Operationalizing in Modulos

This page is for providers, deployers and the other operators that use Modulos for the EU AI Act (Regulation (EU) 2024/1689). It tells you which Frameworks to add and how to set up the Organization and each AI System. It also gives the Requirement for each provision, the recommended sequence of work, the Reviews, and the legal tasks that Modulos does not do. For each provision, the Requirement table gives the page with the law.

Select the Frameworks

For the EU AI Act, Modulos has two Frameworks:

• OFF-1 — the Framework at the Organization level. Add it to the organization AI System.
• MFF-1 — the Framework at the AI System level. Modulos recommends one AI System with MFF-1 for each AI system or general-purpose AI model in the scope of the EU AI Act.

The two levels are a Modulos decision, not a structure of the EU AI Act. The EU AI Act gives duties to actors, for example providers and deployers, for each AI system or general-purpose AI model. A Requirement in OFF-1 does not change which actor has a duty, or for which system or model.

The Requirements for general-purpose AI models are in OFF-1 and MFF-1. See Requirements and provisions.

The EU AI Act gives different duties for AI systems and for general-purpose AI models. One entity can have the two types of duties. A provider does not get the duties of Articles 53 to 55 only because its AI system integrates a general-purpose AI model. See Article 3(63).

Organization AI System

OFF-1 attaches to the organization AI System of your organization. Modulos does not let you make a new organization AI System. If your organization does not have one, contact Modulos before you add OFF-1. See The organization AI System.

Set up the Organization and AI System

Modulos recommends that each actor makes its EU AI Act decisions before it sets up the Organization and the AI Systems. In these steps, "you" is the actor: a provider, deployer, importer, distributor, authorized representative or product manufacturer. Make the decisions for each AI system or general-purpose AI model:

1. Find if the EU AI Act applies to you. Article 2 has a different scope test for each actor, and it has exclusions. See Article 2.
2. Find if Article 2(2) applies. Use the Section B scope rule to find which EU AI Act provisions apply.
3. Find your role. Provider, deployer, authorized representative, importer and distributor are different roles in Article 3. One entity can have more than one role for the same system. See Article 3.
4. Find if your duties are for an AI system, a general-purpose AI model, or the two. See Select the Frameworks.
5. Examine the prohibitions of Article 5. Each prohibited practice has its own conditions and exceptions. See Article 5.
6. Classify each AI system for its intended purpose. Article 6 has cumulative product conditions and a conditional Annex III derogation that excludes profiling of natural persons. See Article 6.
7. Find which transparency duties of Article 50 apply to you. Paragraphs 1–2 give provider duties and paragraphs 3–4 give deployer duties, each with its conditions and exceptions. See Article 50.
8. For a general-purpose AI model, find which model duties apply. Use the three points below.

For a general-purpose AI model, three provisions change the duties of the provider:

• Article 51 — Systemic-risk classification depends on high-impact capabilities or Commission designation, with a training-computation presumption for high-impact capabilities. See Article 51.
• Article 53(2) — For models without systemic risk, the free and open-source exception covers only Article 53(1)(a) and (b), if all license and public-information conditions are met. See Article 53.
• Article 54 — Third-country providers must appoint an EU authorized representative by written mandate before placing the model on the Union market, unless Article 54(6)'s conditions apply and the model has no systemic risk. See Article 54.

Then record the decisions in Modulos:

1. Add OFF-1 to the organization AI System.
2. Register each AI system or general-purpose AI model in scope as an AI System. See Register an AI System.
3. Add MFF-1 to each of these AI Systems.
4. Set the EU AI Act settings of each AI System. See AI System Settings.
5. Complete the EU AI Act questionnaire of each AI System.
6. Before you accept the questionnaire result, compare the Requirements that it puts out of scope with your decisions.

The settings and the questionnaire set the scope of the work in Modulos. They do not classify the AI system in law. The classification comes from Article 6 and Annexes I and III.

