Sistem AI risiko dhuwur: apa sing dibutuhake dening Undhang-undhang AI saka organisasi sampeyan

Sistem AI berisiko tinggi minangka titik fokus saka Peraturan AI Eropa ( Peraturan (EU) 2024/1689 ), sing umum diarani minangka Undhang-undhang AI, sing ngenalake kerangka kerja berbasis risiko kanggo ngembangake, nyedhiyakake, lan nggunakake sistem kecerdasan buatan (AI). Saya dhuwur risiko kesehatan, keselamatan, lan hak-hak dhasar, saya abot kewajibane.

Kanggo organisasi, kepatuhan ora diwiwiti kanthi nyusun dokumentasi teknis, nanging kanthi klasifikasi sing bener. Kapisan, nemtokake sistem AI endi sing dikembangake, dituku, utawa digunakake ing organisasi kasebut. Banjur, netepake apa sistem kasebut dilarang , beresiko dhuwur, tundhuk karo kewajiban transparansi, utawa ing njaba kewajiban tartamtu.

This article sets out when an AI system may qualify as high-risk, which obligations apply to providers and deployers, and which steps organisations can take now. It also sets out the timeline as it now stands, after the deferral of the high-risk obligations under the Digital Omnibus.

Kapan sistem AI iku beresiko dhuwur?

Penilaian sistem AI berisiko tinggi digawe utamane miturut Pasal 6 lan Lampiran I lan III saka Undhang-undhang AI. Ana rong rute.

Rute pertama ana hubungane karo sistem AI sing dadi bagean saka produk sing dilindhungi dening undang-undang produk Eropa sing kadhaptar ing Lampiran I lan mbutuhake penilaian kesesuaian pihak katelu. Coba pikirake piranti medis, mesin, lift, lan dolanan tartamtu. Kanggo sistem kasebut, Undhang-undhang AI dibangun ing prosedur penilaian kesesuaian sing wis ana.

Rute kapindho ana hubungane karo sistem AI sing digunakake ing domain sing kadhaptar ing Lampiran III: biometrik, infrastruktur kritis, pendidikan lan pelatihan kejuruan, manajemen lapangan kerja lan tenaga kerja, akses menyang layanan swasta lan umum sing penting, penegakan hukum, migrasi, suaka lan kontrol tapel wates, lan administrasi keadilan lan proses demokrasi. Ora saben panggunaan ing domain kasebut kanthi otomatis nyebabake klasifikasi ing antarane sistem AI sing beresiko tinggi: fungsi spesifik sistem lan kahanan Pasal 6 uga kudu ditaksir.

Pengecualian ing Pasal 6(3)

Sistem sing kalebu ing domain Lampiran III ora otomatis diitung minangka sistem AI berisiko tinggi: klasifikasi kasebut ora kalebu yen ora ana risiko sing signifikan kanggo kesehatan, keamanan, utawa hak-hak dhasar wong lan ora mengaruhi asil pengambilan keputusan kanthi materi. Iki bisa uga kedadeyan nalika sistem kasebut mung nindakake tugas prosedural sing sempit, mung nambah kegiatan sing wis ditindakake dening manungsa, mung menehi tandha penyimpangan saka pengambilan keputusan manungsa sadurunge tanpa ngganti penilaian kasebut, utawa mung nindakake tugas persiapan.

Ketergantungan marang pengecualian iki kudu dijlentrehake lan didokumentasikake kanthi teliti. Organisasi kasebut ora mung nyathet kesimpulan, nanging uga fakta lan penilaian sing dadi dhasar kesimpulan kasebut. Panyedhiya sing nganggep manawa sistem Lampiran III ora kalebu ing sistem AI berisiko tinggi kudu ndokumentasikake penilaian kasebut sadurunge sistem kasebut dilebokake ing pasar utawa dilebokake ing layanan, lan uga tundhuk karo kewajiban registrasi ing Pasal 49(2).

Ing salah sawijining poin, Peraturan iki absolut. Pasal 6(3) netepake yen sistem AI sing kasebut ing Lampiran III mesthi diitung ing antarane sistem AI berisiko tinggi ing ngendi dheweke nindakake profiling wong. Pengecualian kasebut ora bisa digunakake ing kasus kasebut.

Apa peran organisasi sampeyan?

