REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)
Showing 317 controls
5.1.a
the placing on the market, the putting into service or the use of an AI system that deploys subliminal techniques beyond a person’s consciousness or purposefully manipulative or deceptive techniques,...
5.1.b
the placing on the market, the putting into service or the use of an AI system that exploits any of the vulnerabilities of a person or a specific group of persons due to their age, disability or a spe...
5.1.c
the placing on the market, the putting into service or the use of AI systems for the purpose of the evaluation or classification of natural persons or groups of persons over a certain period of time...
5.1.c.i
detrimental or unfavourable treatment of certain natural persons or whole groups of persons in social contexts that are unrelated to the contexts in which the data was originally generated or collecte...
5.1.c.ii
detrimental or unfavourable treatment of certain natural persons or groups of persons that is unjustified or disproportionate to their social behaviour or its gravity;
5.1.d
the placing on the market, the putting into service for this specific purpose, or the use of an AI system for making risk assessments of natural persons in order to assess or predict the likelihood of...
5.1.e
the placing on the market, the putting into service for this specific purpose, or use of AI systems that create or expand facial recognition databases through the untargeted scraping of facial images...
5.1.f
the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, exce...
5.1.g
the placing on the market, the putting into service for this specific purpose, or the use of biometric categorisation systems that categorise individually natural persons based on their biometric data...
5.1.h
the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement, unless and in so far as such use is strictly necessary for one of the...
5.1.h.i
the targeted search for specific victims of abduction, trafficking in human beings or sexual exploitation of human beings, as well as searching for missing persons;
5.1.h.ii
the prevention of a specific, substantial and imminent threat to the life or physical safety of natural persons or a genuine and present or genuine and foreseeable threat of a terrorist attack;
5.1.h.iii
the localisation or identification of a person suspected of having committed a criminal offence, for the purpose of conducting a criminal investigation, prosecution or executing a criminal penalty for...
5.2
The use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement for any of the objectives referred to in paragraph 1, point (h), shall...
5.2.a
the nature of the situation giving rise to the possible use, in particular the seriousness, probability and scale of the harm that would be caused if the system were not used;
5.2.b
the consequences of the use of the system for the rights and freedoms of all persons concerned, in particular the seriousness, probability and scale of those consequences.
5.3
For the purposes of paragraph 1, point (h) and paragraph 2, each use for the purposes of law enforcement of a ‘real-time’ remote biometric identification system in publicly accessible spaces shall be...
5.4
Without prejudice to paragraph 3, each use of a ‘real-time’ remote biometric identification system in publicly accessible spaces for law enforcement purposes shall be notified to the relevant market s...
10.2
Training, validation and testing data sets shall be subject to data governance and management practices appropriate for the intended purpose of the high-risk AI system. Those practices shall concern i...
10.2.a
the relevant design choices;
10.2.b
data collection processes and the origin of data, and in the case of personal data, the original purpose of the data collection;
10.2.c
relevant data-preparation processing operations, such as annotation, labelling, cleaning, updating, enrichment and aggregation;
10.2.d
the formulation of assumptions, in particular with respect to the information that the data are supposed to measure and represent;
10.2.e
an assessment of the availability, quantity and suitability of the data sets that are needed;
10.2.f
examination in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited under Union law, es...
10.2.g
appropriate measures to detect, prevent and mitigate possible biases identified according to point (f);
10.2.h
the identification of relevant data gaps or shortcomings that prevent compliance with this Regulation, and how those gaps and shortcomings can be addressed.
10.3
Training, validation and testing data sets shall be relevant, sufficiently representative, and to the best extent possible, free of errors and complete in view of the intended purpose. They shall have...
10.4
Data sets shall take into account, to the extent required by the intended purpose, the characteristics or elements that are particular to the specific geographical, contextual, behavioural or function...
10.5
To the extent that it is strictly necessary for the purpose of ensuring bias detection and correction in relation to the high-risk AI systems in accordance with paragraph (2), points (f) and (g) of th...
10.5.a
the bias detection and correction cannot be effectively fulfilled by processing other data, including synthetic or anonymised data;
10.5.b
the special categories of personal data are subject to technical limitations on the re-use of the personal data, and state of the art security and privacy-preserving measures, including pseudonymisati...
10.5.c
the special categories of personal data are subject to measures to ensure that the personal data processed are secured, protected, subject to suitable safeguards, including strict controls and documen...
10.5.d
the personal data in the special categories of personal data are not to be transmitted, transferred or otherwise accessed by other parties;
10.5.e
the personal data in the special categories of personal data are deleted once the bias has been corrected or the personal data has reached the end of its retention period, whichever comes first;
10.5.f
the records of processing activities pursuant to Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680include the reasons why the processing of special categories of personal data w...
10.6
For the development of high-risk AI systems not using techniques involving the training of AI models, paragraphs 2 to 5 apply only to the testing data sets.
11.1
The technical documentation of a high-risk AI system shall be drawn up before that system is placed on the market or put into service and shall be kept up-to date. The technical documentation shall be...
11.2
Where a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section A of Annex I is placed on the market or put into service, a single set of technical do...
12.1
High-risk AI systems shall technically allow for the automatic recording of events (‘logs’) over their lifetime.
