AI Act compliance: which evidence to build, and who produces it

Who is in scope?

The regulation does not sort companies by size or sector, but by use.

• Every size. There is no exemption for SMEs. They get lighter requirements, such as simplified documentation and lower fine ceilings, not a waiver.
• Beyond the EU. The regulation applies to deployers established in the Union, and to providers and deployers established elsewhere as soon as the output of the system is used in the Union (Article 2). A Swiss, Mauritian or US company that recruits, assesses or serves people in the Union is in scope.
• Every sector. High risk is defined by use (Annex III): biometrics, critical infrastructure, education, employment and worker management, access to essential services (credit, health and life insurance, public benefits), law enforcement, migration, justice. A hotel chain that screens applicants with AI is in scope just like a bank. On top of that comes AI built into products that are already regulated (Annex I), such as machinery or medical devices.
• Out of scope. Purely personal use, defence and national security, research carried out for its own sake.

The vendor's compliance is not yours

The regulation separates the provider, who develops an AI system and places it on the market under its own name, from the deployer, who uses it under its own authority (Article 3). The vendor documents its product. You answer for how you use it. One party's evidence does not cover the other's obligations.

This page is about evidence. The obligations themselves, platform by platform, are covered in our guide EU AI Act: what companies using Copilot, Agentforce or Joule must do now.

The information required by Article 50 must be given at the latest at the first interaction or exposure. Bodies governed by public law, private entities providing public services and certain other deployers must also carry out a fundamental rights impact assessment before deploying a high-risk system (Article 27).

A company that puts an agent into service under its own name may also be a provider. It then answers for Article 50(1): people must know they are dealing with an AI.

What makes evidence hold up

Evidence is judged by how it holds up over time. For an inspector to accept it, it must be:

• dated: what was true, and on what date;
• attributed: who established it, by name;
• intact: nothing can alter it without it showing;
• attached: to a system in the AI register and to the article it documents;
• bounded: its scope is stated, including what it does not cover.

Screenshots in a shared folder meet none of these conditions.

Who produces which evidence

In the Cockpit, every piece of evidence carries a recording date and its author. The monthly flight report is frozen when published and sealed with a fingerprint a third party can check.

What 56North does not do

We do not issue certifications. We prepare an evidence file ready for an inspection, covering the obligations of a company that deploys AI systems, in particular Articles 26 and 50. We never call it a certification.

What missing evidence costs

Breaches of deployer obligations (Article 26) and transparency obligations (Article 50) carry fines of up to €15M or 3% of worldwide annual turnover, whichever is higher, and whichever is lower for SMEs. For prohibited practices, the ceiling is €35M or 7% (Article 99). To see these deadlines in context, read AI governance.