### (9) for the purposes of this regulation the notion of publicly accessible space should be understood as referring to any physical place that is accessible to the public , irrespective of whether the place in question is privately or publicly owned. therefore , the notion does not cover places that are private in nature and normally not freely accessible for third parties , including law enforcement authorities , unless those parties have been specifically invited or authorised , such as homes , private clubs , offices , warehouses and factories. online spaces are not covered either , as they are not physical spaces. however , the mere fact that certain conditions for accessing a particular space may apply , such as admission tickets or age restrictions , does not mean that the space is not publicly accessible within the meaning of this regulation. consequently , in addition to public spaces such as streets , relevant parts of government buildings and most transport infrastructure , spaces such as cinemas , theatres , shops and shopping centres are normally also publicly accessible. whether a given space is accessible to the public should however be determined on a case-by-case basis , having regard to the specificities of the individual situation at hand. ### (9) for the purposes of this regulation the notion of publicly accessible space should be understood as referring to any physical place that is accessible to the public , irrespective of whether the place in question is privately or publicly owned. therefore , the notion does not cover places that are private in nature and normally not freely accessible for third parties , including law enforcement authorities , unless those parties have been specifically invited or authorised , such as homes , private clubs , offices , warehouses and factories. online spaces are not covered either , as they are not physical spaces. however , the mere fact that certain conditions for accessing a particular space may apply , such as admission tickets or age restrictions , does not mean that the space is not publicly accessible within the meaning of this regulation. consequently , in addition to public spaces such as streets , relevant parts of government buildings and most transport infrastructure , spaces such as cinemas , theatres , shops , museums , monuments , cultural places , cultural institutions and shopping centres are normally also publicly accessible. whether a given space is accessible to the public should however be determined on a case-by-case basis , having regard to the specificities of the individual situation at hand.


### (9) for the purposes of this regulation the notion of publicly accessible space should be understood as referring to any physical place that is accessible to the public , irrespective of whether the place in question is privately or publicly owned. therefore , the notion does not cover places that are private in nature and normally not freely accessible for third parties , including law enforcement authorities , unless those parties have been specifically invited or authorised , such as homes , private clubs , offices , warehouses and factories. online spaces are not covered either , as they are not physical spaces. however , the mere fact that certain conditions for accessing a particular space may apply , such as admission tickets or age restrictions , does not mean that the space is not publicly accessible within the meaning of this regulation. consequently , in addition to public spaces such as streets , relevant parts of government buildings and most transport infrastructure , spaces such as cinemas , theatres , shops and shopping centres are normally also publicly accessible. whether a given space is accessible to the public should however be determined on a case-by-case basis , having regard to the specificities of the individual situation at hand. ### (9) for the purposes of this regulation the notion of publicly accessible space should be understood as referring to any physical place that is accessible to the public , irrespective of whether the place in question is privately or publicly owned. therefore , the notion does not cover places that are private in nature and normally not freely accessible for third parties , including law enforcement authorities , unless those parties have been specifically invited or authorised , such as homes , private clubs , offices , warehouses , factories and other private spaces. online spaces , whether publicly accessible or not , are not covered either , as they are not physical spaces. however , the mere fact that certain conditions for accessing a particular space may apply , such as admission tickets or age restrictions , does not mean that the space is not publicly accessible within the meaning of this regulation. consequently , in addition to public spaces such as streets , relevant parts of government buildings and most transport infrastructure , spaces such as cinemas , theatres , shops and shopping centres are normally also publicly accessible. whether a given space is accessible to the public should however be determined on a case-by-case basis , having regard to the specificities of the individual situation at hand.


### (14) in order to introduce a proportionate and effective set of binding rules for ai systems , a clearly defined risk-based approach should be followed. that approach should tailor the type and content of such rules to the intensity and scope of the risks that ai systems can generate. it is therefore necessary to prohibit certain artificial intelligence practices , to lay down requirements for high-risk ai systems and obligations for the relevant operators , and to lay down transparency obligations for certain ai systems. ### (14) in order to introduce a proportionate and effective set of binding rules for ai systems , a clearly defined risk-based approach should be followed. that approach should tailor the type and content of such rules to the intensity and scope of the risks that ai systems can generate. it is therefore necessary to prohibit certain artificial intelligence practices , to lay down requirements for high-risk ai systems and obligations for the relevant operators , and to lay down transparency obligations for certain ai systems. however , it is important to distinguish between the parties who develop and make the system and those who promote or market the product.


### (14) in order to introduce a proportionate and effective set of binding rules for ai systems , a clearly defined risk-based approach should be followed. that approach should tailor the type and content of such rules to the intensity and scope of the risks that ai systems can generate. it is therefore necessary to prohibit certain artificial intelligence practices , to lay down requirements for high-risk ai systems and obligations for the relevant operators , and to lay down transparency obligations for certain ai systems. ### (14) in order to introduce a proportionate and effective set of binding rules for ai systems , a clearly defined risk-based approach should be followed. that approach should tailor the type and content of such rules to the intensity and scope of the risks that ai systems can generate for individuals and society , rather than depend on the type of technology. it is therefore necessary to prohibit certain artificial intelligence practices , to lay down requirements for high-risk ai systems and obligations for the relevant operators , and to lay down transparency obligations for certain ai systems.


### (16) the placing on the market , putting into service or use of certain ai systems intended to distort human behaviour , whereby physical or psychological harms are likely to occur , should be forbidden. such ai systems deploy subliminal components individuals cannot perceive or exploit vulnerabilities of children and people due to their age , physical or mental incapacities. they do so with the intention to materially distort the behaviour of a person and in a manner that causes or is likely to cause harm to that or another person. the intention may not be presumed if the distortion of human behaviour results from factors external to the ai system which are outside of the control of the provider or the user. research for legitimate purposes in relation to such ai systems should not be stifled by the prohibition , if such research does not amount to use of the ai system in human-machine relations that exposes natural persons to harm and such research is carried out in accordance with recognised ethical standards for scientific research. ### (16) the placing on the market , putting into service or use of certain ai systems materially distorting human behaviour , whereby physical or psychological harms are likely to occur , should be forbidden. such ai systems deploy subliminal components that persons cannot perceive or those systems otherwise exploit vulnerabilities of a specific group of persons due to their age , disability within the meaning of directive (eu) 2019/882 , or social or economic situation. such systems can be placed on the market , put into service or used with the objective to or the effect of materially distorting the behaviour of a person and in a manner that causes or is reasonably likely to cause physical or psychological harm to that or another person or groups of persons , including harms that may be accumulated over time. the intention to distort the behaviour may not be presumed if the distortion results from factors external to the ai system which are outside of the control of the provider or the user meaning factors that may not be reasonably foreseen and mitigated by the provider or the user of the ai system. in any case , it is not necessary for the provider or the user to have the intention to cause the physical or psychological harm , as long as such harm results from the manipulative or exploitative ai-enabled practices. the prohibitions for such ai practices is complementary to the provisions contained in directive [unfair commercial practice directive 2005/29/ec , as amended by directive (eu) 2019/216] , notably that unfair commercial practices leading to economic or financial harms to consumers are prohibited under all circumstances , irrespective of whether they are put in place through ai systems or otherwise.


