From f7fd601e528f950d33148531a18e8a2ae948194c Mon Sep 17 00:00:00 2001 From: Ioana Valea Date: Thu, 10 Sep 2026 15:44:22 +0300 Subject: [PATCH 1/4] docs(verification): add Article 12 and correct the Article 111(2) attribution Article 12 requires that a high-risk system technically allow the automatic recording of events over its lifetime, and imposes no verification depth, so it belongs beside Article 11 and Annex IV in the informative section. Suggested by @lywinged in review of #310. The list of provisions sitting in Sections 2 and 3 of Chapter III is extended to match. The Article 111(2) sentence presented recital 39 as operative text. Article 1 point (39)(a) of Regulation (EU) 2026/1744 replaces Article 111(2), and the replacement carries the significant-changes test and a 2 August 2030 compliance date for providers and deployers of high-risk systems intended to be used by public authorities. The type-and-model reading is recital 39. Documentation only. No normative delta, no schema change, no conformance test IDs. Signed-off-by: Ioana Valea --- docs/verification.md | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/docs/verification.md b/docs/verification.md index 7ec8998f..f099ef73 100644 --- a/docs/verification.md +++ b/docs/verification.md @@ -167,8 +167,11 @@ them, and neither is a floor that is met. elements Article 11(1) requires the technical documentation to contain at a minimum. It is not a classification annex, since high-risk classification runs through Article 6 with Annexes I and III, and neither Article 11 nor Annex IV imposes a verification obligation of -the kind `provenance_depth_verified` records. Two adjacent provisions are sometimes read as -supplying one, and neither does. Article 25(4), as amended by Regulation (EU) 2026/1744, +the kind `provenance_depth_verified` records. Article 12 does not impose one either, since it +requires that a high-risk system technically allow the automatic recording of events over its +lifetime, which is a capability requirement about logging rather than a statement about +provenance or build inputs. Two adjacent provisions are sometimes read as supplying one, and +neither does. Article 25(4), as amended by Regulation (EU) 2026/1744, requires the provider of a high-risk AI system and a third party supplying an AI system, AI model, tools, services, components or processes used or integrated in it to specify by written agreement the information, capabilities, technical access and other assistance the @@ -177,11 +180,15 @@ components other than general-purpose AI models publicly available under a free open-source licence. Article 15(5) requires technical solutions addressing, where appropriate, data poisoning, model poisoning, adversarial examples, confidentiality attacks and model flaws, which is stated as an outcome rather than as a depth of supply-chain -verification. Articles 11, 15 and 25 sit in Sections 2 and 3 of Chapter III, whose +verification. Articles 11, 12, 15 and 25 sit in Sections 2 and 3 of Chapter III, whose application Regulation (EU) 2026/1744 moved to 2 December 2027 for systems high-risk under Article 6(2) and Annex III, and to 2 August 2028 for systems high-risk under Article 6(1) -and Annex I, subject to the Article 111(2) grace period for units of a type and model -already placed on the market. +and Annex I. Article 111(2), as replaced by the same Regulation, applies the AI Act to +operators of high-risk systems placed on the market before that date of application only +where those systems are subject to significant changes in their designs, and requires +providers and deployers of high-risk systems intended to be used by public authorities to +comply by 2 August 2030. The reading that one lawfully placed unit carries the other units of +the same type and model is recital 39 rather than operative text. **Regulation (EU) 2024/2847.** Annex I Part II point 1 requires manufacturers to identify and document vulnerabilities and components, including by drawing up a software bill of From bfdc1babb9959a2a688d8ca59372695a3bc55e45 Mon Sep 17 00:00:00 2001 From: Ioana Valea Date: Fri, 11 Sep 2026 10:36:47 +0300 Subject: [PATCH 2/4] docs(verification): complete the Article 111(2) paraphrase The paraphrase of the replaced Article 111(2) dropped four clauses of the provision it reports. Article 1 point (39)(a) of Regulation (EU) 2026/1744 replaces Article 111(2) with text applying the Regulation to operators of high-risk AI systems, other than the systems referred to in paragraph 1 of that Article, that have been placed on the market or put into service before the date of application of Chapter III referred to in Article 113, only if, as from that date, those systems are subject to significant changes in their designs, and providing that in any case the providers and deployers of high-risk AI systems intended to be used by public authorities comply by 2 August 2030. The paragraph now carries the put-into-service limb and the Article 111(1) exclusion, both raised by @lywinged in review, together with the temporal anchor on the significant-changes test and the unconditional force of the 2030 date. Article 111 of Regulation (EU) 2024/1689 and Article 1 point (39) of Regulation (EU) 2026/1744 were read against the Official Journal text. Point (39) replaces paragraph 2 and adds a paragraph 4, so paragraph 1 stands as enacted, and the excluded population is AI systems which are components of the large-scale IT systems established by the legal acts listed in Annex X. Documentation only. No normative delta, no schema change, no conformance test IDs. Signed-off-by: Ioana Valea --- docs/verification.