Undhang-undhang AI mbedakake sawetara peran ing rantai kasebut. Loro saka iku penting kanggo umume organisasi. Pihak sing ngembangake sistem AI, utawa nyelehake ing pasar kanthi jeneng utawa merek dagang dhewe, nduweni kualifikasi minangka panyedhiya. Pihak sing nggunakake sistem AI sajrone bisnis dhewe tanpa ngembangake umume nduweni kualifikasi minangka deployer.

Alokasi peran kasebut ora statis. Organisasi sing ngowahi sistem sing dituku kanthi substansial, nyedhiyakake kanthi jeneng utawa merek dagang dhewe, utawa ngganti tujuan sing dimaksud, isih bisa dianggep minangka panyedhiya lan kanthi mangkono kudu tanggung jawab sing luwih abot. Nemtokake peran apa sing sampeyan lakoni kanggo saben sistem, lan cathet penilaian kasebut.

Kewajiban utama

Panyedhiya sistem AI berisiko tinggi tundhuk karo kewajiban kalebu sing ana ing Pasal 8 nganti 17, 43 lan 47 nganti 49:

• sistem manajemen risiko sing nyakup kabeh siklus urip
• tata kelola data, kalebu ndeteksi lan mbenerake bias ing data sing digunakake, kalebu pelatihan, validasi, lan uji coba data
• dokumentasi teknis miturut Lampiran IV, lan pencatatan acara
• pandhuan sing jelas kanggo panggunaan kanggo para deployer
• desain sing nggampangake pengawasan manungsa sing efektif
• syarat akurasi, kekokohan, lan keamanan siber
• sistem manajemen kualitas, penilaian kesesuaian, deklarasi kesesuaian EU, penandaan CE lan registrasi ing basis data EU

Kanggo sistem AI risiko dhuwur sing digunakake kanggo identifikasi biometrik jarak jauh kaya sing kasebut ing Lampiran III, poin 1(a), Pasal 14(5) ngetrapake syarat tambahan babagan pengawasan manungsa: ora ana tindakan utawa keputusan sing bisa ditindakake adhedhasar identifikasi kajaba wis diverifikasi lan dikonfirmasi kanthi kapisah dening paling ora rong wong kanthi kompetensi, pelatihan, lan wewenang sing dibutuhake. Iki dikenal minangka prinsip papat mripat.

Para deployer kudu netepi kewajiban sing luwih entheng nanging ora kalah penting saka Pasal 26 lan 27: panggunaan miturut pandhuan panggunaan, pengawasan manungsa sing kompeten, pemantauan operasi sistem, pelaporan risiko lan kedadeyan serius, lan panyimpenan log paling ora nem wulan. Karyawan sing bakal kerja karo sistem kasebut, lan wong sing ditrapake, kudu diwenehi informasi luwih dhisik.

Penempatan tartamtu uga kudu nindakake penilaian dampak hak-hak dhasar, Penilaian Dampak Hak-Hak Dhasar miturut Pasal 27. Iki ditrapake ing acara apa wae kanggo badan sing diatur dening hukum publik, kanggo panyedhiya layanan umum swasta, lan kanggo penempatan sing nggunakake sistem kanggo penilaian kredit utawa kanggo netepake risiko asuransi ing asuransi jiwa lan kesehatan.

Garis wektu lan status saiki

Undhang-undhang AI iki mulai berlaku tanggal 1 Agustus 2024 lan bakal ditrapake kanthi bertahap. Ing praktik, penting kanggo mbedakake antarane kewajiban sing wis ditrapake, kewajiban sing bakal ditrapake ing mangsa ngarep, lan amandemen sing diumumake sing durung rampung ditrapake sacara resmi.

Praktik sing dilarang (Pasal 5): Ditrapake wiwit 2 Februari 2025

Literasi AI (Pasal 4): Ditrapake wiwit 2 Februari 2025

Model AI tujuan umum: Ditrapake wiwit 2 Agustus 2025

Transparency obligations (Article 50): applicable since 2 August 2026; not deferred

High-risk via Annex III: applicable from 2 December 2027, following the deferral

High-risk via Annex I: applicable from 2 August 2028, following the same deferral

That deferral is settled law. The European Commission presented the Digital Omnibus package on 19 November 2025 with a proposal to postpone the obligations for high-risk AI systems. The amending regulation, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026.