### (16) the placing on the market , putting into service or use of certain ai systems intended to distort human behaviour , whereby physical or psychological harms are likely to occur , should be forbidden. such ai systems deploy subliminal components individuals cannot perceive or exploit vulnerabilities of children and people due to their age , physical or mental incapacities. they do so with the intention to materially distort the behaviour of a person and in a manner that causes or is likely to cause harm to that or another person. the intention may not be presumed if the distortion of human behaviour results from factors external to the ai system which are outside of the control of the provider or the user. research for legitimate purposes in relation to such ai systems should not be stifled by the prohibition , if such research does not amount to use of the ai system in human-machine relations that exposes natural persons to harm and such research is carried out in accordance with recognised ethical standards for scientific research. ### (16) the placing on the market , putting into service or use of certain ai systems intended to distort human behaviour , whereby with due diligence it could be predicted that physical or psychological harms are likely to occur , should be forbidden. such ai systems deploy subliminal components individuals cannot perceive or exploit vulnerabilities of children and people due to their age , physical or mental incapacities. they do so with the intention to materially distort the behaviour of a person and in a manner that causes or is likely to cause harm to that or another person. the intention may not be presumed if the distortion of human behaviour results from factors external to the ai system which are outside of the control of the provider or the user. research for legitimate purposes in relation to such ai systems should not be stifled by the prohibition , if such research does not amount to use of the ai system in human-machine relations that exposes natural persons to harm and such research is carried out in accordance with recognised ethical standards for scientific research.


### (28) ai systems could produce adverse outcomes to health and safety of persons , in particular when such systems operate as components of products. consistently with the objectives of union harmonisation legislation to facilitate the free movement of products in the internal market and to ensure that only safe and otherwise compliant products find their way into the market , it is important that the safety risks that may be generated by a product as a whole due to its digital components , including ai systems , are duly prevented and mitigated. for instance , increasingly autonomous robots , whether in the context of manufacturing or personal assistance and care should be able to safely operate and performs their functions in complex environments. similarly , in the health sector where the stakes for life and health are particularly high , increasingly sophisticated diagnostics systems and systems supporting human decisions should be reliable and accurate. the extent of the adverse impact caused by the ai system on the fundamental rights protected by the charter is of particular relevance when classifying an ai system as high-risk. those rights include the right to human dignity , respect for private and family life , protection of personal data , freedom of expression and information , freedom of assembly and of association , and non-discrimination , consumer protection , workers’ rights , rights of persons with disabilities , right to an effective remedy and to a fair trial , right of defence and the presumption of innocence , right to good administration. in addition to those rights , it is important to highlight that children have specific rights as enshrined in article 24 of the eu charter and in the united nations convention on the rights of the child (further elaborated in the uncrc general comment no. 25 as regards the digital environment) , both of which require consideration of the children’s vulnerabilities and provision of such protection and care as necessary for their well-being. the fundamental right to a high level of environmental protection enshrined in the charter and implemented in union policies should also be considered when assessing the severity of the harm that an ai system can cause , including in relation to the health and safety of persons. ### (28) ai systems could produce adverse outcomes to health and safety of persons , in particular when such systems operate as components of products. consistently with the objectives of union harmonisation legislation to facilitate the free movement of products in the internal market and to ensure that only safe and otherwise compliant products find their way into the market , it is important that the safety risks that may be generated by a product as a whole due to its digital components , including ai systems , are duly prevented and mitigated. for instance , increasingly autonomous robots , whether in the context of manufacturing or personal assistance and care should be able to safely operate and performs their functions in complex environments. similarly , in the health sector where the stakes for life and health are particularly high , increasingly sophisticated diagnostics systems and systems supporting human decisions should be reliable and accurate. the extent of the adverse impact caused by the ai system on the fundamental rights protected by the charter is of particular relevance when classifying an ai system as high-risk. those rights include the right to human dignity , respect for private and family life , protection of personal and health data , freedom of expression and information , freedom of assembly and of association , and non-discrimination , consumer protection , workers’ rights , rights of persons with disabilities , right to an effective remedy and to a fair trial , right of defence and the presumption of innocence , right to good administration. in addition to those rights , it is important to highlight that children have specific rights as enshrined in article 24 of the eu charter and in the united nations convention on the rights of the child (further elaborated in the uncrc general comment no. 25 as regards the digital environment) , both of which require consideration of the children’s vulnerabilities and provision of such protection and care as necessary for their well-being. the fundamental right to a high level of environmental protection enshrined in the charter and implemented in union policies should also be considered when assessing the severity of the harm that an ai system can cause , including in relation to the health and safety of persons.


### (35) ai systems used in education or vocational training , notably for determining access or assigning persons to educational and vocational training institutions or to evaluate persons on tests as part of or as a precondition for their education should be considered high-risk , since they may determine the educational and professional course of a person’s life and therefore affect their ability to secure their livelihood. when improperly designed and used , such systems may violate the right to education and training as well as the right not to be discriminated against and perpetuate historical patterns of discrimination. ### (35) ai systems used in education or vocational training , notably for determining access or assigning persons to educational and vocational training institutions or to evaluate persons on tests as part of or as a precondition for their education or for determining the course of study a student should follow should be considered high-risk , since they may determine the educational and professional course of a person’s life and therefore affect their ability to secure their livelihood. when improperly designed and used , such systems may violate the right to education and training as well as the right not to be discriminated against and perpetuate historical patterns of discrimination. ai systems used to monitor students’ behaviour and emotion during tests at education and training institutions should be considered high-risk , since they are also interfering with students’ rights to privacy and data protection. the use of ai to check fraud at test or exam , such as plagiarism , should not be consider as high-risk.


