A Fortune 500 HR Buyer Just Asked for Your Full Article 16 Provider Obligations Checklist: How to Answer Each Line Item
A procurement manager at a European bank sent your team a vendor questionnaire last week. Section 4 is titled "EU AI Act Provider Compliance" and the first question reads: "Please confirm compliance with each obligation listed in Article 16 of the EU AI Act."
You open Article 16. It's a list. Nine items. Each one pointing to a different section of the regulation.
This post breaks down every item on that list, explains what it actually means in practice, and shows you exactly how to answer when an enterprise customer asks.
What Article 16 Actually Is
Article 16 is the master checklist of obligations that apply to providers of high-risk AI systems under the EU AI Act. If your AI product is classified as high-risk under Annex III — which includes most AI tools used in hiring, performance management, payroll allocation, or employee assessment — Article 16 is the list your customer's legal and procurement teams will work through.
The nine obligations are:
- Implement a quality management system (Article 17)
- Establish technical documentation (Article 11 and Annex IV)
- Keep logs automatically generated by the system (Article 12)
- Ensure conformity before market placement (Article 43)
- Affix CE marking (Article 48)
- Register in the EU database (Article 49)
- Take corrective action if the system is not in conformity (Article 20)
- Inform authorities of serious incidents (Article 73)
- Draw up an EU declaration of conformity (Article 47)
When your customer asks "do you comply with Article 16," they are asking whether you have done all nine of these things.
How to Answer Each Item
Quality management system (Article 17): Your QMS is the documented process for how you manage AI risk, data quality, change control, and incident response. If you have a formal QMS, name it and confirm it covers your AI product. If you don't have a formal QMS, describe the equivalent: risk reviews, documented testing protocols, version-controlled change logs.
Technical documentation (Article 11 / Annex IV): This is the system card for your product. It covers intended purpose, architecture, training data description, risk management methodology, performance metrics, and human oversight design. Complizo generates a ready-to-send evidence pack that covers these requirements — answer the question by providing the pack or listing the documents you maintain.
Automatic logging (Article 12): Your system must generate logs of its own operation automatically, to the extent technically feasible. Describe what your system logs: inputs, outputs, confidence scores, human review decisions, error events. Note how long logs are retained and who has access.
Conformity assessment (Article 43): Most Annex III high-risk AI systems require a conformity assessment. The default path is a self-assessment against the harmonised standards. Describe the assessment you conducted, the standards or frameworks you applied (ISO 42001, CEN/CENELEC drafts), and the outcome.
CE marking (Article 48): CE marking confirms conformity with applicable EU law. It applies when you are placing a high-risk AI system on the EU market. Confirm whether you have affixed CE marking and the basis for it.
EU database registration (Article 49): High-risk AI systems must be registered in the EU database for high-risk AI systems at ai-office.ec.europa.eu before market placement. Provide your registration number or explain your timeline if you are in the registration process.
Corrective action (Article 20): Describe your process for taking corrective action when you identify that your system is not performing as intended or has caused a serious incident. Who decides? What is the escalation path? How do you notify customers?
Serious incident reporting (Article 73): Providers must notify national market surveillance authorities within 15 days of becoming aware of a serious incident. Describe your incident detection process and your notification procedures.
Declaration of conformity (Article 47): The declaration is a formal document stating that the high-risk AI system conforms to the EU AI Act. It includes the provider's identity, system description, applicable standards, and a signed statement of conformity. Confirm whether you have drawn one up, and whether you can share it on request.
The Practical Answer
Most enterprise procurement questionnaires do not require you to attach all nine documents upfront. They want to know you have them and can produce them. The answer that moves a deal forward is: confirm which obligations you have met, name the documents you can share under NDA, and flag any that are in progress with a date.
Saying "we are working on our Article 49 registration and expect to complete it by [date]" is a stronger answer than a non-response. Procurement teams can work with a roadmap. They cannot work with silence.
Try Complizo free at complizo.com