12.2
In order to ensure a level of traceability of the functioning of a high-risk AI system that is appropriate to the intended purpose of the system, logging capabilities shall enable the recording of ev...
12.2.a
identifying situations that may result in the high-risk AI system presenting a risk within the meaning of Article 79(1) or in a substantial modification;
12.2.b
facilitating the post-market monitoring referred to in Article 72; and
12.2.c
monitoring the operation of high-risk AI systems referred to in Article 26(6).
12.3
For high-risk AI systems referred to in point 1 (a) of Annex III, the logging capabilities shall provide, at a minimum:
12.3.a
recording of the period of each use of the system (start date and time and end date and time of each use);
12.3.b
the reference database against which input data has been checked by the system;
12.3.c
the input data for which the search has led to a match;
12.3.d
the identification of the natural persons involved in the verification of the results, as referred to in Article 14(5).
13.1
High-risk AI systems shall be designed and developed in such a way as to ensure that their operation is sufficiently transparent to enable deployers to interpret a system’s output and use it appropria...
13.2
High-risk AI systems shall be accompanied by instructions for use in an appropriate digital format or otherwise that include concise, complete, correct and clear information that is relevant, accessib...
13.3
The instructions for use shall contain at least the following information:
13.3.a
the identity and the contact details of the provider and, where applicable, of its authorised representative;
13.3.b
the characteristics, capabilities and limitations of performance of the high-risk AI system, including:
13.3.b.i
its intended purpose;
13.3.b.ii
the level of accuracy, including its metrics, robustness and cybersecurity referred to in Article 15 against which the high-risk AI system has been tested and validated and which can be expected, and...
13.3.b.iii
any known or foreseeable circumstance, related to the use of the high-risk AI system in accordance with its intended purpose or under conditions of reasonably foreseeable misuse, which may lead to ris...
13.3.b.iv
where applicable, the technical capabilities and characteristics of the high- risk AI system to provide information that is relevant to explain its output;
13.3.b.v
when appropriate, its performance regarding specific persons or groups of persons on which the system is intended to be used;
13.3.b.vi
when appropriate, specifications for the input data, or any other relevant information in terms of the training, validation and testing data sets used, taking into account the intended purpose of the...
13.3.b.vii
where applicable, information to enable deployers to interpret the output of the high-risk AI system and use it appropriately;
13.3.c
the changes to the high-risk AI system and its performance which have been pre- determined by the provider at the moment of the initial conformity assessment, if any;
13.3.d
the human oversight measures referred to in Article 14, including the technical measures put in place to facilitate the interpretation of the outputs of the high-risk AI systems by the deployers;
13.3.e
the computational and hardware resources needed, the expected lifetime of the high-risk AI system and any necessary maintenance and care measures, including their frequency, to ensure the proper funct...
13.3.f
where relevant, a description of the mechanisms included within the high-risk AI system that allows deployers to properly collect, store and interpret the logs in accordance with Article 12.
14.1
High-risk AI systems shall be designed and developed in such a way, including with appropriate human-machine interface tools, that they can be effectively overseen by natural persons during the period...
14.2
Human oversight shall aim to prevent or minimise the risks to health, safety or fundamental rights that may emerge when a high-risk AI system is used in accordance with its intended purpose or under c...
14.3
The oversight measures shall be commensurate to the risks, level of autonomy and context of use of the high-risk AI system, and shall be ensured through either one or both of the following types of me...
14.3.a
measures identified by the provider before placing the high-risk AI system on the market or putting it into service and that are appropriate to be implemented by the deployer.
14.3.b
measures identified and built, when technically feasible, into the high-risk AI system by the provider before it is placed on the market or put into service;
14.4
For the purpose of implementing paragraphs 1, 2 and 3, the high-risk AI system shall be provided to the user in such a way that natural persons to whom human oversight is assigned are enabled, as appr...
14.4.a
to properly understand the relevant capacities and limitations of the high-risk AI system and be able to duly monitor its operation, including in view of detecting and addressing anomalies, dysfunctio...
14.4.b
to remain aware of the possible tendency of automatically relying or over-relying on the output produced by a high-risk AI system (‘automation bias’), in particular for high-risk AI systems used to pr...
14.4.c
to correctly interpret the high-risk AI system’s output, taking into account, for example, the interpretation tools and methods available;
14.4.d
to decide, in any particular situation, not to use the high-risk AI system or to otherwise disregard, override or reverse the output of the high-risk AI system;
14.4.e
to intervene in the operation of the high-risk AI system or interrupt the system through a ‘stop’ button or a similar procedure that allows the system to come to a halt in a safe state.
14.5
For high-risk AI systems referred to in point 1(a) of Annex III, the measures referred to in paragraph 3 of this Article shall be such as to ensure that, in addition, no action or decision is taken by...
15.1
High-risk AI systems shall be designed and developed in such a way that they achieve an appropriate level of accuracy, robustness, and cybersecurity, and that they perform consistently in those respe...
15.3
The levels of accuracy and the relevant accuracy metrics of high-risk AI systems shall be declared in the accompanying instructions of use.
15.4
High-risk AI systems shall be as resilient as possible regarding errors, faults or inconsistencies that may occur within the system or the environment in which the system operates, in particular due t...
15.5
High-risk AI systems shall be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities.