### (35) ai systems used in education or vocational training , notably for determining access or assigning persons to educational and vocational training institutions or to evaluate persons on tests as part of or as a precondition for their education should be considered high-risk , since they may determine the educational and professional course of a person’s life and therefore affect their ability to secure their livelihood. when improperly designed and used , such systems may violate the right to education and training as well as the right not to be discriminated against and perpetuate historical patterns of discrimination. ### (35) ai systems used in education or vocational training for determining access or assigning persons to educational and vocational training institutions or to evaluate persons on tests as part of or as a precondition for their education should be considered high-risk , since poorly designed ai systems may negatively determine the educational and professional course of a person’s life and therefore affect their ability to secure their livelihood. when improperly designed and used , such systems may violate the right to education and training as well as the right not to be discriminated against and perpetuate historical patterns of discrimination. all other applications of ai systems in education and training , such as systems used to monitor students during tests , should by default be considered minimal risk.


### (36) ai systems used in employment , workers management and access to self-employment , notably for the recruitment and selection of persons , for making decisions on promotion and termination and for task allocation , monitoring or evaluation of persons in work-related contractual relationships , should also be classified as high-risk , since those systems may appreciably impact future career prospects and livelihoods of these persons. relevant work-related contractual relationships should involve employees and persons providing services through platforms as referred to in the commission work programme 2021. such persons should in principle not be considered users within the meaning of this regulation. throughout the recruitment process and in the evaluation , promotion , or retention of persons in work-related contractual relationships , such systems may perpetuate historical patterns of discrimination , for example against women , certain age groups , persons with disabilities , or persons of certain racial or ethnic origins or sexual orientation. ai systems used to monitor the performance and behaviour of these persons may also impact their rights to data protection and privacy. ### (36) ai systems used in employment , workers management and access to self-employment , notably for the recruitment and selection of persons , for making decisions on promotion and termination , monitoring or evaluation of persons in work-related contractual relationships , should also be classified as high-risk , since those systems may appreciably impact future career prospects and livelihoods of these persons. relevant work-related contractual relationships should involve employees and persons providing services through platforms as referred to in the commission work programme 2021. such persons should in principle not be considered users within the meaning of this regulation. throughout the recruitment process and in the evaluation , promotion , or retention of persons in work-related contractual relationships , such systems may perpetuate historical patterns of discrimination , for example against women , certain age groups , persons with disabilities , or persons of certain racial or ethnic origins or sexual orientation. ai systems used to monitor the performance and behaviour of these persons may also impact their rights to data protection and privacy.


### (41) the fact that an ai system is classified as high risk under this regulation should not be interpreted as indicating that the use of the system is necessarily lawful under other acts of union law or under national law compatible with union law , such as on the protection of personal data , on the use of polygraphs and similar tools or other systems to detect the emotional state of natural persons. any such use should continue to occur solely in accordance with the applicable requirements resulting from the charter and from the applicable acts of secondary union law and national law. this regulation should not be understood as providing for the legal ground for processing of personal data , including special categories of personal data , where relevant. ### (41) the fact that an ai system is compliant with the requirements for high-risk ai under this regulation should not be interpreted as indicating that the use of the system is necessarily unlawful under other acts of union law or under national law compatible with union law , such as on the protection of personal data , on the use of polygraphs and similar tools or other systems to detect the emotional state of natural persons. any such use should continue to occur solely in accordance with the applicable requirements resulting from the charter and from the applicable acts of secondary union law and national law. as far as is applicable and proportionate , this regulation may , where duly justified , be understood as providing for the legal ground for processing of personal data where relevant.


### (70) certain ai systems intended to interact with natural persons or to generate content may pose specific risks of impersonation or deception irrespective of whether they qualify as high-risk or not. in certain circumstances , the use of these systems should therefore be subject to specific transparency obligations without prejudice to the requirements and obligations for high-risk ai systems. in particular , natural persons should be notified that they are interacting with an ai system , unless this is obvious from the circumstances and the context of use. moreover , natural persons should be notified when they are exposed to an emotion recognition system or a biometric categorisation system. such information and notifications should be provided in accessible formats for persons with disabilities. further , users , who use an ai system to generate or manipulate image , audio or video content that appreciably resembles existing persons , places or events and would falsely appear to a person to be authentic , should disclose that the content has been artificially created or manipulated by labelling the artificial intelligence output accordingly and disclosing its artificial origin. ### (70) certain ai systems intended to interact with natural persons or to generate content may pose specific risks of impersonation or deception irrespective of whether they qualify as high-risk or not. in certain circumstances , the use of these systems should therefore be subject to specific transparency obligations without prejudice to the requirements and obligations for high-risk ai systems. in particular , natural persons should be notified that they are interacting with an ai system , unless this is obvious from the circumstances and the context of use or where the content is doubtless used to form part of a creative , artistic or fictional cinematographic work. moreover , natural persons should be notified when they are exposed to an emotion recognition system or a biometric categorisation system. such information and notifications should be provided in accessible formats for persons with disabilities or other vulnerabilities. further , users , who use an ai system to generate or manipulate image , audio or video content that appreciably resembles existing persons , places or events and would falsely appear to a person to be authentic , should disclose in a clear manner that the content has been artificially created or manipulated by labelling the artificial intelligence output accordingly and disclosing its artificial origin.


### (85) in order to ensure that the regulatory framework can be adapted where necessary , the power to adopt acts in accordance with article 290 tfeu should be delegated to the commission to amend the techniques and approaches referred to in annex i to define ai systems , the union harmonisation legislation listed in annex ii , the high-risk ai systems listed in annex iii , the provisions regarding technical documentation listed in annex iv , the content of the eu declaration of conformity in annex v , the provisions regarding the conformity assessment procedures in annex vi and vii and the provisions establishing the high-risk ai systems to which the conformity assessment procedure based on assessment of the quality management system and assessment of the technical documentation should apply. it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level , and that those consultations be conducted in accordance with the principles laid down in the interinstitutional agreement of 13 april 2016 on better law-making58 . in particular , to ensure equal participation in the preparation of delegated acts , the european parliament and the council receive all documents at the same time as member states’ experts , and their experts systematically have access to meetings of commission expert groups dealing with the preparation of delegated acts. ### (85) in order to ensure that the regulatory framework can be adapted where necessary , the power to adopt acts in accordance with article 290 tfeu should be delegated to the commission to amend the techniques and approaches referred to in annex i to define ai systems , the union harmonisation legislation listed in annex ii , the high-risk ai systems listed in annex iii , the provisions regarding technical documentation listed in annex iv , the content of the eu declaration of conformity in annex v , the provisions regarding the conformity assessment procedures in annex vi and vii and the provisions establishing the high-risk ai systems to which the conformity assessment procedure based on assessment of the quality management system and assessment of the technical documentation should apply. it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level , and that those consultations be conducted in accordance with the principles laid down in the interinstitutional agreement of 13 april 2016 on better law-making58 . such consultations may involve qualified specialists , including from the private sector and industries , with skills and knowledge relevant to the task. in particular , to ensure equal participation in the preparation of delegated acts , the european parliament and the council receive all documents at the same time as member states’ experts , and their experts systematically have access to meetings of commission expert groups dealing with the preparation of delegated acts.


