  The proposed European Artificial Intelligence Act (AIA) is the first attempt
to elaborate a general legal framework for AI carried out by any major global
economy. As such, the AIA is likely to become a point of reference in the
larger discourse on how AI systems can (and should) be regulated. In this
article, we describe and discuss the two primary enforcement mechanisms
proposed in the AIA: the conformity assessments that providers of high-risk AI
systems are expected to conduct, and the post-market monitoring plans that
providers must establish to document the performance of high-risk AI systems
throughout their lifetimes. We argue that AIA can be interpreted as a proposal
to establish a Europe-wide ecosystem for conducting AI auditing, albeit in
other words. Our analysis offers two main contributions. First, by describing
the enforcement mechanisms included in the AIA in terminology borrowed from
existing literature on AI auditing, we help providers of AI systems understand
how they can prove adherence to the requirements set out in the AIA in
practice. Second, by examining the AIA from an auditing perspective, we seek to
provide transferable lessons from previous research about how to refine further
the regulatory approach outlined in the AIA. We conclude by highlighting seven
aspects of the AIA where amendments (or simply clarifications) would be
helpful. These include, above all, the need to translate vague concepts into
verifiable criteria and to strengthen the institutional safeguards concerning
conformity assessments based on internal checks.
