EU AI Act documentation: classification, oversight and the evidence behind them

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It changed the dates in Article 113 of the AI Act:

• Classification, the requirements for high-risk systems and the obligations of providers and deployers (Chapter III, Sections 1 to 3) apply from 2 December 2027 for the high-risk systems listed in Annex III.
• The same rules apply from 2 August 2028 for high-risk systems covered by the Union harmonisation legislation listed in Annex I.
• The general provisions, including AI literacy in Article 4, have applied since 2 February 2025. The 2026 amendment rewrote Article 4: providers and deployers take measures to support the AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf, without having to guarantee a specific level for any individual.
• The Regulation's general application date, 2 August 2026, did not change. Several parts started earlier or start later.

For high-risk systems placed on the market or put into service before the high-risk rules apply, Article 111(2), as amended, applies the Regulation only if their design changes significantly from that date. Providers and deployers of high-risk systems intended for use by public authorities must comply by 2 August 2030.

The Regulation assigns duties by role, so the first question for each system is which role you hold.

• Provider (Article 3(3)): develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark.
• Deployer (Article 3(4)): uses an AI system under its authority, outside personal non-professional use.

A deployer becomes a provider under Article 25(1) if it puts its name or trademark on a high-risk system, makes a substantial modification after which the system remains high-risk, or changes the intended purpose of a system that was not high-risk in a way that makes it high-risk. A firm that adapts a purchased system can therefore take on the provider's documentation duties.

Under Article 6(2), the systems listed in Annex III are high-risk. For financial services, Annex III point 5(b) lists systems that evaluate the creditworthiness of natural persons or establish their credit score, with the exception of systems used to detect financial fraud. Point 5(c) lists risk assessment and pricing for natural persons in life and health insurance.

Annex III does not list KYC or anti-money laundering checks as such. Point 1(a) lists remote biometric identification but excludes biometric verification whose sole purpose is to confirm that a person is who they claim to be. A system that only supports customer due diligence is therefore not high-risk for that reason alone. If the same system also scores the creditworthiness of natural persons, that use is listed.

Article 6(3) lets a provider treat an Annex III system as not high-risk where it does not pose a significant risk of harm, including by not materially influencing the outcome of decision-making, and one of four conditions applies: a narrow procedural task, improving the result of a completed human activity, detecting decision patterns without replacing human assessment, or a preparatory task. An Annex III system that profiles natural persons is always high-risk. A provider relying on Article 6(3) must document its assessment before the system is placed on the market and is subject to registration under Article 49(2).

For anti-money laundering decisions, the EU AML Regulation sets its own conditions from 10 July 2027. See automated decisions under Article 76(5) of the AML Regulation.

The provider draws up technical documentation before the system is placed on the market or put into service, keeps it up to date and keeps it available to national authorities for ten years (Articles 11 and 18). Annex IV sets its minimum content in nine points. The provider also gives the deployer instructions for use (Article 13), including the human oversight measures. See Annex IV technical documentation, point by point.

The deployer uses the system in accordance with those instructions, assigns oversight to people with the necessary competence, training, authority and support, monitors the system, keeps the logs under its control for at least six months and informs the people affected (Article 26). Deployers of the systems listed in Annex III points 5(b) and 5(c), and deployers that are public bodies or private entities providing public services, also assess the impact on fundamental rights before first use (Article 27). See human oversight under the AI Act: what the provider builds and what the deployer keeps.

Related reading: the compliance evidence glossary, choosing an AI agent for KYC/AML evidence and audit-ready evidence packs.