### harmonised rules for the placing on the market , the putting into service and the use of artificial intelligence systems (‘ai systems’) in the union; ### harmonised rules for the placing on the market , the putting into service and the use of safe and trustworthy artificial intelligence systems (‘ai systems’) in the union;


### (8) ‘operator’ means the provider , the user , the authorised representative , the importer and the distributor; ### (8) ‘operator’ means the economic operator and the user;


### the placing on the market , putting into service or use of an ai system that exploits any of the vulnerabilities of a specific group of persons due to their age , physical or mental disability , in order to materially distort the behaviour of a person pertaining to that group in a manner that causes or is likely to cause that person or another person physical or psychological harm; ### the placing on the market , putting into service or use of an ai system that deliberately exploits any of the vulnerabilities of a specific group of persons due to their age , physical or mental disability , in order to materially distort the behaviour of a person pertaining to that group in a manner that causes or is likely to cause that person or another person physical or psychological harm;


### the placing on the market , putting into service or use of an ai system that exploits any of the vulnerabilities of a specific group of persons due to their age , physical or mental disability , in order to materially distort the behaviour of a person pertaining to that group in a manner that causes or is likely to cause that person or another person physical or psychological harm; ### the placing on the market , putting into service or use of an ai system that exploits any of the vulnerabilities of children or a specific group of persons due to their age , physical or mental disability , in order to materially distort the behaviour of a person pertaining to that group in a manner that causes or is likely to cause that person or another person physical or psychological harm;


### the placing on the market , putting into service or use of an ai system that exploits any of the vulnerabilities of a specific group of persons due to their age , physical or mental disability , in order to materially distort the behaviour of a person pertaining to that group in a manner that causes or is likely to cause that person or another person physical or psychological harm; ### the placing on the market , putting into service or use of an ai system that exploits any of the vulnerabilities of a specific group of persons due to their age , physical or mental disability , in order to materially distort the behaviour of a person pertaining to that group in a manner that causes or is likely to cause that person or another person physical or psychological harm that could be predicted with due diligence;


### the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purpose of law enforcement , unless and in as far as such use is strictly necessary for one of the following objectives: ### the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces , unless and in as far as such use by law enforcement is strictly necessary for one of the following objectives:


### the extent to which potentially harmed or adversely impacted persons are dependent on the outcome produced with an ai system , in particular because for practical or legal reasons it is not reasonably possible to opt-out from that outcome; ### the extent to which potentially harmed or adversely impacted persons are dependent on the outcome produced with an ai system with a distinction to be made between an ai system used in an advisory capacity or one to directly inform decision-making process , in particular because for practical or legal reasons it is not reasonably possible to opt-out from that outcome;


### 1. high-risk ai systems shall be designed and developed with capabilities enabling the automatic recording of events (‘logs’) while the high-risk ai systems is operating. those logging capabilities shall conform to recognised standards or common specifications. ### 1. high-risk ai systems shall be designed and developed with capabilities enabling the technical possibility for recording of events (‘logs’) while the high-risk ai systems is operating. those logging capabilities shall conform to recognised standards or common specifications.


### 3. human oversight shall be ensured through either one or all of the following measures: ### 3. the degree of human oversight shall be proportionate to the relevant risks , the level of automation and the intended purpose of the ai system. the relevant oversight shall be ensured through either one or all of the following measures:


### 1. high-risk ai systems shall be designed and developed in such a way that they achieve , in the light of their intended purpose , an appropriate level of accuracy , robustness and cybersecurity , and perform consistently in those respects throughout their lifecycle. ### 1. high-risk ai systems shall be designed and developed in such a way that they achieve , in the light of their intended purpose , a reasonably expected level of accuracy , robustness and cybersecurity , and perform consistently in those respects throughout their lifecycle.


### providers of high-risk ai systems shall , upon request by a national competent authority , provide that authority with all the information and documentation necessary to demonstrate the conformity of the high-risk ai system with the requirements set out in chapter 2 of this title , in an official union language determined by the member state concerned. upon a reasoned request from a national competent authority , providers shall also give that authority access to the logs automatically generated by the high-risk ai system , to the extent such logs are under their control by virtue of a contractual arrangement with the user or otherwise by law. ### providers of high-risk ai systems shall , upon request by a national competent authority , provide that authority with all the information and documentation necessary to demonstrate the conformity of the high-risk ai system with the requirements set out in chapter 2 of this title , in an official union language determined by the member state concerned. upon a reasoned request from a national competent authority , providers shall also give that authority access to the logs automatically generated by the high-risk ai system , to the extent such logs are under their control by virtue of a contractual arrangement with the user or otherwise by law. in accordance with article 70(2) , the national competent authorities shall not disclose and keep confidential all trade secrets or otherwise commercially sensitive information contained in the information received.


### 2. high-risk ai systems that have been certified or for which a statement of conformity has been issued under a cybersecurity scheme pursuant to regulation (eu) 2019/881 of the european parliament and of the council63 and the references of which have been published in the official journal of the european union shall be presumed to be in compliance with the cybersecurity requirements set out in article 15 of this regulation in so far as the cybersecurity certificate or statement of conformity or parts thereof cover those requirements. ### 2. high-risk ai systems that have been certified or for which a statement of conformity has been issued under a cybersecurity scheme pursuant to regulation (eu) 2019/881 of the european parliament and of the council63 and the references of which have been published in the official journal of the european union shall be presumed to be in compliance with the cybersecurity requirements set out in article 15 , where applicable , of this regulation in so far as the cybersecurity certificate or statement of conformity or parts thereof cover those requirements.


### however , the first subparagraph shall not apply where the use is authorised by law to detect , prevent , investigate and prosecute criminal offences or it is necessary for the exercise of the right to freedom of expression and the right to freedom of the arts and sciences guaranteed in the charter of fundamental rights of the eu , and subject to appropriate safeguards for the rights and freedoms of third parties. ### however , the first subparagraph shall not apply where the use is authorised by law to detect , prevent , investigate and prosecute criminal offences or where the content forms part of an evidently artistic , creative or fictional cinematographic and analogous work , or it is necessary for the exercise of the right to freedom of expression and the right to freedom of the arts and sciences guaranteed in the charter of fundamental rights of the eu , and subject to appropriate safeguards for the rights and freedoms of third parties.