Requirements and provisions

Providers, deployers and other operators can find EU AI Act provisions and legal pages for each OFF-1 and MFF-1 Requirement in this table. A Requirement does not make a provision apply to you. The page with the law tells you when the provision applies.

Framework	Requirement	Name in Modulos	Provisions	Page with the law
OFF-1	ORF-1	‘Art. 9 — Risk management system’	Article 9	High-risk AI systems
OFF-1	ORF-5	‘Art. 13 — Transparency and provision of information to deployers’	Article 13	High-risk AI systems
OFF-1	ORF-6	‘Art. 14 — Human oversight’	Article 14	High-risk AI systems
OFF-1	ORF-8	‘Art. 17 — Quality management system’	Article 17	High-risk AI systems
OFF-1	ORF-9	‘Art. 43 — Conformity assessment’	Article 43	Conformity assessment and CE marking
OFF-1	ORF-11	‘Corrective Actions’	Articles 16, 20, 24	Post-market monitoring, Roles and responsibilities
OFF-1	ORF-12	‘Duty of Information’	Articles 20, 23, 24	Post-market monitoring, Roles and responsibilities
OFF-1	ORF-13	‘Cooperation with Competent Authorities’	Articles 21, 22, 23, 24	Roles and responsibilities
OFF-1	ORF-14	‘Use and Oversight’	Article 26	Roles and responsibilities
OFF-1	ORF-36	‘Art. 4 — AI literacy’	Article 4	Roles and responsibilities
OFF-1	ORF-47	‘Art. 73 — Reporting of serious incidents’	Article 73	Post-market monitoring
OFF-1	ORF-49	‘Deployment Monitoring and Incident Handling’	Article 26(5)–(6)	Post-market monitoring
OFF-1	ORF-57	‘Deployer Cooperation with Competent Authorities’	Article 26	Roles and responsibilities
OFF-1	ORF-62	‘Documentation Keeping’	Articles 18, 22(3)(b), 23(5)–(6)	Roles and responsibilities
OFF-1	ORF-95	‘GPAIM IPR Compliance Policy’	Article 53(1)(c)	General-purpose AI models
OFF-1	ORF-96	‘GPAIM Cooperation with Competent Authorities’	Articles 53(3), 54(3)(d)	General-purpose AI models
OFF-1	ORF-97	‘Art. 55 — GPAIM-SR serious incident reporting’	Article 55(1)(c)	General-purpose AI models
OFF-1	ORF-224	‘Art. 54 — GPAIM documentation keeping’	Article 54(3) (points (a) and (b), mandate copy), Article 54(6)	General-purpose AI models
OFF-1	ORF-447	‘Art. 4a — Special-category data processing for bias detection and correction’	Article 4a	High-risk AI systems
MFF-1	MRF-1	‘Art. 9 — Risk management system’	Article 9	High-risk AI systems
MFF-1	MRF-2	‘Art. 10 — Data and data governance’	Article 10	High-risk AI systems
MFF-1	MRF-3	‘Technical Documentation’	Article 11	High-risk AI systems
MFF-1	MRF-4	‘Art. 12 — Record-keeping’	Article 12	High-risk AI systems
MFF-1	MRF-5	‘Art. 13 — Transparency and provision of information to deployers’	Article 13	High-risk AI systems
MFF-1	MRF-6	‘Art. 14 — Human oversight’	Article 14	High-risk AI systems
MFF-1	MRF-7	‘Accuracy’	Article 15	High-risk AI systems
MFF-1	MRF-64	‘Robustness’	Article 15	High-risk AI systems
MFF-1	MRF-65	‘Cybersecurity’	Article 15	High-risk AI systems
MFF-1	MRF-10	‘Keeping Logs by Provider’	Articles 12, 19	High-risk AI systems
MFF-1	MRF-14	‘Use and Oversight’	Article 26	Roles and responsibilities
MFF-1	MRF-15	‘Art. 27 — Fundamental rights impact assessment for high-risk AI systems’	Article 27	High-risk AI systems
MFF-1	MRF-37	‘Authorised Representative’	Article 22	Roles and responsibilities
MFF-1	MRF-38	‘AI System Classification’	Articles 3, 5, 6, 49, 51, 52	High-risk AI systems, General-purpose AI models, Prohibited practices and transparency, Conformity assessment and CE marking
MFF-1	MRF-111	‘Art. 6 — AI system classification exemption’	Articles 6(4), 49(2)	High-risk AI systems
MFF-1	MRF-39	‘Art. 16 — Accessibility’	Article 16	Roles and responsibilities
MFF-1	MRF-40	‘System Testing’	Article 9(6)–(8)	High-risk AI systems
MFF-1	MRF-41	‘Disclosure of Contact Information’	Articles 16, 23	Roles and responsibilities
MFF-1	MRF-42	‘Art. 8 — Choice for handling sectoral requirements’	Article 8(2)	High-risk AI systems
