{"id":31861,"date":"2026-07-02T08:00:00","date_gmt":"2026-07-02T06:00:00","guid":{"rendered":"https:\/\/pegamento.nl\/niet-gecategoriseerd\/what-specific-obligations-apply-to-high-risk-ai-systems\/"},"modified":"2026-07-02T10:00:42","modified_gmt":"2026-07-02T08:00:42","slug":"what-specific-obligations-apply-to-high-risk-ai-systems","status":"publish","type":"post","link":"https:\/\/pegamento.nl\/en\/contact-center\/what-specific-obligations-apply-to-high-risk-ai-systems\/","title":{"rendered":"What specific obligations apply to high-risk AI systems?"},"content":{"rendered":"<p>Under the European AI Act, high-risk AI systems are subject to extensive obligations regarding technical documentation, risk management, transparency, human oversight, and conformity assessment. These requirements apply to both providers and organizations that deploy such systems. In <a href=\"https:\/\/pegamento.nl\/en\/ai-powered-intelligence\/\">\u201cAI-Driven Intelligence<\/a>,\u201d you can read about how organizations can use AI responsibly. In this article, we answer the most frequently asked questions about what exactly high-risk AI entails and what obligations come with it.   <\/p>\n<h2>Which AI systems exactly fall into the high-risk category?<\/h2>\n<p>High-risk AI systems are systems used in contexts where the outcomes can have significant consequences for people\u2019s health, safety, or fundamental rights. The AI Act defines two main categories: systems used as safety components in products already covered by existing EU legislation, and systems deployed in specific application areas designated by law. <\/p>\n<p>The designated high-risk application areas include, among others:<\/p>\n<ul>\n<li>Critical infrastructure such as energy, water, and transportation<\/li>\n<li>Education and vocational training, such as systems that determine who is admitted to a program<\/li>\n<li>Employment and Human Resources Management, such as automated application screening<\/li>\n<li>Access to essential services such as credit, social benefits, and health insurance<\/li>\n<li>Law Enforcement and Border Control<\/li>\n<li>The Administration of Justice and Democratic Processes<\/li>\n<li>Biometric Identification and Categorization of Individuals<\/li>\n<\/ul>\n<p>It is important to note that not every AI system used in one of these sectors is automatically classified as high-risk. The key factor is whether the system plays a decisive role in processes that have direct consequences for people. A simple scheduling system in healthcare generally falls outside the high-risk category; a system that makes medical diagnoses or assesses patient admissions, however, does fall under it.  <\/p>\n<h2>What technical requirements apply to high-risk AI systems?<\/h2>\n<p>High-risk AI systems must meet a set of technical requirements focused on reliability, safety, and verifiability. At the core of these requirements are robustness, accuracy, and the minimization of risks throughout the system\u2019s entire lifecycle. <\/p>\n<p>The main technical requirements are:<\/p>\n<ul>\n<li><strong>Risk Management System:<\/strong> An ongoing process that identifies, evaluates, and manages risks throughout the system&#8217;s entire lifecycle.<\/li>\n<li><strong>Data Quality:<\/strong> Training, validation, and test data must be relevant, representative, and free of errors. Bias in the data must be actively minimized. <\/li>\n<li><strong>Robustness and accuracy:<\/strong> The system must perform consistently and reliably, even in the event of unexpected input or cyberattacks.<\/li>\n<li><strong>Cybersecurity:<\/strong> Technical measures to protect the system against tampering and misuse.<\/li>\n<li><strong>Logging and recording:<\/strong> Automatic recording of events throughout the lifecycle, so that the system&#8217;s performance can be reviewed afterward.<\/li>\n<li><strong>Human oversight:<\/strong> The system must be designed so that people can effectively monitor and understand it, and halt or correct it if necessary.<\/li>\n<\/ul>\n<p>These technical requirements do not apply only once, at the time of the system&#8217;s launch. They remain in effect throughout the system&#8217;s entire operational lifespan and require periodic evaluation and adjustment. <\/p>\n<h2>What should be included in the technical documentation for a high-risk AI system?