### however , the first subparagraph shall not apply where the use is authorised by law to detect , prevent , investigate and prosecute criminal offences or it is necessary for the exercise of the right to freedom of expression and the right to freedom of the arts and sciences guaranteed in the charter of fundamental rights of the eu , and subject to appropriate safeguards for the rights and freedoms of third parties. ### however , the first subparagraph shall not apply where the use is authorised by law to detect , prevent , investigate and prosecute criminal offences or where the content forms part of an evidently artistic , creative or fictional cinematographic and analogous work-or it is necessary for the exercise of the right to freedom of expression and the right to freedom of the arts and sciences guaranteed in the charter of fundamental rights of the eu , and subject to appropriate safeguards for the rights and freedoms of third parties.


### contribute to uniform administrative practices in the member states , including for the functioning of regulatory sandboxes referred to in article 53; ### contribute to uniform administrative practices in the member states , including for the functioning of regulatory sandboxes referred to in article 53 so as to help promote and unleash the full potential of ai;


### contribute to uniform administrative practices in the member states , including for the functioning of regulatory sandboxes referred to in article 53; ### contribute to uniform administrative practices in the member states , including for the assessment , establishing , managing with the meaning of fostering cooperation and guaranteeing consistency among regulatory sandboxes , and functioning of regulatory sandboxes referred to in article 53;


### 1. in compliance with the terms and conditions laid down in this regulation , member states shall lay down the rules on penalties , including administrative fines , applicable to infringements of this regulation and shall take all measures necessary to ensure that they are properly and effectively implemented. the penalties provided for shall be effective , proportionate , and dissuasive. they shall take into particular account the interests of small-scale providers and start-up and their economic viability. ### 1. in compliance with the terms and conditions laid down in this regulation , member states shall lay down the rules on penalties , including administrative fines , applicable to infringements of this regulation and shall take all measures necessary to ensure that they are properly and effectively implemented. the penalties provided for shall be effective , proportionate , and dissuasive. they shall take into particular account the interests and market position of small-scale providers and start-up and their economic viability.


### 1. in compliance with the terms and conditions laid down in this regulation , member states shall lay down the rules on penalties , including administrative fines , applicable to infringements of this regulation and shall take all measures necessary to ensure that they are properly and effectively implemented. the penalties provided for shall be effective , proportionate , and dissuasive. they shall take into particular account the interests of small-scale providers and start-up and their economic viability. ### 1. in compliance with the terms and conditions laid down in this regulation , member states shall lay down the rules on penalties , including administrative fines , applicable to infringements of this regulation and shall take all measures necessary to ensure that they are properly and effectively implemented and aligned with the guidelines issued by the board , as referred to in article 58 (c) (iii). the penalties provided for shall be effective , proportionate , and dissuasive. they shall take into particular account the interests of small-scale providers and start-up and their economic viability.


### 1. in compliance with the terms and conditions laid down in this regulation , member states shall lay down the rules on penalties , including administrative fines , applicable to infringements of this regulation and shall take all measures necessary to ensure that they are properly and effectively implemented. the penalties provided for shall be effective , proportionate , and dissuasive. they shall take into particular account the interests of small-scale providers and start-up and their economic viability. ### 1. in compliance with the terms and conditions laid down in this regulation , the commission in consultation with member states shall lay down the rules on penalties , including administrative fines , applicable to infringements of this regulation and in cooperation with member states shall take all measures necessary to ensure that they are properly and effectively implemented. the penalties provided for shall be effective , proportionate , and dissuasive. they shall take into particular account the size and the interests of sme providers including start-ups and their economic viability.


### 1. in compliance with the terms and conditions laid down in this regulation , member states shall lay down the rules on penalties , including administrative fines , applicable to infringements of this regulation and shall take all measures necessary to ensure that they are properly and effectively implemented. the penalties provided for shall be effective , proportionate , and dissuasive. they shall take into particular account the interests of small-scale providers and start-up and their economic viability. ### 1. in compliance with the terms and conditions laid down in this regulation , member states shall lay down the rules on penalties , including administrative fines , applicable to infringements of this regulation and shall take all measures necessary to ensure that they are properly and effectively implemented and aligned with the guidelines issued by the board , as referred to in article 58 (c) (iii). the penalties provided for shall be effective , proportionate , and dissuasive. they shall take into particular account the interests of smes and start-up and their economic viability.


### 1. in compliance with the terms and conditions laid down in this regulation , member states shall lay down the rules on penalties , including administrative fines , applicable to infringements of this regulation and shall take all measures necessary to ensure that they are properly and effectively implemented. the penalties provided for shall be effective , proportionate , and dissuasive. they shall take into particular account the interests of small-scale providers and start-up and their economic viability. ### 1. in compliance with the terms and conditions laid down in this regulation , the commission in consultation with member states shall lay down the rules on penalties , including administrative fines , applicable to infringements of this regulation and in cooperation with member states shall take all measures necessary to ensure that they are properly and effectively implemented. the penalties provided for shall be effective , proportionate , and dissuasive. they shall take into particular account the size and the interests of sme providers , including start-ups and their economic viability


### the size and market share of the operator committing the infringement; ### the market share of the operator committing the infringement , while also taking into consideration the size of the operator;


### the size and market share of the operator committing the infringement; ### the size , the annual turnover and market share of the operator committing the infringement;


### 1. biometric identification and categorisation of natural persons: ### 1. biometric identification , unless for private use , and categorisation of natural persons:


### 1. biometric identification and categorisation of natural persons: ### 1. biometric identification systems , excluding biometric authentication or verification , intended to be used for the ‘real-time’ and ‘post’ remote biometric identification or categorisation of natural persons (i.e. , revealing their identity or tracking their behaviour) without their expressed or implied consent and causing legal effects or discrimination against the affected person;


### 1. biometric identification and categorisation of natural persons: ### 1. biometric identification of natural persons:


### ai systems intended to be used for the purpose of determining access or assigning natural persons to educational and vocational training institutions; ### ai systems intended to be used for the purpose of determining or materially influence decision on the admission of natural persons to educational and vocational training institutions;


### ai systems intended to be used for the purpose of assessing students in educational and vocational training institutions and for assessing participants in tests commonly required for admission to educational institutions. ### ai systems intended to be used for the purpose of assessing the learning outcome of students in educational and vocational training institutions and for assessing participants in tests commonly required for admission to these institutions.