MFF-1	MRF-43	‘Art. 25 — High-risk AI system integration support’	Article 25	Roles and responsibilities
MFF-1	MRF-9	‘Art. 43 — Conformity assessment’	Articles 43, 44, 47, 48	Conformity assessment and CE marking
MFF-1	MRF-44	‘Transparent Interaction with Natural Persons’	Article 50	Prohibited practices and transparency
MFF-1	MRF-45	‘AI-Generated or Manipulated Content Marking’	Article 50	Prohibited practices and transparency
MFF-1	MRF-46	‘Art. 72 — Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems’	Article 72	Post-market monitoring
MFF-1	MRF-48	‘Relevant and Sufficiently Representative Input Data’	Article 26	Roles and responsibilities
MFF-1	MRF-49	‘Deployment Monitoring and Incident Handling’	Article 26(5)	Post-market monitoring
MFF-1	MRF-50	‘Keeping Logs by Deployer’	Article 26	Post-market monitoring
MFF-1	MRF-51	‘Using Provider-supplied information for DPIA’	Article 26	Roles and responsibilities
MFF-1	MRF-52	‘Transparent Deployment at Workplace’	Article 26	Roles and responsibilities
MFF-1	MRF-53	‘Public Deployer Registration’	Articles 26, 49, 71	Conformity assessment and CE marking
MFF-1	MRF-54	‘Post-Remote Biometric ID Authorization and Reporting’	Article 26(10)	Roles and responsibilities
MFF-1	MRF-55	‘Informing Natural Persons Subject to a High-Risk AI System’	Article 26	Roles and responsibilities
MFF-1	MRF-56	‘Art. 86 — Right to explanation of individual decision-making’	Article 86	Roles and responsibilities
MFF-1	MRF-58	‘Transparency of Biometric Categorisation’	Article 50	Prohibited practices and transparency
MFF-1	MRF-59	‘Transparency of Emotion Recognition’	Article 50	Prohibited practices and transparency
MFF-1	MRF-60	‘Transparency of Deepfakes’	Article 50	Prohibited practices and transparency
MFF-1	MRF-61	‘Transparency of Computer-Generated Reporting’	Article 50	Prohibited practices and transparency
MFF-1	MRF-112	‘Duty to Verify Evidence of Conformity’	Articles 23, 24	Roles and responsibilities
MFF-1	MRF-113	‘Duty to Ensure Appropriate Storage or Transport Conditions’	Articles 23, 24	Roles and responsibilities
MFF-1	MRF-114	‘Authorised Representative Mandate’	Article 22	Roles and responsibilities
MFF-1	MRF-115	‘Authorised Representative Duty to Verify Evidence of Conformity’	Article 22	Roles and responsibilities
MFF-1	MRF-116	‘Authorised Representative Registration’	Articles 22, 49	Conformity assessment and CE marking
MFF-1	MRF-117	‘Modification Assistance’	Article 25	Roles and responsibilities
MFF-1	MRF-118	‘Integration Assistance’	Article 25	Roles and responsibilities
MFF-1	MRF-119	‘Art. 5 — Prohibited AI practices’	Article 5	Prohibited practices and transparency
MFF-1	MRF-120	‘GPAIM Classification’	Articles 51, 52	General-purpose AI models
MFF-1	MRF-121	‘Art. 52 — GPAIM classification exemption’	Article 52(1)–(3), (5)	General-purpose AI models
MFF-1	MRF-122	‘GPAIM Training Data Summary’	Article 53(1)(d)	General-purpose AI models
MFF-1	MRF-123	‘GPAIM Legal Compliance Strategy’	Articles 53(4), 55(2), 56	General-purpose AI models
MFF-1	MRF-124	‘GPAIM Documentation and Downstream Integration’	Article 53(1)(a)–(b), Article 53(2), Annexes XI and XII	General-purpose AI models
MFF-1	MRF-125	‘GPAIM-SR Evaluation’	Article 55(1)(a)	General-purpose AI models
MFF-1	MRF-126	‘GPAIM-SR Risk Assessment and Mitigation’	Article 55(1)(b)	General-purpose AI models
MFF-1	MRF-127	‘GPAIM-SR Security’	Article 55(1)(d)	General-purpose AI models
MFF-1	MRF-128	‘GPAIM Authorised Representative’	Article 54(1), (6)	General-purpose AI models
MFF-1	MRF-130	‘GPAIM Authorised Representative Mandate’	Article 54(1), (3), (5)–(6)	General-purpose AI models
MFF-1	MRF-131	‘GPAIM Authorised Representative Duty to Verify Evidence of Compliance’	Article 54(3)(a), (6)	General-purpose AI models
MFF-1	MRF-413	‘Art. 4a — Special-category data processing for bias detection and correction’	Article 4a	High-risk AI systems