<\/h2>\n<p>The technical documentation for a high-risk AI system must demonstrate that the system complies with all applicable requirements of the AI Act. This documentation is prepared by the provider before the system is placed on the market and must be retained for at least ten years. <\/p>\n<p>The documentation must include at least the following:<\/p>\n<ul>\n<li>A general description of the system, including its intended purpose and the technology used<\/li>\n<li>A detailed description of the system&#8217;s architecture and logic<\/li>\n<li>Information about training dates, validation methods, and test results<\/li>\n<li>A description of the risk management system and the control measures implemented<\/li>\n<li>Performance metrics, including accuracy thresholds and known limitations<\/li>\n<li>Measures for human oversight and the ways in which users can monitor the system<\/li>\n<li>A description of cybersecurity measures<\/li>\n<li>The declaration of conformity and, where applicable, the CE marking<\/li>\n<\/ul>\n<p>In addition to the technical documentation, suppliers must also prepare user instructions. These are intended for the organizations that use the system and contain practical information on proper commissioning, monitoring, and identifying risks. <\/p>\n<h2>How does the conformity assessment for high-risk AI systems work?<\/h2>\n<p>A conformity assessment is the process by which a provider demonstrates that a high-risk AI system complies with the requirements of the AI Act. For most high-risk systems, the provider can conduct this assessment itself through an internal procedure. For specific categories, such as biometric identification systems, the involvement of a notified body is mandatory.  <\/p>\n<h3>Self-Assessment vs. External Assessment<\/h3>\n<p>In the self-assessment process, the provider follows a structured internal procedure based on the harmonized standards published in support of the AI Act. The provider prepares the technical documentation, implements the risk management system, and records the results. Upon successful completion, a declaration of conformity is issued and, where applicable, a CE marking is affixed.  <\/p>\n<h3>Registration in the EU database<\/h3>\n<p>High-risk AI systems must be registered in a central EU database before being placed on the market. This database is publicly accessible and promotes transparency and oversight. The registration includes key information about the system, the provider, and the intended use. Providers outside the EU are required to designate an authorized representative within the EU who will fulfill these obligations on their behalf.   <\/p>\n<h2>What are the obligations for organizations that use high-risk AI?<\/h2>\n<p>Organizations that deploy high-risk AI systems\u2014known as \u201cdeployers\u201d\u2014have specific obligations under the AI Act. They are not responsible for the technical development of these systems, but they are responsible for ensuring their responsible use in practice. <\/p>\n<p>The main obligations for organizations that use high-risk AI are:<\/p>\n<ul>\n<li><strong>Follow the instructions for use:<\/strong> The system may only be used in the manner specified by the provider.<\/li>\n<li><strong>Organizing human oversight:<\/strong> Concrete measures must be in place to ensure human oversight, including the designation of responsible staff members.<\/li>\n<li><strong>Fundamental Rights Impact Assessment:<\/strong> Government agencies and certain other organizations must assess in advance the potential impact on the fundamental rights of those affected.<\/li>\n<li><strong>Retention of Logs:<\/strong> Automatically generated log files must be retained for the period specified by the provider, and for at least six months.<\/li>\n<li><strong>Reporting Incidents:<\/strong> Serious incidents or malfunctions with potentially dangerous consequences must be reported to the competent national authority.<\/li>\n<li><strong>Transparency toward those affected:<\/strong> When the system is used to make decisions about individuals, those individuals must be informed of this.<\/li>\n<\/ul>\n<p>Please note: An organization that modifies a high-risk AI system, brands it with its own name, or uses the system for a purpose for which it was not intended becomes, from a legal standpoint, the provider itself. In that case, all obligations that apply to the original provider also apply to the organization. <\/p>\n<h2>What are the consequences of failing to comply with the high-risk AI requirements?<\/h2>\n<p>Failure to comply with the requirements for high-risk AI systems can result in substantial fines. The AI Act establishes a tiered fine structure that took effect on August 2, 2025, with the amount of the fine depending on the nature of the violation. <\/p>\n<p>The three stages of penance are:<\/p>\n<ul>\n<li><strong>Prohibited AI Practices (Article 5):<\/strong> A maximum of 35 million euros or 7% of global annual revenue, whichever is higher.<\/li>\n<li><strong>Other non-compliance, including high-risk obligations:<\/strong> Up to 15 million euros or 3% of global annual revenue.