16.a
ensure that their high-risk AI systems are compliant with the requirements set out in Section 2;
16.b
indicate on the high-risk AI system or, where that is not possible, on its packaging or its accompanying documentation, as applicable their name, registered trade name or registered trade mark, the ad...
16.c
have a quality management system in place which complies with Article 17;
16.d
keep the documentation referred to in Article 18;
16.e
when under their control, keep the logs automatically generated by their high-risk AI systems as referred to in Article 19;
16.f
ensure that the high-risk AI system undergoes the relevant conformity assessment procedure as referred to in Article 43, prior to its being placed on the market or put into service;
16.g
draw up an EU declaration of conformity in accordance with Article 47;
16.h
affix the CE marking to the high-risk AI system or, where that is not possible, on its packaging or its accompanying documentation, to indicate conformity with this Regulation, in accordance with Arti...
16.i
comply with the registration obligations referred to in Article 49(1);
16.j
take the necessary corrective actions and provide information as required in Article 20;
16.k
upon a reasoned request of a national competent authority, demonstrate the conformity of the high-risk AI system with the requirements set out in Section 2;
16.l
ensure that the high-risk AI system complies with accessibility requirements in accordance with Directives (EU) 2016/2102 and (EU) 2019/882.
17.1
Providers of high-risk AI systems shall put a quality management system in place that ensures compliance with this Regulation. That system shall be documented in a systematic and orderly manner in the...
17.1.a
a strategy for regulatory compliance, including compliance with conformity assessment procedures and procedures for the management of modifications to the high-risk AI system;
17.1.b
techniques, procedures and systematic actions to be used for the design, design control and design verification of the high-risk AI system;
17.1.c
techniques, procedures and systematic actions to be used for the development, quality control and quality assurance of the high-risk AI system;
17.1.d
examination, test and validation procedures to be carried out before, during and after the development of the high-risk AI system, and the frequency with which they have to be carried out;
17.1.e
technical specifications, including standards, to be applied and, where the relevant harmonised standards are not applied in full or do not cover all of the relevant requirements set out in Section 2,...
17.1.f
systems and procedures for data management, including data acquisition, data collection, data analysis, data labelling, data storage, data filtration, data mining, data aggregation, data retention and...
17.1.g
the risk management system referred to in Article 9;
17.1.h
the setting-up, implementation and maintenance of a post-market monitoring system, in accordance with Article 72;
17.1.i
procedures related to the reporting of a serious incident in accordance with Article 73;
17.1.j
the handling of communication with national competent authorities, other relevant authorities, including those providing or supporting the access to data, notified bodies, other operators, customers o...
17.1.k
systems and procedures for record-keeping of all relevant documentation and information;
17.1.l
resource management, including security-of-supply related measures;
17.1.m
an accountability framework setting out the responsibilities of the management and other staff with regard to all the aspects listed in this paragraph.
17.2
The implementation of the aspects referred to in paragraph 1 shall be proportionate to the size of the provider’s organisation. Providers shall in any event comply with the degree of rigour and the le...
17.3
Providers of high-risk AI systems that are subject to obligations regarding quality management systems or an equivalent function under relevant sectorial Union law may include the aspects listed in pa...
17.4
For providers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law, the obligation to put in place...
18.1
The provider shall, for a period ending 10 years after the high-risk AI system has been placed on the market or put into service, keep at the disposal of the national competent authorities:
18.1.a
the technical documentation referred to in Article 11;
18.1.b
the documentation concerning the quality management system referred to in Article 17;
18.1.c
the documentation concerning the changes approved by notified bodies, where applicable;
18.1.d
the decisions and other documents issued by the notified bodies, where applicable;
18.1.e
the EU declaration of conformity referred to in Article 47.
18.3
Providers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law shall maintain the technical documen...
20.1
Providers of high-risk AI systems which consider or have reason to consider that a high- risk AI system that they have placed on the market or put into service is not in conformity with this Regulatio...
20.2
Where the high-risk AI system presents a risk within the meaning of Article 79(1) and the provider becomes aware of that risk, it shall immediately investigate the causes, in collaboration with the re...
21.1
Providers of high-risk AI systems shall, upon a reasoned request by a competent authority, provide that authority all the information and documentation necessary to demonstrate the conformity of the...
21.2
Upon a reasoned request by a national competent authority, providers shall also give the requesting national competent authority, as applicable, access to the automatically generated logs of the high-...
22.1
Prior to making their high-risk AI systems available on the Union market, providers established in third countries shall, by written mandate, appoint an authorised representative which is established...
22.2
The provider shall enable its authorised representative to perform the tasks specified in the mandate received from the provider.
22.3
The authorised representative shall perform the tasks specified in the mandate received from the provider. It shall provide a copy of the mandate to the market surveillance authorities upon request, i...
22.3.a
verify that the EU declaration of conformity and the technical documentation referred to in Article 11 have been drawn up and that an appropriate conformity assessment procedure has been carried out b...
22.3.b
keep at the disposal of the national competent authorities and national authorities or bodies referred to in Article 74(10), for a period of 10 years after the high-risk AI system has been placed on t...
22.3.c
provide a national competent authority, upon a reasoned request, with all the information and documentation, including that referred to in point (b) of this subparagraph, necessary to demonstrate the...
