Recurring duties
These duties are not done once. Some run for a fixed period, some start again after an event. Most concern providers and deployers of high-risk systems, and apply from the high-risk dates.
Logs kept at least six months
Automatically generated logs under your control, unless other law requires longer.
Documentation kept ten years
Technical documentation, quality management documents and the declaration of conformity, ten years after the system was placed on the market.
Serious incidents in 15, 2 or 10 days
15 days after becoming aware; 2 days for a widespread infringement or certain serious incidents; 10 days in case of death. A first incomplete report is allowed.
Substantial modification
A substantial change to a high-risk system starts a new conformity assessment. A deployer that makes it may become the provider (Art. 25).
Renewal of notified-body certificates
Where a notified body issued a certificate, it is valid for up to 4 years (Annex III) or 5 years (Annex I) and is renewed after a new assessment.
Post-market monitoring
Runs for the life of the system. The Commission’s template guidance is due by 2 September 2027.
Registration updates
Registration in the EU database before placing on the market or before use, updated when the data changes.
Legal changes
Delegated acts, guidelines, harmonised standards and national laws change the picture on different days. Each page here shows the day it was checked.