<\/li>\n<li><strong>Inaccurate or misleading information provided to regulators:<\/strong> Up to 7.5 million euros or 1% of global annual revenue.<\/li>\n<\/ul>\n<p>For small and medium-sized enterprises, the lower of the fixed amount or the percentage applies in each case, which offers some protection. Oversight of high-risk AI rests with national market surveillance authorities. In January 2026, Finland became the first Member State to grant enforcement powers under the AI Act to its national authority. Other Member States are expected to follow suit soon, leading to further tightening of enforcement throughout 2026.   <\/p>\n<p>In addition to financial penalties, authorities may also require that a system be withdrawn from the market or that its use be suspended until the noncompliance has been rectified. The reputational damage associated with public enforcement actions can be just as severe for many organizations as the fines themselves. <\/p>\n<h2>How Pegamento Helps with High-Risk AI Compliance<\/h2>\n<p>Navigating the requirements surrounding high-risk AI requires technical knowledge, legal insight, and practical implementation experience. We help organizations deploy AI responsibly and in compliance with regulations, without compromising speed or innovation. <\/p>\n<p>What we can do for you:<\/p>\n<ul>\n<li><strong>Assessment and Risk Classification:<\/strong> We identify which AI applications within your organization fall into the high-risk category and determine the resulting obligations.<\/li>\n<li><strong>Agentic AI within compliance frameworks:<\/strong> Our <a href=\"https:\/\/pegamento.nl\/en\/agentic-ai-for-customer-service\/\">Agentic AI for customer service<\/a> is designed with human oversight as a core principle. Whereas traditional RPA bots operate based on fixed instructions, our self-thinking Agentic AI assistants take the initiative independently and act proactively\u2014but always within the parameters you set. <\/li>\n<li><strong>Technical Documentation and Risk Management:<\/strong> We provide support in preparing the required documentation and establishing an ongoing risk management system.<\/li>\n<li><strong>Everything under one roof:<\/strong> From consulting and implementation to management and support, you have a single point of contact for the entire process, without the need for complex supplier coordination.<\/li>\n<li><strong>Certified Process:<\/strong> Our approach is based on ISO 27001 (information security), ISO 9001 (quality management), and ISO 26000 (corporate social responsibility), which aligns with the compliance requirements of the AI Act.<\/li>\n<\/ul>\n<p>Would you like to know where your organization stands right now and what steps are needed to become compliant? <a href=\"https:\/\/pegamento.nl\/en\/contact-2\/\">Contact us<\/a>, and together we\u2019ll determine the best approach for your situation.<\/p>\n<div class=\"wp-block-seoaic-faq-block\">\n    <h2 class=\"seoaic-faq-section-title\">Frequently Asked Questions<\/h2>\n            <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                Hoe weet ik of mijn bestaande AI-systeem als hoog-risico wordt geclassificeerd onder de AI Act?            <\/h3>\n            <p class=\"seoaic-answer\">\n                Begin met een grondige inventarisatie van alle AI-toepassingen binnen je organisatie en toets ze aan de toepassingsgebieden die de AI Act aanwijst als hoog-risico. Kijk daarbij niet alleen naar de sector, maar specifiek naar de rol die het systeem speelt: heeft het een directe invloed op beslissingen die mensen raken op het gebied van werk, zorg, krediet of veiligheid? Als je twijfelt, is het verstandig om juridisch of technisch advies in te winnen, want een verkeerde classificatie kan leiden tot non-conformiteit en bijbehorende boetes.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                Wat is het verschil tussen een aanbieder en een deployer, en waarom is dat onderscheid zo belangrijk?            <\/h3>\n            <p class=\"seoaic-answer\">\n                Een aanbieder is de partij die een hoog-risico AI-systeem ontwikkelt en op de markt brengt; een deployer is de organisatie die het systeem in de praktijk inzet. Het onderscheid is cruciaal omdat beide partijen eigen, niet-overdraagbare verplichtingen hebben onder de AI Act. Bijzonder aandachtspunt: zodra een deployer het systeem aanpast, er zijn eigen naam op zet of het buiten het beoogde doel gebruikt, wordt die partij juridisch gezien zelf aanbieder en gelden alle bijbehorende verplichtingen volledig.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                Hoe begin ik met het opzetten van een risicobeheerssysteem voor een hoog-risico AI-toepassing?            <\/h3>\n            <p class=\"seoaic-answer\">\n                Een goed risicobeheerssysteem start met het systematisch identificeren van alle mogelijke risico&#8217;s gedurende de volledige levenscyclus van het systeem, van ontwikkeling tot buiten gebruik stelling. Vervolgens beoordeel je de kans en impact van elk risico en stel je beheersmaatregelen op, zoals technische beperkingen, gebruikersinstructies en toezichtprocedures. Belangrijk is dat dit geen eenmalige exercitie is: het systeem vereist periodieke herziening, zeker wanneer het model wordt bijgewerkt, de data verandert of het gebruik wordt uitgebreid.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                Moet ik als deployer ook iets regelen als mijn medewerkers het AI-systeem dagelijks gebruiken?            <\/h3>\n            <p class=\"seoaic-answer\">\n                Ja, menselijk toezicht is een van de kernverplichtingen voor deployers en gaat verder dan alleen een technische instelling. Je moet concreet vastleggen wie binnen de organisatie verantwoordelijk is voor het monitoren van het systeem, hoe medewerkers worden getraind om de output kritisch te beoordelen, en hoe zij het systeem kunnen stopzetten of corrigeren als dat nodig is. Zorg er ook voor dat medewerkers begrijpen wat het systeem wel en niet kan, zodat ze niet blind varen op de uitkomsten.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                Wat is een fundamentele rechtenimpactbeoordeling en wanneer is die verplicht?            <\/h3>\n            <p class=\"seoaic-answer\">\n                Een fundamentele rechtenimpactbeoordeling (FRIA) is een voorafgaande analyse van de mogelijke effecten van een hoog-risico AI-systeem op de grondrechten van betrokkenen, zoals het recht op privacy, non-discriminatie en eerlijk proces. Deze beoordeling is verplicht voor overheidsinstanties en voor private organisaties die hoog-risico AI inzetten in publiek toegankelijke diensten, zoals kredietverlening of verzekeringen. De uitkomst moet worden gedocumenteerd en kan aanleiding geven tot aanvullende beheersmaatregelen voordat het systeem in gebruik wordt genomen.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                Wat gebeurt er als mijn hoog-risico AI-systeem een ernstig incident veroorzaakt?            <\/h3>\n            <p class=\"seoaic-answer\">\n                Bij een ernstig incident, zoals een systeemstoring met gevaarlijke gevolgen of een significante schending van grondrechten, ben je als deployer verplicht dit te melden bij de bevoegde nationale markttoezichtautoriteit. Doe dit zo snel mogelijk en documenteer het incident gedetailleerd, inclusief de oorzaak, de gevolgen en de genomen herstelmaatregelen. Bewaar ook de automatisch gegenereerde logbestanden, want die zijn essentieel voor het onderzoek en kunnen aantonen dat je systeem en processen correct waren ingericht.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                Hoe lang duurt het gemiddeld om een hoog-risico AI-systeem volledig compliant te maken?            <\/h3>\n            <p class=\"seoaic-answer\">\n                De doorlooptijd hangt sterk af van de complexiteit van het systeem, de kwaliteit van de bestaande documentatie en de volwassenheid van de interne processen. Voor organisaties die al werken met frameworks zoals ISO 27001 of ISO 9001 is de stap naar AI Act-compliance aanzienlijk kleiner, omdat veel bouwstenen al aanwezig zijn. In de praktijk varieert een volledig compliancetraject, inclusief risicobeoordeling, documentatie en implementatie van toezichtprocedures, van enkele maanden voor eenvoudigere systemen tot meer dan een jaar voor complexe, grootschalige toepassingen.            <\/p>\n        <\/div>\n        <\/div>\n","protected":false},"excerpt":{"rendered":"<p>The EU AI Act imposes strict obligations on high-risk AI\u2014find out what this means for your organization.<\/p>\n","protected":false},"author":2,"featured_media":31862,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[500],"tags":[],"class_list":["post-31861","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-contact-center"],"_links":{"self":[{"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/posts\/31861","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/comments?post=31861"}],"version-history":[{"count":2,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/posts\/31861\/revisions"}],"predecessor-version":[{"id":31864,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/posts\/31861\/revisions\/31864"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/media\/31862"}],"wp:attachment":[{"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/media?parent=31861"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/categories?post=31861"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/tags?post=31861"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}