High-Risk AI Systems and the Problem of Identity in the European AI Act

[Submitted on 17 Apr 2026 (v1), last revised 4 Jul 2026 (this version, v3)]

View PDF HTML (experimental)

Abstract:The EU Artificial Intelligence Act (AIA) establishes a lifecycle governance regime for high-risk AI systems built around ex-ante conformity assessment, post-market monitoring, and re-assessment upon “substantial modification.” These obligations presuppose AI identity judgments: regulators and providers must decide when an updated system remains the same system over time. In this work, we show how this logic is clarified by the function+ framework of artifact identity, which individuates AI systems by their intended function together with context-sensitive criteria of appropriate functioning, captured as “AI trustworthiness.” We further argue that the AIA does not provide an internal, auditable criterion for synchronic identity–when two AI systems at a given time should count as the same for regulatory purposes–and instead largely defers such sameness determinations to sectoral or harmonization instruments. function+ supplies a synchronic identity test anchored in intended function and trustworthiness profiles and levels, making synchronic identity decisions inspectable in governance settings such as procurement, liability, and market surveillance. Our contribution is a conceptual and auditing lens: we provide a correspondence map between AIA lifecycle obligations and function+ identity components, and we make the synchronic case operationally legible via a minimal decision flow for audit and dispute contexts. We conclude with two implementation-facing recommendations: (1) more precise, testable reporting of intended purpose, and (2) standardized, auditable trustworthiness reporting that supports comparability over time and across deployments.

Submission history

From: Andrea Ferrario [view email]
[v1] Fri, 17 Apr 2026 20:24:29 UTC (36 KB)
[v2] Sat, 27 Jun 2026 19:16:17 UTC (36 KB)
[v3] Sat, 4 Jul 2026 20:00:32 UTC (39 KB)