### 4. employment , workers management and access to self-employment: ### 4. employment and work-related contractual relationships


### 6. directive 2014/53/eu of the european parliament and of the council of 16 april 2014 on the harmonisation of the laws of the member states relating to the making available on the market of radio equipment and repealing directive 1999/5/ec (oj l 153 , 22.5.2014 , p. 62); ### deleted


### 11. regulation (eu) 2017/745 of the european parliament and of the council of 5 april 2017 on medical devices , amending directive 2001/83/ec , regulation (ec) no 178/2002 and regulation (ec) no 1223/2009 and repealing council directives 90/385/eec and 93/42/eec (oj l 117 , 5.5.2017 , p. 1; ### deleted


### 12. regulation (eu) 2017/746 of the european parliament and of the council of 5 april 2017 on in vitro diagnostic medical devices and repealing directive 98/79/ec and commission decision 2010/227/eu (oj l 117 , 5.5.2017 , p. 176). ### deleted


### high-risk ai systems referred to in article 6(2) ### high-risk uses of ai systems referred to in article 6(2)


### high-risk ai systems referred to in article 6(2) ### critical use cases referred to in article 6(2)


### high-risk ai systems pursuant to article 6(2) are the ai systems listed in any of the following areas: ### the ai systems specifically mentioned under points 1-8 stand for critical use cases and are each considered to be high-risk ai systems pursuant to article 6(2) , when - according to their instructions to use - their intended purpose and specific use pose a significant risk of harm to the health and safety or a risk of adverse impact on fundamental rights:


### 2. management and operation of critical infrastructure: ### 2. critical infrastructure and protection of environment:


### ai systems intended to be used by public authorities or on behalf of public authorities to evaluate the eligibility of natural persons for public assistance benefits and services , as well as to grant , reduce , revoke , or reclaim such benefits and services; ### ai systems intended to be used by public authorities or on behalf of public authorities to evaluate and decide on the eligibility of natural persons for public assistance benefits and services , as well as to grant , reduce , revoke , or reclaim such benefits and services;


### ai systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score , with the exception of ai systems put into service by small scale providers for their own use; ### deleted


### ai systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score , with the exception of ai systems put into service by small scale providers for their own use; ### ai systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score in order to determine their access to credit or to other essential services. ancillary applications such as ai applications used for the acceleration of the credit disbursement process , in the valuation of collateral , or for the internal process efficiency , as well as other subsequent applications based on the credit scoring which do not create high risks for individuals are not included in those systems;


### ai systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score , with the exception of ai systems put into service by small scale providers for their own use; ### ai systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score , with the exception of ai systems put into service by small scale providers for their own use; or ai systems related to low-value credits for the purchase of movables;


### ai systems intended to be used by law enforcement authorities for making individual risk assessments of natural persons in order to assess the risk of a natural person for offending or reoffending or the risk for potential victims of criminal offences; ### ai systems intended to be used by law enforcement authorities or on their behalf for making individual risk assessments of natural persons in order to assess the risk for a natural person for offending or reoffending or the risk for a natural person to become a potential victim of criminal offences;


### rules on market monitoring and surveillance. ### rules on market monitoring , market surveillance and governance;


### users of ai systems located within the union; ### users of ai systems who are physically present or established within the union;


### users of ai systems located within the union; ### users of ai systems using the ai system in the union;


### users of ai systems located within the union; ### users of ai systems using the ai system in the union ;


### providers and users of ai systems that are located in a third country , where the output produced by the system is used in the union; ### providers and users of ai systems that are located in a third country , where the output , meaning predictions , recommendations or decisions , produced by the ai system and influencing the environment it interacts with , is intended for use in the union and puts at risk the health , safety or fundamental rights of natural persons physically present in the union , insofar as the provider has permitted , is aware or can reasonably expect such use;


### regulation (ec) 300/2008; ### deleted


### regulation (eu) no 167/2013; ### deleted


### regulation (eu) no 168/2013; ### deleted


### directive 2014/90/eu; ### deleted


### directive (eu) 2016/797; ### deleted


### regulation (eu) 2018/858; ### deleted


### regulation (eu) 2018/1139; ### deleted


### regulation (eu) 2019/2144. ### deleted


### (3) ‘small-scale provider’ means a provider that is a micro or small enterprise within the meaning of commission recommendation 2003/361/ec61 ; ### deleted


### (5) ‘authorised representative’ means any natural or legal person established in the union who has received a written mandate from a provider of an ai system to , respectively , perform and carry out on its behalf the obligations and procedures established by this regulation; ### (5) ‘authorised representative’ means any natural or legal person physically present or established in the union who has received and accepted a written mandate from a provider of an ai system to , respectively , perform and carry out on its behalf the obligations and procedures established by this regulation;


### (6) ‘importer’ means any natural or legal person established in the union that places on the market or puts into service an ai system that bears the name or trademark of a natural or legal person established outside the union; ### (6) ‘importer’ means any natural or legal person physically present or established in the union that places on the market an ai system that bears the name or trademark of a natural or legal person established outside the union;


### (15) ‘instructions for use’ means the information provided by the provider to inform the user of in particular an ai system’s intended purpose and proper use , inclusive of the specific geographical , behavioural or functional setting within which the high-risk ai system is intended to be used; ### (15) ‘instructions for use’ means the information provided by the provider to inform the user of in particular an ai system’s intended purpose and proper use ,


### (16) ‘recall of an ai system’ means any measure aimed at achieving the return to the provider of an ai system made available to users; ### (16) ‘recall of an ai system’ means any measure aimed at achieving the return to the provider or taking it out of service or disable the use of an ai system made available to users;


### (17) ‘withdrawal of an ai system’ means any measure aimed at preventing the distribution , display and offer of an ai system; ### (17) ‘withdrawal of an ai system’ means any measure aimed at preventing an ai system in the supply chain being made available on the market;


### (20) ‘conformity assessment’ means the process of verifying whether the requirements set out in title iii , chapter 2 of this regulation relating to an ai system have been fulfilled; ### (20) ‘conformity assessment’ means the process of demonstrating whether the requirements set out in title iii , chapter 2 of this regulation relating to an ai system have been fulfilled;


### (22) ‘notified body’ means a conformity assessment body designated in accordance with this regulation and other relevant union harmonisation legislation; ### (22) ‘notified body’ means a conformity assessment body notified in accordance with art 32 of this regulation and with other relevant union harmonisation legislation;


### (23) ‘substantial modification’ means a change to the ai system following its placing on the market or putting into service which affects the compliance of the ai system with the requirements set out in title iii , chapter 2 of this regulation or results in a modification to the intended purpose for which the ai system has been assessed; ### (23) ‘substantial modification’ means a change to a high-risk ai system following its placing on the market or putting into service which affects the compliance of the ai system with the requirements set out in title iii , chapter 2 of this regulation such as a new training with a completely different dataset with respect to the one used to begin with or the addition of a further ai module into the ai system or results in a modification to the intended purpose for which the ai system has been assessed; supplementary and periodic training of an ai algorithm by the ai user or provider using their own data to ensure that the system remains accurate and/or is working as intended does not amount to a ‘substantial modification’ under this regulation. the periodic retraining of models due to new data with same structure shall not constitute a substantial modification. for high-risk ai systems that continue to learn after being placed on the market or put into service , changes to the high-risk ai system and its performance that have been predetermined by the provider at the moment of the initial conformity assessment and are part of the information contained in the technical documentation referred to in point 2(f) of annex iv , shall not constitute a substantial modification;


