Regulations
The EU AI Act makes you show the figure and the log behind an AI output. Eight of its articles turn on records anyone can re-run. Article 50 has applied since 2 August 2026, and Article 99 prices a failure at up to €15 million or 3% of worldwide turnover (Regulation 2024/1689).
Eight EU AI Act articles turn on records anyone can re‑run. Art. 50 applied 2 August 2026. Art. 99 prices a failure at €15M or 3%.
The verifier re-derives the figure or log each article turns on. Open any one for where the line sits.
Art. 9Risk‑management systemre-derivable
Re-runs the validation metric that Art. 9(6) has you test against a fixed threshold, so an auditor recomputes the result instead of trusting it. Pilot: iso42001_vnv. It does not run the risk process itself.
Art. 10Data and data governancere-derivable
Recomputes the declared data-quality figures (completeness, duplicate rate, class balance) and the four-fifths disparate-impact ratio from your own dataset. It does not judge whether the data is fit.
Art. 11Technical documentationre-derivable
Annex IV point 2(g) puts the accuracy, robustness and discriminatory-impact metrics inside the file. Each one recomputes from the declared data. The documentation itself is still yours to write.
Art. 12Automatic logging capabilityAutomatic loggingre-derivable
Recomputes the log's hash-chain head, so any edit, reorder or deletion is caught. Your system still generates the log.
Art. 14Human oversightre-derivable
Ships a pinned oversight control that re-runs on the verifier's side against a hash-pinned registry and rejects any divergence, and recomputes the disclosed oversight rate.
Art. 15Accuracy, robustness and cybersecurityAccuracy and robustnessre-derivable
Art. 15(3) makes you declare the accuracy metric. It recomputes from the declared test set. Cybersecurity under 15(5) stays with you.
Art. 19Provider keeps the logs, six months or moreProvider keeps the logsre-derivable
Recomputes the head of the retained log, so a kept log can be shown untampered. Capturing it and holding it six months is yours.
Art. 26(6)Deployer keeps the logs, six months or moreDeployer keeps the logsre-derivable
The same log re-derivation on the deployer's side.
Art. 13, 18, 43, 49, 72, not re-derivableArt. 13, 18, 43, 49, 72not re-derivable
Each turns on a filing, a procedure or a duration, not a figure or log to recompute. Art. 13, instructions for use you write. Art. 18, a documentation-keeping period. Art. 43, a conformity-assessment procedure. Art. 49, a registration filing. Art. 72, an ongoing post-market monitoring plan.
The published clock.
Art. 50 transparency applied on 2 August 2026. Three dates are still ahead.
Three dates still ahead.
The full timelineFull timeline
The eight high-risk areas · Annex IIIAnnex III areas
What a breach costs · penaltiesPenalties
Of global annual turnover, whichever is higher. For small firms and start-ups, Art. 99(6) inverts it: whichever is lower.
The Digital Omnibus, adopted 29 June 2026, moved high-risk to the dates above. Transparency did not move. Dates follow the Digital Omnibus, adopted 29 June 2026. Regulation (EU) 2024/1689 ↗
The whole field, on one clock.
The re-derivable column marks each instrument that carries a re-derivable record, log or documentation duty. A re-run shows the number matches its declared inputs and rules. It does not make the rule right. Hover any mark for where the line sits. Tap any mark for where the line sits.
Dates show the next duty for instruments still phasing in, the date of effect for those in force, and the last legislative step for bills. Sources checked 9 July 2026.
The first date has already passed.
Re-derivable evidence for the record-keeping duty each article names.
Re-derivable evidence, article by article.