22.3.d
cooperate with competent authorities, upon a reasoned request, in any action the latter take in relation to the high-risk AI system, in particular to reduce and mitigate the risks posed by the high-r...
22.3.e
where applicable, comply with the registration obligations referred in Article 49(1), or, if the registration is carried out by the provider itself, ensure that the information referred to in Section...
22.4
The authorised representative shall terminate the mandate if it considers or has reason to consider the provider to be acting contrary to its obligations pursuant to this Regulation. In such a case, i...
23.1
Before placing a high-risk AI system on the market, importers shall ensure that the system is in conformity with this Regulation by verifying that:
23.1.a
the relevant conformity assessment procedure referred to in Article 43 has been carried out by the provider of the high-risk AI system;
23.1.b
the provider has drawn up the technical documentation in accordance with Article 11 and Annex IV;
23.1.c
the system bears the required CE marking and is accompanied by the EU declaration of conformity and instructions for use;
23.1.d
the provider has appointed an authorised representative in accordance with Article 22(1)
23.2
Where an importer has sufficient reason to consider that a high-risk AI system is not in conformity with this Regulation, or is falsified, or accompanied by falsified documentation, it shall not place...
23.3
Importers shall indicate their name, registered trade name or registered trade mark, and the address at which they can be contacted in relation to the high-risk AI system on its packaging or its accom...
23.4
Importers shall ensure that, while a high-risk AI system is under their responsibility, storage or transport conditions, where applicable, do not jeopardise its compliance with the requirements set ou...
23.5
Importers shall keep, for a period of 10 years after the high-risk AI system has been placed on the market or put into service, a copy of the certificate issued by the notified body, where applicable,...
23.6
Importers shall provide national competent authorities, upon a reasoned request, with all the necessary information and documentation, including that kept in accordance with paragraph 5, to demonstrat...
23.7
Importers shall cooperate with national competent authorities in any action those authorities take in relation to a high-risk AI system the importers placed on the market, in particular to reduce and...
24.1
Before making a high-risk AI system available on the market, distributors shall verify that it bears the required CE marking, that it is accompanied by a copy of EU declaration of conformity and instr...
24.2
Where a distributor considers or has reason to consider, on the basis of the information in its possession, a high-risk AI system not to be in conformity with the requirements set out in Section 2, it...
24.3
Distributors shall ensure that, while a high-risk AI system is under their responsibility, where applicable, storage or transport conditions do not jeopardise the compliance of the system with the req...
24.4
A distributor that considers or has reason to consider, on the basis of the information in its possession, a high-risk AI system which it has made available on the market not to be in conformity with...
24.5
Upon a reasoned request from a national competent authority, distributors of a high-risk AI system shall provide that authority with all the information and documentation regarding its actions pursuan...
24.6
Distributors shall cooperate with national competent authorities in any action those authorities take in relation to a high-risk AI system they made available on the market, in particular to reduce or...
25.1
Any distributor, importer, deployer or other third-party shall be considered to be a provider of a high-risk AI system for the purposes of this Regulation and shall be subject to the obligations of th...
25.1.a
they put their name or trademark on a high-risk AI system already placed on the market or put into service, without prejudice to contractual arrangements stipulating that the obligations therein are a...
25.1.b
they make a substantial modification to a high-risk AI system that has already been placed on the market or has already been put into service in such a way that it remains a high-risk AI system pursua...
25.1.c
they modify the intended purpose of an AI system, including a general-purpose AI system, which has not been classified as high-risk and has already been placed on the market or put into service in suc...
25.2
Where the circumstances referred to in paragraph 1 occur, the provider that initially placed the AI system on the market or put it into service shall no longer be considered to be a provider of that...
25.3
In the case of high-risk AI systems that are safety components of products covered by the Union harmonisation legislation listed in Section A of Annex I, the product manufacturer shall be considered t...
25.3.a
the high-risk AI system is placed on the market together with the product under the name or trademark of the product manufacturer;
25.3.b
the high-risk AI system is put into service under the name or trademark of the product manufacturer after the product has been placed on the mark
25.4
The provider of a high-risk AI system and the third party that supplies an AI system, tools, services, components, or processes that are used or integrated in a high-risk AI system shall, by written a...
26.1
Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems, pur...
26.10
Without prejudice to Directive (EU) 2016/680, in the framework of an investigation for the targeted search of a person suspected or convicted of having committed a criminal offence, the deployer of a...
26.11
Without prejudice to Article 50 of this Regulation, deployers of high-risk AI systems referred to in Annex III that make decisions or assist in making decisions related to natural persons shall inform...
26.12
Deployers shall cooperate with the relevant national competent authorities in any action those authorities take in relation to the high-risk AI system in order to implement this Regulation.
26.2
Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.
26.4
Without prejudice to paragraphs 1 and 2, to the extent the deployer exercises control over the input data, that deployer shall ensure that input data is relevant and sufficiently representative in vie...
26.5
Deployers shall monitor the operation of the high-risk AI system on the basis of the instructions for use and, where relevant, inform providers in accordance with Article 72. Where deployers have reas...
26.6
Deployers of high-risk AI systems shall keep the logs automatically generated by that high-risk AI system to the extent such logs are under their control, for a period appropriate to the intended pur...
26.7
Before putting into service or using a high-risk AI system at the workplace, deployers who are employers shall inform workers’ representatives and the affected workers that they will be subject to the...
