108 Pflichten. Jede Frist. Jede Sanktion.
Die EU KI-Verordnung als verwertbare Daten — filterbar, durchsuchbar und maschinenlesbar. Kostenlos und offen.
Was gilt, was kommt als Nächstes
108 Anforderungen, filterbar
Klicken Sie auf eine Zeile, um vollständige Details, Nachweisanforderungen und Automatisierungsansatz anzuzeigen.
Beschreibung
Use system per instructions, assign human oversight, ensure input data quality, monitor operations, keep logs 6+ months.
Was zu tun ist
- Implement provider instructions
- Assign named human oversight persons
- Verify input data quality
- Active monitoring
- Log retention min 6 months
Was NICHT zu tun ist
- Do NOT use high-risk AI contrary to provider's instructions
- Do NOT skip monitoring of AI system outputs and performance
Erforderliche Nachweise
Implementation evidence, oversight assignments, monitoring logs, log retention records
Frist
2026-08-02
Beschreibung
Provide information, documentation, and access to AI systems upon request from competent authorities.
Was zu tun ist
- Designate regulatory contact person
- Maintain accessible compliance documentation
- Respond promptly and completely to requests
Was NICHT zu tun ist
- Do NOT obstruct regulatory authority inspections or information requests
- Do NOT destroy evidence relevant to compliance investigations
Erforderliche Nachweise
Designated contact details, documentation access procedures
Frist
2026-08-02
Beschreibung
Verify no AI system creates or expands facial recognition databases through untargeted scraping from internet or CCTV.
Was zu tun ist
- Check if any AI component scrapes facial images
- Verify face databases are not built from untargeted web/CCTV scraping
Was NICHT zu tun ist
- Do NOT scrape facial images from the internet or CCTV without targeted lawful basis
- Do NOT build or expand facial recognition databases through mass collection
Erforderliche Nachweise
Facial data sourcing audit
Frist
2025-02-02
Sanktion
€35M / 7% turnover
Beschreibung
High-risk AI must automatically record events (logs) for traceability: periods of use, input references, outputs, human interventions.
Was zu tun ist
- Design logging from architecture phase
- Log: timestamps, inputs, outputs, human oversight actions, errors
- Integrity protection on logs
- Provide deployer guidance on log access
Was NICHT zu tun ist
- Do NOT deploy high-risk AI without automatic event logging enabled
- Do NOT log only errors — log all events specified by provider
Erforderliche Nachweise
Architecture docs showing logging, sample logs, retention policy, integrity mechanism
Frist
2026-08-02
Beschreibung
Verify no AI system infers emotions of persons in workplace or educational settings (except for medical or safety reasons).
Was zu tun ist
- Identify any emotion recognition AI
- Verify it is NOT used in workplace or education context
- If medical/safety exception claimed, document justification
Was NICHT zu tun ist
- Do NOT use emotion recognition AI in workplace or educational settings
- Do NOT infer employee mood, stress, or engagement via facial/voice analysis (exception: medical/safety)
Erforderliche Nachweise
Emotion recognition context audit
Frist
2025-02-02
Sanktion
€35M / 7% turnover
Beschreibung
Verify no AI system categorizes persons based on biometric data to infer sensitive characteristics (race, political opinions, religion, sexual orientation).
Was zu tun ist
- Check if any AI uses biometric data to infer race, religion, political views, or sexual orientation
- Document absence of such functionality
Was NICHT zu tun ist
- Do NOT use biometric data to categorize individuals by race, religion, political opinion, or sexual orientation
- Do NOT infer sensitive attributes from biometric inputs
Erforderliche Nachweise
Biometric categorization screening
Frist
2025-02-02
Sanktion
€35M / 7% turnover
Beschreibung
Every company that uses or builds AI must train their staff so they understand AI risks and responsible use. Training must be proportionate to role and risk level.