For the Controls that OFF-1 and MFF-1 share with other Frameworks, see Control overlap.

Complete the work in sequence

Modulos recommends this sequence of EU AI Act work for the provider of a high-risk AI system. The sequence is a recommendation. The duties, their conditions and their deadlines come from the EU AI Act.

1. Start with the risk-management system of Article 9. In Article 8(1), this system “shall be taken into account” for compliance with Chapter III, Section 2. See Article 9.
2. Prepare the quality management system of Article 17. It includes the post-market monitoring system of Article 72. See Article 17.
3. Prepare the technical documentation of Article 11 and Annex IV. Make it before the system is placed on the market or put into service. Keep it up to date. See Article 11.
4. Include the post-market monitoring plan in the technical documentation. Article 72(3) makes the plan part of the Annex IV documentation. See Article 72.
5. Complete the applicable conformity assessment of Article 43. Subject to Article 46 derogations, complete assessment before placing on the market or putting into service. See Article 16(f) and Article 43.
6. Make the EU declaration of conformity of Article 47. See Article 47.
7. Affix the CE marking of Article 48. See Article 48.
8. Complete the applicable registration before placing on the market or putting into service. Article 49 covers EU registration, also for Article 6(3) systems, and national registration for high-risk Annex III(2) systems. See Article 49.
9. Operate the post-market monitoring system, and report serious incidents. See Post-market monitoring.

Review the Requirements

In Modulos, the Requirement Owner reviews the completed work for each EU AI Act Requirement and marks the Requirement Fulfilled. See Reviews & Statuses.

A Fulfilled Requirement shows the status of the work in Modulos. It does not demonstrate conformity of an AI system or a general-purpose AI model with the EU AI Act. For a high-risk AI system, the provider demonstrates conformity through the applicable EU AI Act procedures, for example the conformity assessment of Article 43.

