What should you publish in an AI Trust Center?
Publish what a customer's reviewer checks first: each AI system with its risk class and the article behind it, how you meet Article 50, your AI use policy and AI literacy approach, your sub-processors and DPA. Keep test reports and technical documentation behind a request. The AI Act has no article that requires a Trust Center.
Written 1 November 2026 against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI); Article 13, Article 15 and Article 50(1) to (6) were not amended.
In short
- No legal duty. Neither Regulation (EU) 2024/1689 nor the amending act mentions a Trust Center. What goes on one is your choice and your customers' expectation.
- Publish: a summary of your AI register with each system's risk class and article, how you meet Article 50, your AI use policy, your Article 4 literacy approach, your sub-processor list and your DPA.
- Keep behind a request: penetration test reports and detailed security documents, technical documentation and the instructions for use of a high-risk system, which Article 13 writes for its deployers and which go to them with the system.
- A page is not the notice. Article 50(5) requires the information to reach the person at the latest at the time of the first interaction or exposure. The Trust Center describes the notice; the system gives it.
- Date every item. Article 4 was replaced with effect from 27 July 2026, so a literacy statement written earlier was written against wording that no longer applies.
Does the EU AI Act require an AI Trust Center?
No. Where the Act wants information to reach someone, it names the recipient. Instructions for use accompany a high-risk system and are written to be comprehensible to deployers (Article 13(2)). Article 50 information reaches the natural persons concerned (Article 50(5)). Technical documentation gives national competent authorities and notified bodies the information to assess compliance (Article 11(1), second subparagraph, as replaced).
A Trust Center is a channel you choose on top of those. It can carry some of them: Article 13(2) allows instructions for use "in an appropriate digital format or otherwise", so a gated page can deliver them to a deployer. It cannot deliver an Article 50 notice to a person who never visits it.
What should go on the public page?
| Item | What to show | AI Act link | Duty or expectation |
|---|---|---|---|
| AI register summary | Each system, what it does, its risk class, the article the class rests on, the date a person confirmed it. | Article 6, with Annexes I and III, sets when a system is high-risk; Article 5 lists prohibited practices; Article 50 sets the transparency duties. | Expectation. The Act sets the classification rules, not a page that shows them. |
| Article 50 notices | Which systems tell people they are AI, which outputs are marked and where each notice appears. | Article 50(1) to (4). | The duty sits in the system: the notice or the marking. The page is evidence of it. |
| AI use policy | The rules your staff follow when they use AI. | No article requires one; it can carry Article 4 measures. | Expectation. |
| AI literacy approach | Who is trained on what, how often and the last date. | Article 4(1), as replaced. | The duty is the measures. Publishing them is expectation. |
| Sub-processors and DPA | Who processes customer data, and your data processing agreement. | Data protection law, not the AI Act. | Not an AI Act item. |
| Security overview | Certifications held and the main controls, in brief. | For a high-risk system, Article 15(1) requires an appropriate level of accuracy, robustness and cybersecurity, performing consistently throughout the system's lifecycle. | Expectation. |
Show each risk class as your own assessment: the class, the article, the date and who confirmed it. A class without its article invites the question the page was meant to answer.
The Act's own register is a different thing. Article 49 has providers of Annex III high-risk systems, providers that concluded under Article 6(3) that an Annex III system is not high-risk, and public-sector deployers of those high-risk systems register in the EU database referred to in Article 71, with the exceptions it sets. The EU database registration guide covers who and when.
In Complipath, the Trust Center is on Growth and up: the sections you choose, and a requested file that goes out only after your yes, on a seven-day link. A custom domain for it is not available yet.
What should stay behind a request?
- Penetration test reports and detailed security documents. They show where you are exposed. Release them to a named person, after approval, for a limited time. That is practice, not law.
- Technical documentation of a high-risk system. Article 11(1), second subparagraph, as replaced, has it drawn up "to provide national competent authorities and notified bodies with the necessary information in a clear and comprehensive form to assess the compliance of the AI system with those requirements". It contains at least the elements of Annex IV. Customers are not its addressee.
- Instructions for use of a high-risk system. Article 13(3) lists their minimum content, including the system's limitations of performance and any known or foreseeable circumstance that may lead to risks to health and safety or fundamental rights. Give them to the deployers of that system.
- What a high-risk provider you supply needs. Where your customer provides a high-risk system and you supply something used or integrated in it, Article 25(4), as replaced, requires a written agreement on the necessary information, capabilities, technical access and other assistance, so that the provider can fully comply with the Regulation. That goes into the agreement, not onto a public page. The paragraph does not apply to third parties making tools, services, processes or components, other than general-purpose AI models, accessible to the public under a free and open-source licence.
Articles 11, 13, 15, 25 and 26 apply from 2 December 2027 for a system high-risk under Annex III, and from 2 August 2028 for AI systems classified as high-risk pursuant to Article 6(1) and Annex I (Article 113, third paragraph, point (c), as amended by Regulation (EU) 2026/1744). They do not apply to high-risk AI systems related to products under Section B of Annex I (Article 2(2), as replaced).