Was zu tun ist
- Conduct skills gap assessment
- Develop role-based AI literacy training
- Document training completion
- Annual refresh cycle
Was NICHT zu tun ist
- Do NOT allow staff to use AI systems without any training
- Do NOT treat AI literacy as a one-time event — it requires annual refresh
- Do NOT apply same training level to all roles — tailor to responsibility
Erforderliche Nachweise
Training records, curriculum, policy document, completion certificates
Frist
2025-02-02
Sanktion
€15M / 3% turnover
Beschreibung
Screen all AI systems against Article 5 prohibited practices. Eight categories of banned AI uses.
Was zu tun ist
- Audit all AI systems against Art. 5 list
- Document screening results
- Establish pre-deployment screening process
Was NICHT zu tun ist
- Do NOT deploy any AI system matching prohibited categories without legal review
- Do NOT assume third-party tools are automatically compliant with Art. 5
Erforderliche Nachweise
AI inventory with Art. 5 screening results per system
Frist
2025-02-02
Sanktion
€35M / 7% turnover (HIGHEST tier)
Beschreibung
Verify no AI system uses subliminal, manipulative, or deceptive techniques to distort behavior beyond a person's consciousness, causing significant harm.
Was zu tun ist
- For each AI system: assess whether it could manipulate user behavior through deceptive patterns, dark patterns, or subliminal techniques
- Document assessment rationale
Was NICHT zu tun ist
- Do NOT use dark patterns, persuasion profiling, or behavioral nudging that bypasses user awareness
- Do NOT deploy recommendation systems that materially distort behavior causing significant harm
Erforderliche Nachweise
Per-system manipulation risk assessment document
Frist
2025-02-02
Sanktion
€35M / 7% turnover
Beschreibung
Verify no AI system exploits vulnerabilities of specific groups (age, disability, social/economic situation) to distort behavior causing significant harm.
Was zu tun ist
- Identify if AI targets vulnerable populations (children, elderly, disabled, economically disadvantaged)
- Assess exploitation risk
- Document findings
Was NICHT zu tun ist
- Do NOT target elderly, disabled, or economically vulnerable users with manipulative AI features
- Do NOT exploit cognitive limitations of specific user groups
Erforderliche Nachweise
Vulnerability exploitation risk assessment per system
Frist
2025-02-02
Sanktion
€35M / 7% turnover
Beschreibung
Verify no AI system evaluates or classifies persons based on social behavior or personal characteristics leading to detrimental treatment unrelated to the original context.
Was zu tun ist
- Check if any AI system scores individuals based on social behavior
- Verify scores are not used to deny services/rights in unrelated contexts
Was NICHT zu tun ist
- Do NOT aggregate personal behavior scores across unrelated contexts
- Do NOT restrict access to services based on AI-scored social behavior
Erforderliche Nachweise
Social scoring screening assessment
Frist
2025-02-02
Sanktion
€35M / 7% turnover
Beschreibung
Verify no AI system assesses criminal risk of individuals based solely on profiling or personality traits (without concrete behavioral facts).
Was zu tun ist
- Check if any AI predicts criminal behavior from personal traits alone
- Ensure law enforcement AI uses objective factual indicators, not profiling
Was NICHT zu tun ist
- Do NOT use AI to predict criminal risk based solely on demographics or personality traits
- Do NOT profile individuals without objective verifiable fact basis
Erforderliche Nachweise
Criminal profiling screening assessment
Frist
2025-02-02
Sanktion
€35M / 7% turnover
Beschreibung
Continuous risk management system throughout the high-risk AI lifecycle covering identification, evaluation, mitigation, and testing of risks.
Was zu tun ist
- Create documented RMS
- Identify and analyze known/foreseeable risks
- Adopt mitigation measures
- Test system
- Review and update regularly
Was NICHT zu tun ist
- Do NOT operate high-risk AI without a documented risk management system
- Do NOT treat risk management as a one-time assessment — it must be continuous
Erforderliche Nachweise
RMS plan, risk register, mitigation log, testing reports
Frist
2026-08-02
Sanktion
€15M / 3% turnover
Beschreibung
Identify and analyze risks to health, safety, and fundamental rights that are known or reasonably foreseeable when the system is used as intended.