26.8
Deployers of high-risk AI systems that are public authorities, or Union institutions, bodies, offices or agencies shall comply with the registration obligations referred to in Article 49. When such de...
26.9
Where applicable, deployers of high-risk AI systems shall use the information provided under Article 13 of this Regulation to comply with their obligation to carry out a data protection impact assessm...
27.1
Prior to deploying a high-risk AI system referred to in Article 6(2) into use, with the exception of high-risk AI systems intended to be used in the area listed in point 2 of Annex III, deployers that...
27.1.a
a description of the deployer’s processes in which the high-risk AI system will be used in line with its intended purpose;
27.1.b
a description of the period of time within which, and the frequency with which, each high-risk AI system is intended to be used;
27.1.c
the categories of natural persons and groups likely to be affected by its use in the specific context;
27.1.d
the specific risks of harm likely to have an impact on the categories of persons or groups of persons identified pursuant point (c) of this paragraph, taking into account the information given by the...
27.1.e
a description of the implementation of human oversight measures, according to the instructions for use;
27.1.f
the measures to be taken where those risks materialise, including the arrangements for internal governance and complaint mechanisms.
27.2
The obligation laid down in paragraph 1 applies to the first use of the high-risk AI system. The deployer may, in similar cases, rely on previously conducted fundamental rights impact assessments or e...
27.3
Once the assessment referred to in paragraph 1 of this Article has been performed, the deployer shall notify the market surveillance authority of its results, including filling-out and submitting the...
27.4
If any of the obligations laid down in this Article is already complied with as a result of the data protection impact assessment conducted pursuant to Article 35 of Regulation (EU) 2016/679 or Articl...
41.5
Where providers of high-risk AI systems do not comply with the common specifications referred to in paragraph 1, they shall duly justify that they have adopted technical solutions that meet the requir...
42.1
High-risk AI systems that have been trained and tested on data reflecting the specific geographical, behavioural, contextual or functional setting within which they are intended to be used shall be pr...
42.2
High-risk AI systems that have been certified or for which a statement of conformity has been issued under a cybersecurity scheme pursuant to Regulation (EU) 2019/881 and the references of which have...
43.1
For high-risk AI systems listed in point 1 of Annex III, where, in demonstrating the compliance of a high-risk AI system with the requirements set out in Section 2, the provider has applied harmonised...
43.1.a
the internal control referred to in Annex VI; or
43.1.b
he assessment of the quality management system and the assessment of the technical documentation, with the involvement of a notified body, referred to in Annex VII.
43.2
For high-risk AI systems referred to in points 2 to 8 of Annex III, providers shall follow the conformity assessment procedure based on internal control as referred to in Annex VI, which does not pro...
43.3
For high-risk AI systems covered by the Union harmonisation legislation listed in Section A of Annex I,,, the provider shall follow the relevant conformity assessment procedure as required under those...
43.4
High-risk AI systems that have already been subject to a conformity assessment procedure shall undergo a new conformity assessment procedure in the event of a substantial modification, regardless of w...
44.2
Certificates shall be valid for the period they indicate, which shall not exceed five years for AI systems covered by Annex I, and four years for AI systems covered by Annex III. On the application of...
44.3
Where a notified body finds that an AI system no longer meets the requirements set out in Section 2, it shall, taking account of the principle of proportionality, suspend or withdraw the certificate i...
46.7
For high-risk AI systems related to products covered by Union harmonisation legislation listed in Section A of Annex I, only the derogations from the conformity assessment established in that Union ha...
47.1
The provider shall draw up a written machine readable, physical or electronically signed EU declaration of conformity for each high-risk AI system, and keep it at the disposal of the national competen...
47.2
The EU declaration of conformity shall state that the high-risk AI system concerned meets the requirements set out in Section 2. The EU declaration of conformity shall contain the information set out...
47.3
Where high-risk AI systems are subject to other Union harmonisation legislation which also requires an EU declaration of conformity, a single EU declaration of conformity shall be drawn up in respect...
47.4
By drawing up the EU declaration of conformity, the provider shall assume responsibility for compliance with the requirements set out in Section 2. The provider shall keep the EU declaration of confor...
48.2
For high-risk AI systems provided digitally, a digital CE marking shall be used, only if it can easily be accessed via the interface from which that system is accessed or via an easily accessible mach...
48.3
The CE marking shall be affixed visibly, legibly and indelibly for high-risk AI systems. Where that is not possible or not warranted on account of the nature of the high-risk AI system, it shall be af...
48.4
Where applicable, the CE marking shall be followed by the identification number of the notified body responsible for the conformity assessment procedures set out in Article 43. The identification numb...
48.5
Where high-risk AI systems are subject to other Union law which also provides for the affixing of the CE marking, the CE marking shall indicate that the high-risk AI system also fulfil the requirement...
49.1
Before placing on the market or putting into service a high-risk AI system listed in Annex III, with the exception of high-risk AI systems referred to in point 2 of Annex III, the provider or, where a...
49.2
Before placing on the market or putting into service an AI system for which the provider has concluded that it is not high-risk according to Article 6(3), that provider or, where applicable, the autho...
