Your AI Act duties, with dates
Answer 2 questions: your role and what the AI system does. You get each duty with its date, and how much ISO/IEC 42001 work covers it.
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 (Digital Omnibus).
Your duty sheet on 2026-11-04
Deployer: High-risk use (Annex III)
Next deadline: 2027-12-02
393 days left
8 duties start on that day. Your sheet has 10 duties: 2 already apply, 8 start later.
How much ISO/IEC 42001 work covers these duties
- 3 large overlap
- 5 some overlap
- 2 no overlap
Get your duty sheet as a PDF
Your 10 duties, by date
2025-02-02In force
2 duties
Support AI literacy of your staff
Take measures so that staff who build or use AI systems understand them well enough for their role. The Omnibus removed the duty to reach a set level.
Art. 4Large overlap with 42001
A 42001 management system already sets competence and awareness needs for people who work on AI, and keeps records of training.
Check that no use is a prohibited practice
Confirm that the system is not used for a banned purpose, such as social scoring, manipulation that causes harm, or emotion recognition at work or in schools. Keep the check on file.
Art. 5Some overlap with 42001
The AI impact assessment of a 42001 system can catch these uses. The ban itself is a legal test that you must do against Art. 5.
2027-12-02In 393 days
8 duties
Use the system as the instructions say
Take technical and organisational measures so that you use the system within its instructions for use.
Art. 26(1)Large overlap with 42001
42001 operational planning and control of AI use covers this.
Assign trained people to oversee the system
Give human oversight to people with the competence, training, authority and support they need.
Art. 26(2)Large overlap with 42001
42001 roles, responsibilities and competence cover this.
Check input data under your control
Where you control the input data, make sure it is relevant and representative for the intended purpose.
Art. 26(4)Some overlap with 42001
42001 data controls help. The test is against the provider's intended purpose.
Monitor use and report risks and incidents
Monitor the system. If it presents a risk, inform the provider and the authority and stop using it. Report serious incidents.
Art. 26(5)Some overlap with 42001
42001 monitoring and incident handling help. The duty to inform and to stop comes from the law.
Keep the logs for at least 6 months
Keep the logs that the system generates, where they are under your control, for at least 6 months.
Art. 26(6)Some overlap with 42001
42001 controls on records help. The minimum period is legal.
Use the provider's information in your DPIA
Use the information from the provider to carry out the data protection impact assessment under the GDPR, where one is needed.
Art. 26(9)Some overlap with 42001
The 42001 AI impact assessment can share inputs with the DPIA. The DPIA itself is a GDPR duty.
Tell people that AI helps decide about them
If an Annex III system makes or helps make decisions about people, tell them. On request, explain the role of the system in a decision.
Art. 26(11), Art. 86No overlap with 42001
A legal information duty to the people affected.
Check whether you become the provider
You become the provider if you put your name or trademark on a high-risk system, make a substantial modification, or change its purpose so that it becomes high-risk. The original provider must then cooperate with you.
Art. 25No overlap with 42001
A legal test of your role. 42001 scope work helps you see it, but does not decide it.
Which role are you?
One company can hold 2 roles. A company that sells an AI hiring tool is its provider. It is also a deployer when it uses the tool for its own hiring. Run the finder once per role.
A deployer, importer or distributor becomes the provider when it puts its own name on a high-risk system, changes it substantially, or uses it for a high-risk purpose the provider did not intend.