Was zu tun ist
- Systematic risk identification workshop
- Document each risk with likelihood and severity
- Consider risks to different user groups including vulnerable persons
Was NICHT zu tun ist
- Do NOT ignore known risks documented by provider or reported by users
- Do NOT omit foreseeable misuse scenarios from risk analysis
Erforderliche Nachweise
Risk register with identified risks, likelihood, severity, affected groups
Frist
2026-08-02
Beschreibung
Estimate and evaluate risks not only from intended use but also from reasonably foreseeable misuse of the high-risk AI system.
Was zu tun ist
- Brainstorm foreseeable misuse scenarios
- Assess risks from each misuse scenario
- Document evaluation and residual risk
Was NICHT zu tun ist
- Do NOT assume users will only use the system as intended
- Do NOT skip misuse scenario testing
Erforderliche Nachweise
Misuse risk assessment document, residual risk acceptance rationale
Frist
2026-08-02
Beschreibung
Test the high-risk AI system to identify appropriate risk management measures. Testing must be against defined metrics prior to market placement.
Was zu tun ist
- Define test plan with metrics
- Execute tests including real-world conditions where appropriate (Art. 60)
- Document test results against acceptance criteria
- Test prior to market AND throughout lifecycle
Was NICHT zu tun ist
- Do NOT place high-risk AI on market without testing against defined metrics
- Do NOT use production data for testing without proper safeguards
Erforderliche Nachweise
Test plan, test results, acceptance criteria, test logs signed by responsible person
Frist
2026-08-02
Beschreibung
Training, validation, and testing datasets must meet quality criteria: relevant, representative, free of errors, complete. Bias detection required.
Was zu tun ist
- Implement data governance practices
- Document data sources
- Assess for bias
- Address special category data under GDPR
Was NICHT zu tun ist
- Do NOT train AI on biased, incomplete, or unrepresentative datasets
- Do NOT skip data quality assessment before training
Erforderliche Nachweise
Data governance policy, data quality reports, bias analysis, GDPR documentation
Frist
2026-08-02
Beschreibung
Examine training data specifically for possible biases that could lead to discrimination, especially regarding protected characteristics.
Was zu tun ist
- Run statistical bias analysis on training data
- Test for representation gaps across gender, age, ethnicity, disability
- Implement bias mitigation (resampling, reweighting, debiasing)
- Document findings and actions
Was NICHT zu tun ist
- Do NOT deploy AI systems without bias testing across protected characteristics
- Do NOT ignore disparate impact in model outputs
Erforderliche Nachweise
Bias analysis report, mitigation actions log, before/after fairness metrics
Frist
2026-08-02
Beschreibung
Document all data collection, labeling, storage, and processing choices. Include data source descriptions and representativeness rationale.
Was zu tun ist
- Create data sheet / data card for each training dataset
- Document collection methodology, labeling process, storage, and preprocessing
- Assess and document representativeness
Was NICHT zu tun ist
- Do NOT use training data without documenting provenance and processing steps
- Do NOT omit data source limitations from documentation
Erforderliche Nachweise
Data sheets/data cards, data processing records, representativeness assessment
Frist
2026-08-02
Beschreibung
Keep documented records of who was trained, when, on what topics, and their assessment results. Records must be available for auditors.
Was zu tun ist
- Create training register with: employee name, role, training date, topics, score
- Store records securely for audit
- Update when new staff join or roles change
Was NICHT zu tun ist
- Do NOT destroy or fail to maintain training completion records
- Do NOT accept unverified self-attestation as training evidence
Erforderliche Nachweise
Training register (spreadsheet or system), individual completion records
Frist
2025-02-02
Sanktion
€15M / 3% turnover
Drei Stufen der Durchsetzung
Der höhere Betrag gilt — Festbetrag oder Prozentsatz des weltweiten Jahresumsatzes.
Begriffe, die zählen
Kennen Sie Ihre Pflichten. Handeln Sie jetzt.
Führen Sie in 30 Sekunden eine kostenlose Compliance-Prüfung Ihrer KI-Tools durch.
$ npx complior