49.3
Before putting into service or using a high-risk AI system listed in Annex III, with the exception of high-risk AI systems listed in point 2 of Annex III, deployers who are public authorities, agencie...
49.5
High-risk AI systems referred to in point 2 of Annex III shall be registered at national level.
6.1
Irrespective of whether an AI system is placed on the market or put into service independently from the products referred to in points (a) and (b), that AI system shall be considered to be high-risk w...
6.1.a
the AI system is intended to be used as a safety component of a product, or the AI system is itself a product, covered by the Union harmonisation legislation listed in Annex I;
6.1.b
the product whose safety component pursuant to point (a) is the AI system, or the AI system itself as a product, is required to undergo a third-party conformity assessment, with a view to the placing...
6.2
In addition to the high-risk AI systems referred to in paragraph 1, AI systems referred to in Annex III shall be considered to be high-risk.
6.3
By derogation from paragraph 2, an AI system shall not be considered to be high-risk if it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, incl...
6.3.a
the AI system is intended to perform a narrow procedural task;
6.3.b
the AI system is intended to improve the result of a previously completed human activity;
6.3.c
the AI system is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, witho...
6.3.d
the AI system is intended to perform a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III.
6.4
A provider who considers that an AI system referred to in Annex III is not high-risk shall document its assessment before that system is placed on the market or put into service. Such provider shall b...
8.1
High-risk AI systems shall comply with the requirements laid down in this Section, taking into account their intended purposes as well as the generally acknowledged state of the art on AI and AI-relat...
8.2
Where a product contains an AI system, to which the requirements of this Regulation as well as requirements of the Union harmonisation legislation listed in Section A of Annex I apply, providers shall...
9.1
A risk management system shall be established, implemented, documented and maintained in relation to high-risk AI systems.
9.10
For providers of high-risk AI systems that are subject to requirements regarding internal risk management processes under other relevant provisions of Union law, the aspects provided in paragraphs 1 t...
9.2
The risk management system shall be understood as a continuous iterative process planned and run throughout the entire lifecycle of a high-risk AI system, requiring regular systematic review and updat...
9.2.a
the identification and analysis of the known and the reasonably foreseeable risks that the high-risk AI system can pose to health, safety or fundamental rights when the high-risk AI system is used in...
9.2.b
the estimation and evaluation of the risks that may emerge when the high-risk AI system is used in accordance with its intended purpose, and under conditions of reasonably foreseeable misuse;
9.2.c
the evaluation of other risks possibly arising, based on the analysis of data gathered from the post-market monitoring system referred to in Article 72;
9.2.d
the adoption of appropriate and targeted risk management measures designed to address the risks identified pursuant to point (a) .
9.3
The risks referred to in this Article shall concern only those which may be reasonably mitigated or eliminated through the development or design of the high-risk AI system, or the provision of adequat...
9.4
The risk management measures referred to in paragraph 2, point (d), shall give due consideration to the effects and possible interaction resulting from the combined application of the requirements set...
9.5
The risk management measures referred to in paragraph 2, point (d), shall be such that the relevant residual risk associated with each hazard, as well as the overall residual risk of the high-risk AI...
9.5.a
elimination or reduction of identified and evaluated risks pursuant to paragraph 2 as far as technically feasible through adequate design and development of the high- risk AI system;
9.5.b
where appropriate, implementation of adequate mitigation and control measures addressing risks that cannot be eliminated;
9.5.c
provision of information required pursuant to Article 13 and, where appropriate, training to deployers.
9.6
High-risk AI systems shall be tested for the purpose of identifying the most appropriate and targeted risk management measures. Testing shall ensure that high-risk AI systems perform consistently for...
9.7
Testing procedures may include testing in real-world conditions in accordance with Article 60.
9.8
The testing of high-risk AI systems shall be performed, as appropriate, at any time throughout the development process, and, in any event, prior to their being placed on the market or put into service...
9.9
When implementing the risk management system as provided for in paragraphs 1 to 7, providers shall give consideration to whether in view of its intended purpose the high-risk AI system is likely to ha...
a
harmonised standards referred to in Article 40 do not exist, and common specifications referred to in Article 41 are not available;
b
the provider has not applied, or has applied only part of, the harmonised standard;
c
the common specifications referred to in point (a) exist, but the provider has not applied them;
d
one or more of the harmonised standards referred to in point (a) has been published with a restriction, and only on the part of the standard that was restricted.
50.1
Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interac...
50.2
Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable...
50.3
Deployers of an emotion recognition system or a biometric categorisation system shall inform the natural persons exposed thereto of the operation of the system, and shall process the personal data in...
50.4
Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated. This obl...
50.5
The information referred to in paragraphs 1 to 4 shall be provided to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure...
72.1
Providers shall establish and document a post-market monitoring system in a manner that is proportionate to the nature of the AI technologies and the risks of the high-risk AI system.
72.2
The post-market monitoring system shall actively and systematically collect, document and analyse relevant data which may be provided by deployers or which may be collected through other sources on th...
72.4
For high-risk AI systems covered by the Union harmonisation legislation listed in Section A of Annex I, where a post-market monitoring system and plan are already established under that legislation, i...
73.1
Providers of high-risk AI systems placed on the Union market shall report any serious incident to the market surveillance authorities of the Member States where that incident occurred.