Which items answer an actual AI Act duty?
Article 4. As replaced by Regulation (EU) 2026/1744, Article 4(1) requires providers and deployers of AI systems to "take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf". The measures take into account those persons' technical knowledge, experience, education and training, the context of use and the persons the systems are used on.
The obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". Article 4 has applied since 2 February 2025 (Article 113, third paragraph, point (a)), in this wording since 27 July 2026 (Article 4 of Regulation (EU) 2026/1744). Nothing in it requires you to publish; a published approach is evidence that measures exist. The AI literacy guide covers the article in full.
Article 50. Providers design a system intended to interact directly with people so that they are informed they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person in the circumstances and context of use (Article 50(1)). A system generating synthetic audio, image, video or text has its outputs marked in a machine-readable format and detectable as artificially generated or manipulated (Article 50(2)). Deployers inform people exposed to emotion recognition or biometric categorisation (Article 50(3)) and disclose deep fakes and AI-generated text published to inform the public on matters of public interest (Article 50(4)).
Each paragraph carries exceptions of its own; the four Article 50 disclosures sets them out. Article 50 has applied since 2 August 2026 (Article 113, second paragraph). A provider whose synthetic-content system was placed on the market before that date has until 2 December 2026 for Article 50(2) (Article 111(4), as added by Regulation (EU) 2026/1744).
Article 13, for providers of high-risk systems: "High-risk AI systems shall be accompanied by instructions for use in an appropriate digital format or otherwise that include concise, complete, correct and clear information that is relevant, accessible and comprehensible to deployers" (Article 13(2)), from the dates above.
Everything else on the page is a customer expectation: the register summary, the AI use policy, the security overview and the Trust Center itself. How to write an AI use policy covers what a policy can carry. The sub-processor list and the DPA come from data protection law, which this guide does not cover.
How do you keep a Trust Center current?
Date every item and name the version of the law it was written against. When the law changes, re-read the items that cite the changed provision; the Article 4 replacement of 27 July 2026 is the case in point.
Keep the page and your questionnaire answers in step: a control you answered as Planned cannot appear as done on the Trust Center. Questionnaire, audit or Trust Center covers how the three draw on one record.
What this means for you
If you're a provider: publish how each system meets Article 50(1) and (2) and where the notice appears. For a high-risk system, make sure the Article 13 instructions for use reach its deployers with the system, and keep the technical documentation for the authorities and notified bodies it is written for.
If you're a deployer: your page shows your Article 4 measures and, where they reach you, your Article 50(3) and (4) disclosures. If you deploy a high-risk system, Article 26 applies to you from the dates above, and your own customers may ask about it.
FAQ
Is an AI Trust Center required by the EU AI Act? No. The Act does not mention one. It sends information to named recipients instead: instructions for use to the deployers of a high-risk system (Article 13(2)), transparency information to the persons concerned (Article 50(5)), and technical documentation to authorities and notified bodies (Article 11(1), second subparagraph, as replaced). A Trust Center is your choice.
Should we publish our risk classifications? For each system, publish the class a person confirmed, the article it rests on and the date. Publishing them on your own page is not an AI Act duty; registration in the EU database under Article 49 is a separate one. Say plainly that each classification is your own assessment, and update it when a system or the law changes.
Does a Trust Center page count as our Article 50 notice? No. Article 50(5) requires the information to reach the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure. That happens where the person meets the system or its content. The Trust Center describes where each notice appears: it is evidence, not the notice.
What should stay behind a request? Penetration test reports, detailed security documents and the technical documentation of a high-risk system, which Article 11(1), second subparagraph, as replaced, draws up for national competent authorities and notified bodies, not customers. Release gated documents to a named person after approval for a limited time, and record who received what.
Sources: Regulation (EU) 2024/1689 (EUR-Lex), Article 2(2), Article 4, Article 5, Article 6, Article 11, Article 13, Article 15, Article 25, Article 26, Article 49, Article 50, Article 71, Article 111, Article 113, Annex I, Annex III and Annex IV; as amended by Regulation (EU) 2026/1744 (EUR-Lex), which replaced Article 2(2), Article 4, the second subparagraph of Article 11(1), the first subparagraph of Article 25(4) and Article 113, third paragraph, points (a) and (c); it also added Article 111(4); it entered into force on 27 July 2026 (its Article 4).
Where this question meets the product: what counts as evidence for each requirement. Answering it in a customer's questionnaire: how to answer AI questions in a supplier questionnaire. The feature that does this in the app: AI Act technical documentation software. Tools ranked on it: Best Annex IV documentation software. Everything else: every live Complipath feature.
How Complipath helps
Complipath turns each confirmed classification into the requirements it brings, each with an owner, a status and the date it applies from, and drafts the Annex IV documentation from your register. What we do best, from that same record: customer questionnaires, customer audits and a Trust Center. It is done for you: send two files you already have, and you confirm.