Legal tasks that Modulos does not do

The EU AI Act gives some legal acts to the actor itself. Modulos does not do these legal acts when you complete the Requirements of OFF-1 and MFF-1. The responsible actor must do each applicable task. These are examples:

• Article 5(3) — Law-enforcement use of real-time remote biometric identification in publicly accessible spaces requires prior authorization, subject to Article 5(3)'s conditions and urgency exception. See Article 5.
• Article 22(1) — Where Article 22 applies, third-country providers must appoint an EU authorized representative by written mandate before making their high-risk AI systems available on the Union market. See Article 22.
• Article 26(10) — Article 26(10)'s authorization duty concerns high-risk post-remote biometric identification in an investigation for the “targeted search” of a person suspected or convicted of a criminal offense. Deployers “shall request an authorisation” for that use, subject to Article 26(10)'s timing rules and initial-identification exception. See Article 26(10).
• Article 27 — The specified deployers must complete the fundamental rights impact assessment before first use and notify its results, unless the Article 46(1) notification exception applies. See Article 27.
• Articles 43 and 47 to 49 — For high-risk systems, providers must do the applicable assessment, declaration, CE marking and registration tasks, with notified-body involvement where required. See Conformity assessment and CE marking.
• Article 52(1) — General-purpose AI model providers must notify the Commission when the Article 51(1)(a) condition is met or they know it will be, subject to Article 52(1)'s time limits. See Article 52.
• Article 73 — Providers and deployers must send the applicable serious-incident reports and notifications required by Articles 73 and 26(5), with actor-specific conditions, recipients and time limits. See Article 73.

Review changes

Modulos recommends that each actor examines its EU AI Act scope, role and duties again after one of these changes:

• a change to the AI system or to its intended purpose
• a change to the role of the actor
• a change to the general-purpose AI model.

These provisions of the EU AI Act can apply after a change:

• Article 25(1) — A distributor, importer, deployer or other third party becomes the provider of a high-risk AI system when one of Article 25(1)'s specified conditions applies. See Article 25.
• Article 43(4) — Article 43(4) requires a new conformity assessment after substantial modification of an assessed high-risk system, with an exception for specified predetermined learning changes. See Article 43(4).
• Article 52(1) — A model change can cause the provider's notification duty to apply when the Article 51(1)(a) condition is met or the provider knows it will be. See Article 52.

After a change, update the EU AI Act settings of the AI System. Then complete the questionnaire again. If you find that a change is not a substantial modification, Modulos recommends that you record the justification for this decision. The EU AI Act does not make this record mandatory.

Related information

• EU AI Act overview: the scope, the dates, the penalties and the status of the Commission guidance.
• Frequently asked questions: short answers about the scope, the dates, the roles and the obligations.
• Roles and responsibilities: the scope, the definitions, and the duties of each actor.
• Prohibited practices and transparency: Article 5 prohibitions and Article 50 transparency obligations.
• High-risk AI systems: Article 6 classification and the requirements of Articles 8 to 17 and 27.
• Conformity assessment and CE marking: Article 43 procedures, the declaration, the CE marking and registration.
• Post-market monitoring: Article 72 monitoring and Article 73 serious-incident reports.
• General-purpose AI models: Articles 51 to 56 for the providers of general-purpose AI models.
• Commission guidance: the Commission guidelines on the EU AI Act and their status.
• Control overlap: the Controls that the EU AI Act Frameworks in Modulos share with other Frameworks.

See it in Modulos

Add OFF-1 to your organization AI System and MFF-1 to each AI System in scope.

Request a demo

Sources

• EU AI Act, Regulation (EU) 2024/1689. Consolidated text of 27 July 2026. EUR-Lex.
  • Articles 2(1)–(2), 3(1), 3(3)–(8), 3(12), 3(23), 4, 4a, 5, and 6.
  • Articles 8 to 27, and 43 to 56.
  • Articles 71 to 73, 75(1a), and 86.
  • Annexes I, III, IV, VI, VII, XI, and XII.
• Modulos Frameworks: OFF-1 and MFF-1, EU AI Act.

Disclaimer

This page gives general information. It is not legal advice.