Can You Name the Data Behind Each Production Model? The European Union Dates Are Now Fixed

A note to forward to your team

Model lineage check

The European Union has fixed the dates for high-risk artificial intelligence systems: 2 December 2027 for Annex III uses and 2 August 2028 for Annex I products. The rules ask for governed training data, technical documentation and logs kept for at least six months.

Please run the check in this note by [date] and reply with three numbers:
1. Models in production
2. Models we can trace to a data set version from stored records
3. Models whose inference logs record the model version

Classification reviewed with counsel: [yes or no]
Owner: [name]
Note: https://stonetusker.com/insights/eu-ai-act-model-lineage.html

Why it matters now

Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It moved the high-risk dates and made them firm.^1,3 Annex III covers uses such as recruitment, credit scoring and life and health insurance pricing. Annex I covers regulated products such as medical devices.

Three groups of requirements fall on the engineering organisation.⁴ Article 10 asks for training, validation and testing data under governance practices that cover data origin, labelling, cleaning and examination for possible biases. Article 11 and Annex IV ask for technical documentation that describes the training data, how it was obtained and selected, the testing metrics and the software versions. Articles 12 and 19 ask for automatic logs kept for at least six months.

Fines for most provider obligations reach 15 million euros or 3% of worldwide annual turnover, whichever is higher. For small and medium-sized enterprises, start-ups and small mid-cap enterprises, the lower amount applies.⁴ A nearer date also applies: generative systems placed on the market before 2 August 2026 must mark their output in a machine-readable format by 2 December 2026.^3,4

Check one model in 30 minutes

Step 1. Choose the model and find what is deployed

Pick the model that serves the most traffic. If it runs on Kubernetes, list what is deployed:

kubectl get deployments --all-namespaces \
  -o 'custom-columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,IMAGE:.spec.template.spec.containers[*].image'

Step 2. Answer five questions from stored records only

• Which model version serves production, and where is that recorded?
• Which training data set version produced it, and can you retrieve that exact snapshot today?
• Which code commit and configuration trained it?
• Which evaluation results justified its promotion, and who approved it?
• Do inference logs record the model version, and for how long are they kept?

Step 3. Count the answers

Write down how many of the five you answered from a registry, a log or a versioned store, without asking anyone to remember.

What the result means

A model release moves three things: the code, the data and the trained weights, plus the evaluation behind the promotion. When only the code is under version control, every question from a customer or an auditor becomes a search through old notebooks and storage paths.

Recording lineage at training time, step by step

1. List production models. Record each model in production, the product it serves and its intended use, and agree the risk classification of each use with counsel.
2. Version the data. Store training, validation and testing data as immutable snapshots, with origin, labelling and cleaning steps recorded for each version.
3. Register every model. Use a model registry that links each model version to its training run, data set version and code commit.
4. Gate promotion on evaluation. Evaluate candidates on held-out data in the pipeline, store the results with the model version and block promotion below the agreed threshold.
5. Log inference with the model version. Add the model version to every prediction log and keep logs for at least six months for high-risk uses.
6. Generate documentation from records. Produce the technical documentation from the registry and data set metadata, so each new model version updates it.

The same records help outside the regulation: reproducing a regression, rolling back a model with confidence and explaining a drift incident to a customer.

What is still open

• The European Commission published draft guidelines on the classification of high-risk systems on 19 May 2026. Please base the classification of a specific system on the final guidelines and on advice from counsel.⁵
• Many systems are outside the high-risk categories. The transparency rules in Article 50 may still apply to generative and interactive systems.