Is the AI in our product within EU AI Act scope? What should the product manager decide first?
Even without an establishment in the EU, a Taiwanese company is in scope once it places an AI system on the EU market or the system's output is used in the EU (Article 2(1)). Then decide, system by system:
- Role: provider, deployer, importer or distributor. Whoever develops an AI system and places it on the market under its own name is the provider.
- Risk tier: whether the system falls under the Article 5 prohibitions, high risk under Annex I or Annex III, the Article 50 transparency obligations, or the Article 6(3) exemption.
- Record of the decision: an Annex III system that profiles natural persons is always high risk; an Article 6(3) exemption needs a written assessment and registration, not a verbal call.
If we put our own brand on someone else's AI or change its purpose, do we become the provider?
Possibly. Under Article 25(1), the following can make you a provider with provider obligations:
| Situation | Provision |
|---|---|
| Putting your own name or trademark on it (unless the contract allocates otherwise) | Point (a) |
| Making a substantial modification to a high-risk system | Point (b) |
| Changing the intended purpose so that it becomes high risk | Point (c) |
Article 25(2) requires the original provider to cooperate, unless it has clearly specified that the system is not to be changed into a high-risk use. Before buying or rebranding, the product manager should complete the role assessment and confirm what information and help the original provider can give.
What documents and procedures must a high-risk AI product have before launch?
Under Article 16, the provider must meet the Section 2 requirements, which cover risk management, data governance, technical documentation, record-keeping, human oversight and accuracy, among others. Before launch:
- Choose the conformity assessment under Article 43: Annex III points 2 to 8 use internal control; point 1 biometric systems need a notified body where harmonised standards are not fully applied; Annex I products follow the procedure of the relevant sectoral law.
- The provider draws up the EU declaration of conformity and affixes the CE marking itself, with no application to an authority.
- Annex III systems are registered in the EU database before being placed on the market.
The EU AI Act has no stand-alone certificate; what you show customers is the declaration of conformity, the CE marking and the technical documentation.
When does the EU AI Act apply? Will compliance work delay our product launch?
Under the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026):
- High-risk systems under Annex III: from 2 December 2027
- Annex I products: from 2 August 2028
- Article 50 transparency obligations: from 2 August 2026
Timeline as listed on the service page: high-risk AI compliance usually takes 6–9 months, and 9–12 months together with ISO 42001 certification. In order: AI system inventory and risk classification (1 month), FRIA and gap analysis (1–2 months), ISO 42001 management system (2–4 months), technical documentation (1–2 months), conformity assessment and EU AI database registration (1–2 months), then post-market monitoring. Plan backwards from the target launch date.
Customers want proof that our product's AI is compliant. Is an ISO 42001 certificate enough?
No. ISO/IEC 42001 can be certified by a certification body, but it is not a harmonised standard under the EU AI Act, and certification creates no presumption of conformity; a certificate cannot replace conformity assessment, EU database registration, an authorised representative or Article 50 transparency. As of October 2026, the only AI Act harmonised standard published in the Official Journal is EN 18286:2026 (AI quality management system, supporting Article 17), and the presumption extends only to the requirements it covers.
Statements to customers and channels should be reviewed: describe the certificate scope separately from product compliance, and never say "42001 equals AI Act compliance". Where the customer is a deployer, the provider should also prepare the information the deployer needs for its own assessment.
Our product is also a connected product. Do the EU AI Act and the CRA have to be handled separately?
Not entirely. When a product is in CRA scope and is also a high-risk AI system under the AI Act, meeting the CRA Annex I essential requirements and stating in the CRA EU declaration of conformity that the level of cybersecurity protection required by Article 15 of the AI Act has been achieved creates a presumption of conformity with the Article 15 cybersecurity requirements (CRA Article 12).
Accuracy and robustness are outside this bridge and must still be handled under the AI Act; conformity assessment generally follows Article 43 of the AI Act, with exceptions for important and critical products. One risk assessment, technical file and declaration of conformity can cover the cybersecurity part of both laws; AI risk classification, data governance, human oversight and accuracy validation must be prepared separately.
How does Winners Consulting help product managers with the EU AI Act?
Winners Consulting starts with an AI system risk classification diagnosis to place the AI product in the four-tier risk structure, then plans the compliance path by risk tier:
- Three core documents: an AI system inventory, an AI risk and impact assessment, and an EU AI Act obligation matrix (each obligation by role, with owner, evidence and due date)
- Technical documentation and conformity assessment: preparing the technical file and arranging conformity assessment and EU database registration
- Post-market monitoring: monitoring and serious incident reporting procedures folded into the existing security incident process
- Dual-track integration: ISO 42001 and the EU AI Act share one set of documents and evidence, avoiding duplicate work
VP- and director-level consultants lead the work end to end, never outsourced. Read more: EU AI Act consulting, Choosing an EU AI Act consultant, Role change from rebranding or new purposes. Request a free mechanism diagnosis
How other roles see this service
- CEOEU AI Act and ISO 42001 for the CEO: staff AI use, fines and governance ownership
- CISOCISO and the EU AI Act: what do AI security, logs and human oversight require?
- CROAI risk for CROs: what to decide first on ISO 42001 and the EU AI Act?
- CFOCFO view of the EU CRA and EU AI Act: EU revenue risk, penalties and budgeting
- CTOISO 42001 and the EU AI Act for CTOs: what does AI product development need?
Other services for this role
- EU CRA for product managers: is my product in scope, and what must be ready before launch?
- ISO/IEC 29147 and 30111 for product managers: what can we promise on vulnerability disclosure and fixes?
- IEC 62443-4-2 for product managers: will industrial product certification delay our launch?
- ISO/SAE 21434 for product managers: how does an automotive product pass carmaker development audits?
- ISO 42001 for product managers: how do we answer customer demands on AI product governance?
- TISAX prototype protection for product managers: will a missing label block a carmaker project?
- ISO 27701 and GDPR for product managers: which privacy work comes first when selling into each market?