73.10
For high-risk AI systems referred to in Annex III that are placed on the market or put into service by providers that are subject to Union legislative instruments laying down reporting obligations eq...
73.11
For high-risk AI systems which are safety components of devices, or are themselves devices, covered by Regulations (EU) 2017/745 and (EU) 2017/746, the notification of serious incidents shall be limit...
73.2
The report referred to in paragraph 1 shall be made immediately after the provider has established a causal link between the AI system and the serious incident or the reasonable likelihood of such a...
73.3
Notwithstanding paragraph 2 of this Article, in the event of a widespread infringement or a serious incident as defined in Article 3, point (44) (b), the report referred to in paragraph 1 of this Arti...
73.5
Notwithstanding paragraph 2, in the event of the death of a person, the report shall be provided immediately after the provider or the deployer has established, or as soon as it suspects, a causal rel...
73.6
Where necessary to ensure timely reporting, the provider or, where applicable, the deployer, may submit an initial report that is incomplete, followed by a complete report.
73.7
Following the reporting of a serious incident pursuant to paragraph 1, the provider shall, without delay, perform the necessary investigations in relation to the serious incident and the AI system con...
80.4
The provider shall ensure that all necessary action is taken to bring the AI system into compliance with the requirements and obligations laid down in this Regulation. Where the provider of an AI syst...
80.5
The provider shall ensure that all appropriate corrective action is taken in respect of all the AI systems concerned that it has made available on the Union market.
80.6
The provider shall ensure that all appropriate corrective action is taken in respect of all the AI systems concerned that it has made available on the Union market.
82.2
The provider or other relevant operator shall ensure that corrective action is taken in respect of all the AI systems concerned that it has made available on the Union market within the timeline presc...
83.1.a
Where the market surveillance authority of a Member State makes one of the following findings, it shall require the relevant provider to put an end to the non-compliance concerned, within a period it...
83.1.b
a CE marking has not been affixed;
83.1.c
a EU declaration of conformity has not been drawn up;
83.1.d
a EU declaration of conformity has not been drawn up correctly;
83.1.e
registration in the EU database has not been carried out;
83.1.f
where applicable, an authorised representative has not been appointed;
83.1.g
technical documentation is not available.
91.5
The provider of the general-purpose AI model concerned, or its representative shall supply the information requested. In the case of legal persons, companies or firms, or where the provider has no leg...
92.5
The providers of the general-purpose AI model concerned and, in the case of legal persons, companies or firms, or where they have no legal personality, the persons authorised to represent them by law...
93.3
If, during the structured dialogue referred to in paragraph 2, the provider of the general- purpose AI model with systemic risk offers commitments to implement mitigation measures to address a systemi...
51.1
A general-purpose AI model shall be classified as a general-purpose AI model with systemic risk if it meets any of the following requirements:
51.2
A general-purpose AI model shall be presumed to have high impact capabilities pursuant to paragraph 1, point (a), when the cumulative amount of computation used for its training measured in FLOPs is g...
52.1
Where a general-purpose AI model meets the requirement referred to in Article 51(1), point (a), the relevant provider shall notify the Commission without delay and in any event within two weeks after...
52.2
The provider of a general purpose AI model that meets the requirement referred to in Article 51(1), point (a), may present, with its notification, sufficiently substantiated arguments to demonstrate t...
53.1.a
draw up and keep up-to-date the technical documentation of the model, including its training and testing process and the results of its evaluation, which shall contain, at a minimum, the elements set...
53.1.b
draw up, keep up-to-date and make available information and documentation to providers of AI systems who intend to integrate the general-purpose AI model into their AI systems. Without prejudice to th...
53.1.b.i
enable providers of AI systems to have a good understanding of the capabilities and limitations of the general-purpose AI model and to comply with their obligations pursuant to this Regulation; and
53.1.b.ii
contain, at a minimum, the elements set out in Annex XII;
53.1.c
put in place a policy to comply with Union copyright law, and in particular to identify and comply with, including through state of the art technologies, a reservation of rights expressed pursuant to...
53.1.d
draw up and make publicly available a sufficiently detailed summary about the content used for training of the general-purpose AI model, according to a template provided by the AI Office.
53.2
The obligations set out in paragraph 1, points (a) and (b), shall not apply to providers of AI models that are released under a free and open licence that allows for the access, usage, modification, a...
53.3
Providers of general-purpose AI models shall cooperate as necessary with the Commission and the national competent authorities in the exercise of their competences and powers pursuant to this Regulati...
53.4
Providers of general-purpose AI models may rely on codes of practice within the meaning of Article 56 to demonstrate compliance with the obligations set out in paragraph 1 of this Article, until a har...
54.1
Prior to placing a general-purpose AI model on the Union market, providers established in third countries shall, by written mandate, appoint an authorised representative which is established in the Un...
54.2
The provider shall enable its authorised representative to perform the tasks specified in the mandate received from the provider.
54.3
The authorised representative shall perform the tasks specified in the mandate received from the provider. It shall provide a copy of the mandate to the AI Office upon request, in one of the official...
54.3.a
verify that the technical documentation specified in Annex XI has been drawn up and all obligations referred to in Articles 53 and, where applicable, Article 55 have been fulfilled by the provider;
54.3.b
keep a copy of the technical documentation specified in Annex XI at the disposal of the AI Office and national competent authorities, for a period of 10 years after the general-purpose AI model has be...
