ARE YOU ACTUALLY THE PROVIDER?
Start with the Regulation’s operator definitions and the facts of the system. Branding, development, market placement, substantial modification and intended-purpose changes can matter to the role analysis.
IF YOU ARE THE PROVIDER,
WHAT MUST YOU PROVE?
Provider obligations are not a one-page checklist. They begin with the actual system and role, then move through classification, evidence, conformity and continuing lifecycle duties. TA-14 turns that obligation map into an attributable operating record.
BOUNDARYThis page is educational and operational guidance. It is not legal advice, certification, conformity assessment or regulatory approval.
CURRENT SOURCE ANCHOR
OPEN OFFICIAL EU SOURCE ↗EUR-Lex · Regulation (EU) 2024/1689 · Provider framework
Use the official Regulation as the controlling source. Provider duties vary by system and route; high-risk provider requirements span Articles 8–25 with additional conformity, registration, post-market and incident provisions elsewhere in the Regulation.
WHAT BUSINESSES NEED TO ESTABLISH
Do not start with a generic checklist.
Start with the actual system, role, use case and evidence boundary. The same regulation can produce different obligations for different actors and systems.
WHAT RISK ROUTE APPLIES?
Screen prohibited practices, high-risk pathways, transparency duties, GPAI involvement and other applicable routes before assuming every provider carries the same obligation set.
WHAT MUST BE CREATED AND PRESERVED?
For high-risk systems, provider work can include risk management, data governance, technical documentation, logging capability, instructions, oversight design, performance controls and quality management.
WHAT MUST CONTINUE AFTER MARKET ENTRY?
Conformity, registration, documentation retention, corrective action, post-market monitoring, serious-incident handling and material-change review make provider governance a lifecycle responsibility.
THE TA-14 OPERATING ROUTE
Turn the question into a governed record.
The goal is not merely to reach an answer. It is to preserve what facts, evidence, scope and limitations supported that answer at that time.
Establish system identity, intended purpose and provider standing
Bind the obligation analysis to the actual system and version instead of treating a company-wide label as proof of role.
Map applicable provider duties to evidence
Connect each relevant requirement to the document, test, log, control, accountable owner and source needed to support it.
Preserve conformity and market-entry state
Where applicable, preserve the assessment route, declaration, registration, marking, instructions and evidence package supporting market placement or service entry.
Revalidate through the lifecycle
Material changes, incidents, drift, new intended purposes and new evidence can change the prior position. Preserve the chronology and determine what must be re-examined.
READY TO OPERATE · START PAID ACCESS NOW
Move from reading about the EU AI Act to maintaining the record.
Choose the smallest operating tier that fits the portfolio today. Upgrade when system count, team size or governance scope actually requires it.
Evidence Passport
$19/MOKeep a living system-level evidence record with obligations, gaps, versions and revalidation state.
START EVIDENCE PASSPORT →Compliance Workspace
$49/MOCoordinate evidence, owners, documentation, incidents and team compliance work in one governed workspace.
START COMPLIANCE WORKSPACE →Governance Pro
$99/MOOperate broader high-risk, GPAI, FRIA, post-market and material-change governance across a growing portfolio.
START GOVERNANCE PRO →Institution
$499/MORun institutional governance with expanded users, authority workflows, examiner rooms and portfolio reporting.
START INSTITUTION →Need an independent human readiness examination?A governed readiness review is separate from software access and starts at $750.
REQUEST READINESS REVIEW →Not ready to subscribe? Classify first.
Use the free classifier to establish the system, intended purpose, possible actor role, EU exposure and unresolved facts. When continuing evidence infrastructure is needed, paid access begins at $19 per month. Independent human readiness review remains a separate service.
COMMON QUESTIONS
Questions businesses are asking now.
Who is a provider under the EU AI Act?
The Regulation defines a provider by the legal and factual relationship to development and placing an AI system or GPAI model on the market or putting an AI system into service under its own name or trademark. Specific facts should be checked against the current legal text.
Do all providers have the same obligations?
No. Duties depend on matters including the system classification, intended purpose, whether the system is high-risk, transparency obligations, GPAI status and the organization’s actual operator role.
What are core high-risk provider requirements?
The high-risk framework includes risk management, data and data governance, technical documentation, recordkeeping capability, transparency and instructions, human oversight design, accuracy/robustness/cybersecurity and quality-management obligations, alongside conformity and lifecycle duties.
Does a provider need technical documentation?
For high-risk AI systems, Article 11 requires technical documentation before market placement or putting into service and requires it to be kept up to date.
Does provider responsibility end after launch?
No. The Regulation includes continuing duties such as post-market monitoring, corrective action and serious-incident processes, subject to the applicable system and role.
Can TA-14 certify that I am compliant?
No. TA-14 can help structure applicability, evidence, gaps, provenance, change and revalidation records. It does not turn a software subscription into legal advice, certification, conformity assessment or regulatory approval.