AI Act Obligations for the AI Office

Source text: “The AI Office shall develop a template for a questionnaire, including through an automated tool, to facilitate deployers in complying with their obligations under this Article in a simplified manner.”

In practice: Monitor the AI Office's publication of the official FRIA questionnaire template and automated tool, and integrate it into your compliance management system once available to ensure standardised and efficient assessments.

GDPR Art. 35(1): “Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks.”

GDPR Art. 35(2): “The controller shall seek the advice of the data protection officer, where designated, when carrying out a data protection impact assessment.”

GDPR Art. 35(3): “A data protection impact assessment referred to in paragraph 1 shall in particular be required in the case of:”

GDPR Art. 35(4): “The supervisory authority shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1. The supervisory authority shall communicate those lists to the Board referred to in Article 68.”

GDPR Art. 35(5): “The supervisory authority may also establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. The supervisory authority shall communicate those lists to the Board.”

GDPR Art. 35(6): “Prior to the adoption of the lists referred to in paragraphs 4 and 5, the competent supervisory authority shall apply the consistency mechanism referred to in Article 63 where such lists involve processing activities which are related to the offering of goods or services to data subjects or to the monitoring of their behaviour in several Member States, or may substantially affect the free movement of personal data within the Union.”

GDPR Art. 35(7): “The assessment shall contain at least:”

GDPR Art. 35(8): “Compliance with approved codes of conduct referred to in Article 40 by the relevant controllers or processors shall be taken into due account in assessing the impact of the processing operations performed by such controllers or processors, in particular for the purposes of a data protection impact assessment.”

GDPR Art. 35(9): “Where appropriate, the controller shall seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of processing operations.”

GDPR Art. 35(10): “Where processing pursuant to point (c) or (e) of Article 6(1) has a legal basis in Union law or in the law of the Member State to which the controller is subject, that law regulates the specific processing operation or set of operations in question, and a data protection impact assessment has already been carried out as part of a general impact assessment in the context of the adoption of that legal basis, paragraphs 1 to 7 shall not apply unless Member States deem it to be necessary to carry out such an assessment prior to processing activities.”

GDPR Art. 35(11): “Where necessary, the controller shall carry out a review to assess if processing is performed in accordance with the data protection impact assessment at least when there is a change of the risk represented by processing operations.”

Source text: “The AI Office shall encourage and facilitate the drawing up of codes of practice at Union level to facilitate the effective implementation of the obligations regarding the detection and labelling of artificially generated or manipulated content. The Commission may adopt implementing acts to approve those codes of practice in accordance with the procedure laid down in Article 56 (6). If it deems the code is not adequate, the Commission may adopt an implementing act specifying common rules for the implementation of those obligations in accordance with the examination procedure laid down in Article 98(2).”

In practice: Providers and deployers of AI systems generating or manipulating content should actively participate in the AI Office-led code of practice process and monitor Commission implementing acts, as approved codes or common rules will define the practical compliance standard for detection and labelling obligations.

Source text: “Any information or documentation obtained pursuant to this Article, including trade secrets, shall be treated in accordance with the confidentiality obligations set out in Article 78.”

In practice: Implement information classification and handling procedures that align with Article 78 confidentiality requirements. Ensure that any information shared with or received from the AI Office or national competent authorities under Article 55 is subject to strict access controls, non-disclosure agreements, and secure storage protocols. Train staff on trade secret protection obligations.

Source text: “The AI Office shall encourage and facilitate the drawing up of codes of practice at Union level in order to contribute to the proper application of this Regulation, taking into account international approaches.”

In practice: Providers of general-purpose AI models should proactively engage with the AI Office's code of practice development process to shape practical compliance standards and demonstrate early commitment to responsible AI governance.

Source text: “The AI Office and the Board shall aim to ensure that the codes of practice cover at least the obligations provided for in Articles 53 and 55, including the following issues:”

In practice: Providers of general-purpose AI models should prepare documentation covering training data summaries and systemic risk identification processes in anticipation of code of practice requirements, aligning with Articles 53 and 55 obligations.

Source text: “The AI Office and the Board shall aim to ensure that the codes of practice clearly set out their specific objectives and contain commitments or measures, including key performance indicators as appropriate, to ensure the achievement of those objectives, and that they take due account of the needs and interests of all interested parties, including affected persons, at Union level.”

In practice: When participating in or implementing codes of practice, organisations should ensure their internal governance frameworks map to the specific objectives and KPIs defined in the codes, and document how affected persons' interests have been considered.

Source text: “The AI Office shall aim to ensure that participants to the codes of practice report regularly to the AI Office on the implementation of the commitments and the measures taken and their outcomes, including as measured against the key performance indicators as appropriate. Key performance indicators and reporting commitments shall reflect differences in size and capacity between various participants.”

In practice: Organisations participating in codes of practice should establish internal reporting mechanisms to track KPI performance and commitment implementation, ensuring reports are proportionate to their size and capacity and submitted to the AI Office on a regular basis.

Source text: “The AI Office and the Board shall regularly monitor and evaluate the achievement of the objectives of the codes of practice by the participants and their contribution to the proper application of this Regulation. The AI Office and the Board shall assess whether the codes of practice cover the obligations provided for in Articles 53 and 55, and shall regularly monitor and evaluate the achievement of their objectives. They shall publish their assessment of the adequacy of the codes of practice. The Commission may, by way of an implementing act, approve a code of practice and give it a general validity within the Union. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 98(2).”

