Establish the provider role for the specific system.
For high-risk systems, Article 16 sets out provider obligations spanning system requirements, quality management, documentation, conformity procedures and corrective action. The details depend on the applicable framework and dates.
Do not assign the role solely from a procurement label such as 'customer' or 'reseller'. Review the actual activity and ask whether changes to branding, design or purpose require a more specific value-chain assessment.
Know which evidence your organisation must produce.
List the information that comes from internal teams and the information expected from suppliers. Identify who can explain the design, intended purpose, evaluations and limitations of the system. Where an upstream dependency is opaque, record the unanswered questions and their effect on the programme.
Technical documentation should describe the relevant release and be maintained as required. Article 11 is the starting reference for high-risk technical-documentation requirements; a generic marketing pack is a different kind of material.
Assign responsibility across the lifecycle.
Provider work spans more than a final approval meeting. Define who maintains requirements, reviews evidence, controls changes, prepares user information and responds to findings after release. Keep the boundaries between engineering, product, legal and quality roles understandable.
- An entity, system and dependency map.
- Evidence owners and review responsibilities.
- Release conditions and required formal procedures.
- Change, monitoring and corrective-action contacts.
Use a readiness record to expose gaps.
A provider programme should make unresolved work visible before a release decision. Separate evidence that is missing from evidence that has been reviewed and found inadequate. Identify dependencies on suppliers or external assessors early enough to plan them realistically.
EUAIC can help organise these records and workflows. It does not act as the system's legal provider merely by supplying governance technology, nor does it issue conformity approval. Keep the substantive responsibilities with the appropriately accountable parties.