54.3.c
provide the AI Office, upon a reasoned request, with all the information and documentation, including that referred to in point (b), necessary to demonstrate its compliance with the obligations in thi...
54.3.d
cooperate with the AI Office and national competent authorities, upon a reasoned request, in any action the latter take in relation to a general-purpose AI model with systemic risks, including when th...
54.4
The mandate shall empower the authorised representative to be addressed, in addition to or instead of the provider, by the AI Office or the national competent authorities, on all issues related to ens...
54.5
The authorised representative shall terminate the mandate if it considers or has reason to consider the provider to be acting contrary to its obligations pursuant to this Regulation. In such a case, i...
54.6
The obligation set out in this Article shall not apply to providers of general-purpose AI models that are released under a free and open source licence that allows for the access, usage, modification,...
55.1
In addition to the obligations listed in Article 53, providers of general-purpose AI models with systemic risk shall:
55.1.a
perform model evaluation in accordance with standardised protocols and tools reflecting the state-of-the-art, including conducting and documenting adversarial testing of the model with a view to ident...
55.1.b
assess and mitigate possible systemic risks at Union level, including their sources, that may stem from the development, the placing on the market, or the use of general-purpose AI models with systemi...
55.1.c
keep track of, document and report without undue delay to the AI Office and, as appropriate, to national competent authorities, relevant information about serious incidents and possible corrective mea...
55.1.d
ensure an adequate level of cybersecurity protection for the general-purpose AI model with systemic risk and the physical infrastructure of the model.
55.2
Providers of general-purpose AI models with systemic risk may rely on codes of practice within the meaning of Article 56 to demonstrate compliance with the obligations set out in paragraph 1 of this A...
55.3
Any information or documentation obtained pursuant to this Article, including trade secrets, shall be treated in compliance with the confidentiality obligations set out in Article 78.
56.7
The AI Office may invite all providers of general-purpose AI models to adhere to the codes of practice. For providers of general-purpose AI models not presenting systemic risks this adherence may be l...
59.1
Personal data lawfully collected for other purposes may be processed in an AI regulatory sandbox solely for the purpose of developing, training and testing certain AI systems in the sandbox when all...
59.1.d
any personal data to be processed in the context of the sandbox are in a functionally separate, isolated and protected data processing environment under the control of the prospective provider and onl...
59.1.e
providers can further share the originally collected data only in compliance with Union data protection law; any personal data crated in the sandbox cannot be shared outside the sandbox;
60.1
Testing of high-risk AI systems in real world conditions outside AI regulatory sandboxes may be conducted by providers or prospective providers of high-risk AI systems listed in Annex III, in accordan...
60.2
Providers or prospective providers may conduct testing of high-risk AI systems referred to in Annex III in real world conditions at any time before the placing on the market or the putting into servic...
60.4
Providers or prospective providers may conduct the testing in real world conditions only where all of the following conditions are met:
60.4.a
the provider or prospective provider has drawn up a real-world testing plan and submitted it to the market surveillance authority in the Member State where the testing in real world conditions is to b...
60.4.b
the market surveillance authority in the Member State where the testing in real world conditions is to be conducted has approved the testing in real world conditions and the real-world testing plan. W...
60.4.c
the provider or prospective provider, with the exception of providers or prospective providers of high-risk AI systems referred to in points 1, 6 and 7 of Annex III in the areas of law enforcement, mi...
60.4.d
the provider or prospective provider conducting the testing in real world conditions is established in the Union or has appointed a legal representative who is established in the Union;
60.4.e
data collected and processed for the purpose of the testing in real world conditions shall be transferred to third countries only provided that appropriate and applicable safeguards under Union law ar...
60.4.f
the testing in real world conditions does not last longer than necessary to achieve its objectives and in any case not longer than six months, which may be extended for an additional period of six mon...
60.4.g
subjects of the testing in real world conditions who are vulnerable persons due to their age, physical or mental disability, are appropriately protected;
60.4.h
where a provider or prospective provider organises the testing in real world conditions in cooperation with one or more deployers or prospective deployers, the latter have been informed of all aspects...
60.4.i
the subjects of the testing in real world conditions have given informed consent in accordance with Article 61, or in the case of law enforcement, where the seeking of informed consent would prevent t...
60.4.j
the testing in real world conditions is effectively overseen by the provider or prospective provider, as well as by deployers or prospective deployers through persons who are suitably qualified in the...
60.4.k
the predictions, recommendations or decisions of the AI system can be effectively reversed and disregarded.
60.7
Any serious incident identified in the course of the testing in real world conditions shall be reported to the national market surveillance authority in accordance with Article 73. The provider or pro...
60.8
Providers or prospective providers shall notify the national market surveillance authority in the Member State where the testing in real world conditions is to be conducted of the suspension or termin...
60.9
The provider or prospective provider shall be liable under applicable Union and national liability law for any damage caused in the course of their testing in real world conditions.
71.2
The data listed in Section A of Annex VIII shall be entered into the EU database by the provider or, where applicable, by the authorised representative.
71.3
The data listed in Section C of Annex VIII shall be entered into the EU database by the deployer who is, or who acts on behalf of, a public authority, agency or body, in accordance with Articles 49(2)...