EU AI Act: assess the use, role and evidence

Start with the intended use

The AI Act sets requirements according to the system and the role of each organisation. An internal search assistant is not automatically high risk because it runs in a bank or hospital. Assess the purpose, people affected and authority of the particular system against the Article 6 classification rules.

Record the analysis and review it when the use or system changes. Prohibited practices and transparency requirements also need assessment; high risk is not the only relevant category.

Separate provider and deployer responsibilities

A provider places an AI system on the market or puts it into service under its name. For high-risk systems, its duties include the applicable quality, documentation and conformity requirements. See Article 16.

A deployer uses the system under its authority. High-risk deployer duties include use according to instructions, competent oversight, monitoring and relevant records. See Article 26. A modified purpose or substantial change can affect the role allocation.

The supplier and customer should document who does what. A platform does not automatically assume every obligation of the deployed system.

Turn the requirements into a practical scope

1. Control: name the reviewer, define their authority and agree when work must stop or escalate.
2. Evidence: keep relevant versions, sources, actions and reviews with appropriate access and retention.
3. Evaluation: measure task quality, errors and review effort, and define how changes and incidents are handled.

Logging is not a mandate to store unlimited sensitive content or hidden model reasoning. Align evidence with applicable requirements and GDPR. A private deployment or European region does not by itself establish conformity.

Use the current timeline

The Commission's current overview explains the phased application and the revised high-risk dates. The central AI Act readiness page carries the timeline alongside NeuroCluster's approach. Check the transition provisions relevant to your particular system.

Start with one workflow

An assessment identifies the purpose, data, roles and missing evidence. A pilot then tests the agreed controls. NeuroCluster supports that implementation; the engagement scope records demonstrated capabilities, remaining validation and operating responsibilities.

Sources and review date

Checked on 15 October 2026 against the official sources above and Regulation (EU) 2026/1744. This guide describes a review approach, not product certification.