Article 16 places extensive obligations on providers of high-risk AI systems, including quality management, technical documentation, conformity assessment, and post-market monitoring. As a business user, you should ask your AI vendors whether they comply with these requirements.
Article 16: What AI Providers Must Do — And What to Ask Your Vendors
What AI Providers Must Do
Article 16 is primarily about the companies that build and sell AI systems, not the businesses that use them. Providers of high-risk AI must ensure their systems comply with all the technical requirements in the EU AI Act — including risk management, data governance, transparency, accuracy, and human oversight capabilities.
They must also implement a quality management system, create and maintain technical documentation, keep logs generated by their AI system, undergo conformity assessment before putting their system on the market, register their system in the EU database, and set up post-market monitoring to track how their system performs in the real world.
Why This Matters to You as a User
Even though these obligations fall on your AI vendor, not on you, they directly affect your business. If your vendor isn't complying with Article 16, you could be using a non-compliant AI system — which creates risk for your own business. You have a responsibility as a deployer to do reasonable due diligence on the AI tools you use.
Think of it like buying food for your restaurant. The food safety regulations primarily apply to the supplier, but if you knowingly buy from a supplier that doesn't meet health standards, you're also at risk.
Questions to Ask Your AI Vendor
When evaluating AI tools, ask vendors these questions: Have you completed a conformity assessment for this system? Can you provide technical documentation? What quality management system do you have in place? How do you monitor the system's performance after deployment? What's your process for handling incidents or malfunctions? How do you handle data governance and bias testing?
A good vendor will have clear answers to these questions. Vague or evasive responses should be a warning sign.
What to Do With the Answers
Document your vendor due diligence. Keep records of the questions you asked and the answers you received. If a vendor can't demonstrate compliance with Article 16, consider this a risk factor in your decision to use their product. You don't need to audit your vendor's internal processes, but you should make reasonable efforts to verify that they take their obligations seriously.
Check your AI compliance readiness — free.
Take the Readiness Check 3 minutes · 10 questions · no signup requiredThis article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.