Platform / Obligations and evidence
Turn an approved position into owned, evidenced work.
The regulation becomes operational only when each applicable requirement has an owner, a due date, an expected form of evidence and a decision about whether that evidence is adequate.
Product demonstration · 1 minute 59 seconds
Manage the AI lifecycle
Follow a hypothetical AI system through inventory, exposure, role, classification, ownership, obligations, evidence and controlled lifecycle decisions. All organisations, people and systems shown were created for demonstration, and no client data appears.
Read the video transcript
An AI system should not move from an idea into live use simply because a team feels ready. EU AI Fit turns that journey into a controlled, reviewable process. The portfolio shows every recorded system, lifecycle stage, accountable owner, exposure position and reviewed classification.
Inside each system record, responsibility becomes active only when the nominated owner accepts it. Before progress, the workflow checks foundations such as approved role and classification, a current exposure check, an obligation and evidence plan and operational risk review.
A lifecycle change records the request, evidence, reviewer, decision and rationale. Production is not the end: controls, indicators, incidents and material changes can trigger reassessment. The result is an operating trail from discovery and pilot through production, suspension or retirement.
Why this matters
A policy folder cannot show whether a requirement is operating for this system.
Evidence needs to be relevant, attributable, approved and current. A generic policy may support one part of a control but say nothing about the model version, test result, human-oversight arrangement or release being assessed.
EU AI Fit connects obligations to expected evidence, owners and review decisions while preserving the distinction between a stored item and evidence accepted as adequate.
Who it is for
The people who turn a requirement into an operating control.
- Compliance leads coordinating implementation
- System and control owners providing evidence
- Reviewers deciding adequacy and currency
- Customers using their own infrastructure for source files
How the work moves
Move from an applicable duty to accepted evidence.
- 01
Generate the applicable plan
Use the approved role, classification, use context and current rule set to propose relevant obligations.
- 02
Define useful evidence
Explain what a reviewer would expect to see and why, with guiding principles rather than a filename alone.
- 03
Assign and collect
Give the work to an accepted owner and link managed files or references held in customer-controlled infrastructure.
- 04
Review and maintain
Record adequacy, limitations, approval, expiry and replacement while retaining the audit trail.
In this scenario
Showing that human oversight exists
A system owner uploads a general responsible-AI policy against a human-oversight obligation.
The evidence guidance asks for system instructions, named competent overseers, authority to intervene, training or briefing records and evidence that the control is monitored.
The reviewer can accept the policy as supporting context while marking the system-specific evidence incomplete and opening targeted actions.
The organisation avoids calling a document ‘complete evidence’ simply because it has been uploaded.
What is retained
An obligation record that shows what exists and what is still missing.
An evidence-plan review helps the team define adequacy before collecting files and links.
- Applicable obligation register
- Evidence expectations and guiding principles
- Accepted owner and target date
- Managed object or customer-controlled reference
- Review decision, limitations, version and expiry
Source basis
The official material behind the workflow.
Source review updated 31 August 2026. Read our editorial and regulatory review policy, check the current source and obtain qualified advice for your circumstances.
- Regulation (EU) 2024/1689
The official consolidated legal text, including the 2026 amendments, and starting point for every assessment.
- Provider obligations — Article 16
Official duties for providers of high-risk AI systems.
- Deployer obligations — Article 26
Official operational, oversight, monitoring and record-keeping duties for deployers.
Next step
Make every requirement actionable and reviewable.
Build an evidence plan that explains what good looks like, who owns it and what remains unresolved.
Discuss your evidence plan