### (23) ‘substantial modification’ means a change to the ai system following its placing on the market or putting into service which affects the compliance of the ai system with the requirements set out in title iii , chapter 2 of this regulation or results in a modification to the intended purpose for which the ai system has been assessed; ### (23) ‘substantial modification’ means a change to the ai system following its placing on the market or putting into service , not foreseen by the provider , which affects the compliance of the ai system with the requirements set out in title iii , chapter 2 of this regulation or results in a modification to the intended purpose for which the ai system has been assessed;


### (24) ‘ce marking of conformity’ (ce marking) means a marking by which a provider indicates that an ai system is in conformity with the requirements set out in title iii , chapter 2 of this regulation and other applicable union legislation harmonising the conditions for the marketing of products (‘union harmonisation legislation’) providing for its affixing; ### (24) ‘ce marking of conformity’ (ce marking) means a physical or electronic marking by which a provider indicates that an ai system is in conformity with the requirements set out in title iii , chapter 2 of this regulation and other applicable union legislation harmonising the conditions for the marketing of products (‘union harmonisation legislation’) providing for its affixing as well as the gdpr;


### (28) ‘common specifications’ means a document , other than a standard , containing technical solutions providing a means to , comply with certain requirements and obligations established under this regulation; ### (28) ‘common specifications’ means a document comprising a set of technical specifications , other than a standard , providing a means to comply with certain requirements and obligations established under this regulation;


### (30) ‘validation data’ means data used for providing an evaluation of the trained ai system and for tuning its non-learnable parameters and its learning process , among other things , in order to prevent overfitting; whereas the validation dataset can be a separate dataset or part of the training dataset , either as a fixed or variable split; ### (30) ‘machine learning validation data’ means data used for providing an evaluation of the trained ai system and for tuning its non-learnable parameters and its learning process , among other things , in order to prevent overfitting; whereas the validation dataset can be a separate dataset or part of the training dataset , either as a fixed or variable split;


### (31) ‘testing data’ means data used for providing an independent evaluation of the trained and validated ai system in order to confirm the expected performance of that system before its placing on the market or putting into service; ### (31) ‘testing data’ means data used for providing an independent evaluation of the trained and validated ai system in order to confirm the expected performance of that system before its placing on the market or putting into service. the testing data must be a separate dataset;


### (34) ‘emotion recognition system’ means an ai system for the purpose of identifying or inferring emotions or intentions of natural persons on the basis of their biometric data; ### (34) ‘emotion recognition system’ means an ai system for the purpose of identifying or inferring emotions or intentions of natural persons on the basis of their biometric or other data obtained , read or interpreted from an individual;


### article 67 ### deleted


### the conformity marking has not been affixed; ### the ce marking has not been affixed;


### 2. where the non-compliance referred to in paragraph 1 persists , the member state concerned shall take all appropriate measures to restrict or prohibit the high-risk ai system being made available on the market or ensure that it is recalled or withdrawn from the market. ### 2. where the non-compliance referred to in paragraph 1 persists , the member state concerned shall take proportionate measures to restrict or prohibit the high-risk ai system being made available on the market.


### 4. the commission and the board shall take into account the specific interests and needs of the small-scale providers and start-ups when encouraging and facilitating the drawing up of codes of conduct. ### 4. the commission and the board shall take into account the specific interests and needs of the smes and start-ups when encouraging and facilitating the drawing up of codes of conduct.


### intellectual property rights , and confidential business information or trade secrets of a natural or legal person , including source code , except the cases referred to in article 5 of directive 2016/943 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition , use and disclosure apply. ### intellectual property rights , and confidential business information or trade secrets of a natural or legal person in line with the 2016 eu trade secrets directive (directive 2016/943) as well as the 2004 directive on the enforcement of intellectual property rights (directive 2004/48/ec) , including source code , except the cases referred to in article 5 of directive 2016/943 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition , use and disclosure apply.


### intellectual property rights , and confidential business information or trade secrets of a natural or legal person , including source code , except the cases referred to in article 5 of directive 2016/943 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition , use and disclosure apply. ### intellectual property rights , and confidential business information or professional secrecy or trade secrets of a natural or legal person , including source code , except the cases referred to in article 5 of directive 2016/943 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition , use and disclosure apply.


### 4. the commission and member states may exchange , where necessary , confidential information with regulatory authorities of third countries with which they have concluded bilateral or multilateral confidentiality arrangements guaranteeing an adequate level of confidentiality. ### 4. the commission and member states may exchange , where necessary and in compliance with trade agreements between the eu and third countries that may apply , confidential information with regulatory authorities of third countries with which they have concluded bilateral or multilateral confidentiality arrangements guaranteeing an adequate level of confidentiality.


### 4. the commission and member states may exchange , where necessary , confidential information with regulatory authorities of third countries with which they have concluded bilateral or multilateral confidentiality arrangements guaranteeing an adequate level of confidentiality. ### 4. the commission and member states may , if consistent with the provisions contained in eu trade agreements with third countries , exchange , where necessary , confidential information with regulatory authorities of third countries with which they have concluded bilateral or multilateral confidentiality arrangements guaranteeing an adequate level of confidentiality.


### 2. the member states shall notify the commission of those rules and of those measures and shall notify it , without delay , of any subsequent amendment affecting them. ### deleted


### 2. the member states shall notify the commission of those rules and of those measures and shall notify it , without delay , of any subsequent amendment affecting them. ### 2. member states shall notify the commission of those rules and of those measures and shall notify it , without delay , of any subsequent amendment affecting them.


### 3. the following infringements shall be subject to administrative fines of up to 30 000 000 eur or , if the offender is company , up to 6 % of its total worldwide annual turnover for the preceding financial year , whichever is higher: ### 3. non-compliance with the prohibition of the ai practices referred to in article 5 shall be subject to administrative fines of up to 20 000 000 eur or , if the offender is a company , up to 4% of its total worldwide annual turnover for the preceding financial year , whichever is higher.