In practice: Providers participating in codes of practice should track AI Office and Board assessments of adequacy and be prepared to adapt their compliance frameworks if the Commission elevates a code of practice to general validity via implementing act.

Source text: “The AI Office shall, as appropriate, also encourage and facilitate the review and adaptation of the codes of practice, in particular in light of emerging standards. The AI Office shall assist in the assessment of available standards.”

In practice: Compliance teams should monitor AI Office publications on standards assessments and code of practice revisions to ensure their internal policies remain aligned with the latest applicable standards and updated codes.

Source text: “Codes of practice shall be ready at the latest by 2 May 2025. The AI Office shall take the necessary steps, including inviting providers pursuant to paragraph 7. If, by 2 August 2025, a code of practice cannot be finalised, or if the AI Office deems it is not adequate following its assessment under paragraph 6 of this Article, the Commission may provide, by means of implementing acts, common rules for the implementation of the obligations provided for in Articles 53 and 55, including the issues set out in paragraph 2 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 98(2).”

In practice: Providers should actively participate in the code of practice development process before 2 May 2025 to influence the outcome; if implementing acts are adopted instead, providers must be ready to comply with those common rules by 2 August 2025.

Source text: “National competent authorities shall inform the AI Office and the Board of the establishment of a sandbox, and may ask them for support and guidance. The AI Office shall make publicly available a list of planned and existing sandboxes and keep it up to date in order to encourage more interaction in the AI regulatory sandboxes and cross-border cooperation.”

In practice: National competent authorities should establish a formal notification procedure for sandbox establishment that includes submission to the AI Office and the Board, and should monitor the AI Office's public sandbox list to identify opportunities for cross-border collaboration and alignment with other Member States' sandbox activities.

Source text: “The AI Office shall undertake the following actions:”

In practice: The AI Office should coordinate with the Board to prioritise template development for the most complex compliance areas (e.g., conformity assessment documentation, risk management), and ensure the information platform is accessible, multilingual, and machine-readable to serve diverse operators across the EU.

Source text: “The scientific panel shall advise and support the AI Office, in particular with regard to the following tasks:”

In practice: Providers of general-purpose AI models should be aware that the scientific panel may be called upon to assist market surveillance authorities investigating their systems; maintain comprehensive technical documentation to facilitate such reviews.

Source text: “The experts on the scientific panel shall perform their tasks with impartiality and objectivity, and shall ensure the confidentiality of information and data obtained in carrying out their tasks and activities. They shall neither seek nor take instructions from anyone when exercising their tasks under paragraph 3. Each expert shall draw up a declaration of interests, which shall be made publicly available. The AI Office shall establish systems and procedures to actively manage and prevent potential conflicts of interest.”

In practice: The AI Office should implement a formal conflict-of-interest management framework including a public register of declarations of interests, periodic reviews, and recusal procedures for panel members with relevant financial or organisational ties.

Source text: “The implementing act referred to in paragraph 1 shall include provisions on the conditions, procedures and detailed arrangements for the scientific panel and its members to issue alerts, and to request the assistance of the AI Office for the performance of the tasks of the scientific panel.”

In practice: When the implementing act is published, compliance teams should map the alert and assistance request procedures to internal escalation workflows, ensuring that any interaction with the scientific panel or AI Office is properly documented and tracked.

Source text: “Market surveillance authorities and the Commission shall be able to propose joint activities, including joint investigations, to be conducted by either market surveillance authorities or market surveillance authorities jointly with the Commission, that have the aim of promoting compliance, identifying non-compliance, raising awareness or providing guidance in relation to this Regulation with respect to specific categories of high-risk AI systems that are found to present a serious risk across two or more Member States in accordance with Article 9 of Regulation (EU) 2019/1020. The AI Office shall provide coordination support for joint investigations.”

In practice: Organisations operating high-risk AI systems across multiple Member States should maintain up-to-date documentation and be prepared for coordinated cross-border investigations; designate a single compliance contact point to liaise with multiple national authorities.

Source text: “Where an AI system is based on a general-purpose AI model, and the model and the system are developed by the same provider, the AI Office shall have powers to monitor and supervise compliance of that AI system with obligations under this Regulation. To carry out its monitoring and supervision tasks, the AI Office shall have all the powers of a market surveillance authority provided for in this Section and Regulation (EU) 2019/1020.”

In practice: Providers who develop both the general-purpose AI model and the AI system built on it should treat the AI Office as their primary supervisory counterpart and ensure all documentation, technical records, and compliance evidence are readily accessible to the AI Office upon request.

Source text: “Where a market surveillance authority is unable to conclude its investigation of the high-risk AI system because of its inability to access certain information related to the general-purpose AI model despite having made all appropriate efforts to obtain that information, it may submit a reasoned request to the AI Office, by which access to that information shall be enforced. In that case, the AI Office shall supply to the applicant authority without delay, and in any event within 30 days, any information that the AI Office considers to be relevant in order to establish whether a high-risk AI system is non-compliant. Market surveillance authorities shall safeguard the confidentiality of the information that they obtain in accordance with Article 78 of this Regulation. The procedure provided for in Chapter VI of Regulation (EU) 2019/1020 shall apply mutatis mutandis.”

In practice: Market surveillance authorities should document all efforts made to obtain information before submitting a reasoned request to the AI Office, and implement confidentiality protocols aligned with Article 78 of the AI Act to handle any information received from the AI Office.