An annual turnover of under 50 million euros/ under 43 million euros on their annual balance sheet.

The risks are not only financial; non-compliance with the EU AI Act’s provisions on high-risk AI systems could lead to significant reputational damage, loss of user trust and therefore loss of profits.

Practical next steps

Appointing an AI Compliance Lead

If you believe your AI system qualifies as 'high-risk', you might consider appointing an AI Compliance Lead to assist in ensuring continuous regulatory compliance.

An AI Compliance Lead eases compliance burdens related to:

• continuous risk management;

• high data governance standards;

• preparation and maintenance of technical documentation (including design specifications and performance testing);

• conformity assessments;

• quality management systems; and

• coordinating with providers and other third-parties involved in the model’s lifecycle.