Only the high-risk regime moved. The obligations under Chapter III for systems classified through Annex III now apply from 2 December 2027, and those for systems classified through Annex I from 2 August 2028. Everything else kept its original date, so the deferral did not create a general pause in the AI Act.

The postponement is not unconditional in the way a simple change of date would be. Application of the high-risk obligations is linked to the availability of the harmonised standards and supporting instruments needed to comply with them, and the new dates operate as the outer limit of that arrangement rather than as a target that can still slip further. Planning on the assumption of another extension is therefore unwise.

Two points deserve separate attention. First, the transparency obligations of Article 50 and the AI literacy obligation of Article 4 were not deferred: Article 50 has applied since 2 August 2026 and Article 4 since 2 February 2025. Second, the package adds a new prohibition to Article 5, aimed at AI applications generating non-consensual intimate imagery and at AI-generated child sexual abuse material.

For organisations this means that December 2027 is the date to plan the high-risk documentation against, while the transparency, literacy and general purpose obligations are matters of present compliance rather than preparation.

Pengawasan lan sanksi

In the Netherlands the implementing act for the AI Act is not yet in force. A draft was released for public consultation on 20 April 2026. It gives the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) the role of supervisor for the fields in which no sector supervisor is designated, with a dedicated AI unit, and gives the Dutch Authority for Digital Infrastructure (RDI) a coordinating role, while sector supervisors keep their own domains. Until that act has been passed and brought into force, the precise allocation of powers and the national penalty regime are not settled.

Pasal 99 saka Undhang-undhang AI nyedhiyakake sawetara kategori paukuman maksimal. Tingkat kasebut gumantung saka sifat pelanggaran lan, yen ana hubungane, saka omzet taunan perusahaan ing saindenging jagad. Maksimum paling dhuwur ditrapake kanggo pelanggaran praktik sing dilarang ing Pasal 5; maksimum sing luwih murah ditrapake kanggo pelanggaran kewajiban liyane, kalebu kanggo panyedhiya lan panyebar sistem AI berisiko tinggi; lan sing paling endhek ditrapake kanggo nyedhiyakake informasi sing salah, ora lengkap, utawa mblusukake marang panguwasa. Rezim sing luwih nguntungake ditrapake kanggo usaha cilik lan menengah (UKM), kalebu perusahaan rintisan. Hukuman sing nyata ditemtokake kanthi nggatekake aturan sing ditrapake babagan paukuman lan kahanan kasus kasebut.

Peta dalan praktis

• Inventaris kabeh sistem AI sing dikembangake, dituku, utawa digunakake organisasi sampeyan.
• Nemtokake peran sing sampeyan lakoni kanggo saben sistem: panyedhiya utawa panyebar.
• Nemtokake kategori risiko kanggo saben sistem lan dokumentasikake penilaian kasebut, kalebu katergantungan marang pengecualian ing Pasal 6(3).
• Nyetel tata kelola AI lan nunjuk pejabat sing tanggung jawab.
• Njamin literasi AI ing antarane staf sing makarya nganggo sistem kasebut; kewajiban kasebut wis ditrapake.
• Implement the transparency measures under Article 50; they have applied since 2 August 2026.
• Miwiti dokumentasi teknis lan, yen dibutuhake, penilaian dampak hak-hak dhasar kanthi tepat wektu.
• Nliti kontrak pemasok babagan alokasi peran, panyediaan informasi, lan hak audit.
• Plan the high-risk documentation against 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.

Apa sing dijaluk dening Undhang-undhang AI saka organisasi sampeyan

The AI Act fundamentally affects how organisations develop, purchase and use AI. The deferral of the high-risk obligations buys time for the heaviest part of the regime, but it leaves everything else in place: the prohibitions of Article 5, the AI literacy obligation, the rules for general purpose AI models and the transparency obligations of Article 50 all apply today. The time gained is best spent on classification and documentation, because those are the steps that cannot be compressed later. For a broader overview of the regulation, see our Pandhuan Lengkap kanggo Undhang-undhang AI EU, sing nglengkapi fokus artikel iki babagan sistem AI berisiko tinggi.

Law & More helps organisations inventory and classify their AI systems, determine their role as provider or deployer, review and draft contracts with AI suppliers, and set up AI governance. If you would like to know which obligations currently apply to your organisation and which steps should take priority? please feel free to contact us.

Pitakonan Paling Sering

Ing ngisor iki kita bakal njawab pitakonan sing paling kerep ditakoni babagan iki.