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/docs/verification.md b/docs/verification.md index f099ef73..49c39209 100644 --- a/docs/verification.md +++ b/docs/verification.md @@ -184,11 +184,12 @@ verification. Articles 11, 12, 15 and 25 sit in Sections 2 and 3 of Chapter III, application Regulation (EU) 2026/1744 moved to 2 December 2027 for systems high-risk under Article 6(2) and Annex III, and to 2 August 2028 for systems high-risk under Article 6(1) and Annex I. Article 111(2), as replaced by the same Regulation, applies the AI Act to -operators of high-risk systems placed on the market before that date of application only -where those systems are subject to significant changes in their designs, and requires -providers and deployers of high-risk systems intended to be used by public authorities to -comply by 2 August 2030. The reading that one lawfully placed unit carries the other units of -the same type and model is recital 39 rather than operative text. +operators of high-risk systems, other than the systems referred to in Article 111(1), that +have been placed on the market or put into service before that date of application, only +where, as from that date, those systems are subject to significant changes in their designs, +and in any case requires providers and deployers of high-risk systems intended to be used by +public authorities to comply by 2 August 2030. The reading that one lawfully placed unit +carries the other units of the same type and model is recital 39 rather than operative text. **Regulation (EU) 2024/2847.** Annex I Part II point 1 requires manufacturers to identify and document vulnerabilities and components, including by drawing up a software bill of From 2ebe59262280f972afd6b00eba6e9df720757011 Mon Sep 17 00:00:00 2001 From: Ioana Valea Date: Fri, 11 Sep 2026 21:00:02 +0300 Subject: [PATCH 3/4] docs(verification): name the instrument for the type-and-model reading The sentence cited "recital 39" without naming an instrument, and a reader lands on Regulation (EU) 2024/1689 by default, whose recital 39 concerns the processing of biometric data for biometric identification and its relationship to Article 10 of Directive (EU) 2016/680 and Article 9(1) of Regulation (EU) 2016/679. Raised by @imran-siddique in review. The reading belongs to recital 39 of Regulation (EU) 2026/1744, which provides that if at least one individual unit of the high-risk AI system has been lawfully placed on the market or put into service before the date specified in Article 111(2), other individual units of the same type and model are subject to the grace period provided in that Article. The phrase "type and model" occurs three times in Regulation (EU) 2026/1744, all three inside that recital, and nowhere in Regulation (EU) 2024/1689. The same sentence said "one lawfully placed unit" where the recital says placed on the market or put into service, so that limb is restored here too. Both recitals were read against the Official Journal text. Documentation only. No normative delta, no schema change, no conformance test IDs. Signed-off-by: Ioana Valea --- docs/verification.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/verification.md b/docs/verification.md index 49c39209..31fead09 100644 --- a/docs/verification.md +++ b/docs/verification.md @@ -188,8 +188,9 @@ operators of high-risk systems, other than the systems referred to in Article 11 have been placed on the market or put into service before that date of application, only where, as from that date, those systems are subject to significant changes in their designs, and in any case requires providers and deployers of high-risk systems intended to be used by -public authorities to comply by 2 August 2030. The reading that one lawfully placed unit -carries the other units of the same type and model is recital 39 rather than operative text. +public authorities to comply by 2 August 2030. The reading that one unit lawfully placed on +the market or put into service carries the other units of the same type and model is recital +39 of Regulation (EU) 2026/1744 rather than operative text. **Regulation (EU) 2024/2847.** Annex I Part II point 1 requires manufacturers to identify and document vulnerabilities and components, including by drawing up a software bill of From eb2a5b3228dda9e0929d3f8aa874e712fa6ca784 Mon Sep 17 00:00:00 2001 From: Ioana Valea Date: Sat, 12 Sep 2026 01:34:26 +0300 Subject: [PATCH 4/4] docs(verification): carry the necessary-steps limb and match only if Article 111(2) as replaced requires the providers and deployers concerned to "take the necessary steps to comply with the requirements and obligations laid down in this Regulation by 2 August 2030". The paragraph had them comply by that date, which states an outcome where the provision states a duty to act. Raised by @lywinged, who noted the short form survived his own approval of f7fd601 and his review above. "only where" becomes "only if", which is the word both Article 111(2) as enacted and its replacement use. Article 1 point (39)(a) of Regulation (EU) 2026/1744 was read against the Official Journal text. Documentation only. No normative delta, no schema change, no conformance test IDs. Signed-off-by: Ioana Valea --- docs/verification.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/verification.md b/docs/verification.md index 31fead09..ab91a668 100644 --- a/docs/verification.md +++ b/docs/verification.md @@ -185,12 +185,12 @@ application Regulation (EU) 2026/1744 moved to 2 December 2027 for systems high- Article 6(2) and Annex III, and to 2 August 2028 for systems high-risk under Article 6(1) and Annex I. Article 111(2), as replaced by the same Regulation, applies the AI Act to operators of high-risk systems, other than the systems referred to in Article 111(1), that -have been placed on the market or put into service before that date of application, only -where, as from that date, those systems are subject to significant changes in their designs, -and in any case requires providers and deployers of high-risk systems intended to be used by -public authorities to comply by 2 August 2030. The reading that one unit lawfully placed on -the market or put into service carries the other units of the same type and model is recital -39 of Regulation (EU) 2026/1744 rather than operative text. +have been placed on the market or put into service before that date of application, only if, +as from that date, those systems are subject to significant changes in their designs, and in +any case requires providers and deployers of high-risk systems intended to be used by public +authorities to take the necessary steps to comply by 2 August 2030. The reading that one unit +lawfully placed on the market or put into service carries the other units of the same type +and model is recital 39 of Regulation (EU) 2026/1744 rather than operative text. **Regulation (EU) 2024/2847.** Annex I Part II point 1 requires manufacturers to identify and document vulnerabilities and components, including by drawing up a software bill of