### non-compliance with the prohibition of the artificial intelligence practices referred to in article 5; ### deleted


### non-compliance of the ai system with the requirements laid down in article 10. ### deleted


### 4. the non-compliance of the ai system with any requirements or obligations under this regulation , other than those laid down in articles 5 and 10 , shall be subject to administrative fines of up to 20 000 000 eur or , if the offender is a company , up to 4 % of its total worldwide annual turnover for the preceding financial year , whichever is higher. ### 4. the grossly negligent non-compliance by the provider or user of the ai system with the respective requirements or obligations under this regulation , other than those laid down in articles 5 , shall be subject to administrative fines of up to 10 000 000 eur or , if the offender is a company , up to 2 % of its total worldwide annual turnover for the preceding financial year , whichever is higher , and in case of smes and start-ups , up to 1% of its worldwide annual turnover for the preceding financial year , whichever is higher.


### 4. the non-compliance of the ai system with any requirements or obligations under this regulation , other than those laid down in articles 5 and 10 , shall be subject to administrative fines of up to 20 000 000 eur or , if the offender is a company , up to 4 % of its total worldwide annual turnover for the preceding financial year , whichever is higher. ### 4. the non-compliance of the ai system with any requirements or obligations under this regulation , other than those laid down in articles 5 and 10 , shall be subject to administrative fines of up to 1 000 000 eur or , if the offender is a company , up to 1 % of its total worldwide annual turnover for the preceding financial year , whichever is higher.


### 5. the supply of incorrect , incomplete or misleading information to notified bodies and national competent authorities in reply to a request shall be subject to administrative fines of up to 10 000 000 eur or , if the offender is a company , up to 2 % of its total worldwide annual turnover for the preceding financial year , whichever is higher. ### 5. the supply of incorrect , incomplete or misleading information to notified bodies and national competent authorities in reply to a request shall be subject to administrative fines of up to 10 000 000 eur or , if the offender is a company , up to 2 % of its total worldwide annual turnover for the preceding financial year , whichever is higher and in case of smes and start-ups , up to 1% of its worldwide annual turnover for the preceding financial year , whichever is higher.


### 5. the supply of incorrect , incomplete or misleading information to notified bodies and national competent authorities in reply to a request shall be subject to administrative fines of up to 10 000 000 eur or , if the offender is a company , up to 2 % of its total worldwide annual turnover for the preceding financial year , whichever is higher. ### 5. the supply of incorrect or misleading information to notified bodies and national competent authorities in reply to a request shall be subject to administrative fines of up to 1 000 000 eur or , if the offender is a company , up to 1 % of its total worldwide annual turnover for the preceding financial year , whichever is higher.


### 6. when deciding on the amount of the administrative fine in each individual case , all relevant circumstances of the specific situation shall be taken into account and due regard shall be given to the following: ### 6. fines may be imposed in addition to or instead of non-monetary measures such as orders or warnings. when deciding on whether to impose a fine or on the amount of the administrative fine in each individual case , all relevant circumstances of the specific situation shall be taken into account and due regard shall be given to the following:


### the nature , gravity and duration of the infringement and of its consequences; ### the nature , gravity and duration of the infringement and of its consequences taking into account the nature , scope or purpose of the ai system concerned , as well as the number of individuals affected , and the level of damage suffered by them;


### 2. the delegation of power referred to in article 4 , article 7(1) , article 11(3) , article 43(5) and (6) and article 48(5) shall be conferred on the commission for an indeterminate period of time from [entering into force of the regulation]. ### 2. the delegation of power referred to in article 4 and article 48(5) shall be conferred on the commission for an indeterminate period of time from [entering into force of the regulation].


### 3. the delegation of power referred to in article 4 , article 7(1) , article 11(3) , article 43(5) and (6) and article 48(5) may be revoked at any time by the european parliament or by the council. a decision of revocation shall put an end to the delegation of power specified in that decision. it shall take effect the day following that of its publication in the official journal of the european union or at a later date specified therein. it shall not affect the validity of any delegated acts already in force. ### 3. the delegation of power referred to in article 4 and article 48(5) may be revoked at any time by the european parliament or by the council. a decision of revocation shall put an end to the delegation of power specified in that decision. it shall take effect the day following that of its publication in the official journal of the european union or at a later date specified therein. it shall not affect the validity of any delegated acts already in force.


### 5. any delegated act adopted pursuant to article 4 , article 7(1) , article 11(3) , article 43(5) and (6) and article 48(5) shall enter into force only if no objection has been expressed by either the european parliament or the council within a period of three months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object. that period shall be extended by three months at the initiative of the european parliament or of the council. ### 5. any delegated act adopted pursuant to article 4 and article 48(5) shall enter into force only if no objection has been expressed by either the european parliament or the council within a period of three months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object. that period shall be extended by three months at the initiative of the european parliament or of the council.


### 1. this regulation shall not apply to the ai systems which are components of the large-scale it systems established by the legal acts listed in annex ix that have been placed on the market or put into service before [12 months after the date of application of this regulation referred to in article 85(2)] , unless the replacement or amendment of those legal acts leads to a significant change in the design or intended purpose of the ai system or ai systems concerned. ### 1. this regulation shall not apply to the ai systems which are components of the large-scale it systems established by the legal acts listed in annex ix that have been placed on the market or put into service before [24 months after the date of application of this regulation referred to in article 85(2)] , unless the replacement or amendment of those legal acts leads to a significant change in the design or intended purpose of the ai system or ai systems concerned.


### (42) to mitigate the risks from high-risk ai systems placed or otherwise put into service on the union market for users and affected persons , certain mandatory requirements should apply , taking into account the intended purpose of the use of the system and according to the risk management system to be established by the provider. ### (42) to mitigate the risks from high-risk ai systems placed or otherwise put into service on the union market for users and affected persons , certain mandatory requirements should apply , taking into account the intended purpose of the use of the system , level of reliance of the user or business user on the output of the ai system for the final decision or outcome and according to the risk management system to be established by the provider.


### (42) to mitigate the risks from high-risk ai systems placed or otherwise put into service on the union market for users and affected persons , certain mandatory requirements should apply , taking into account the intended purpose of the use of the system and according to the risk management system to be established by the provider. ### (42) to mitigate the risks from high-risk ai systems placed or otherwise put into service on the union market for users and affected persons , certain mandatory requirements should apply proportionately , taking into account the intended purpose of the use of the system and according to the risk management system to be established in a clear and accessible manner by the provider.


### (45) for the development of high-risk ai systems , certain actors , such as providers , notified bodies and other relevant entities , such as digital innovation hubs , testing experimentation facilities and researchers , should be able to access and use high quality datasets within their respective fields of activities which are related to this regulation. european common data spaces established by the commission and the facilitation of data sharing between businesses and with government in the public interest will be instrumental to provide trustful , accountable and non-discriminatory access to high quality data for the training , validation and testing of ai systems. for example , in health , the european health data space will facilitate non-discriminatory access to health data and the training of artificial intelligence algorithms on those datasets , in a privacy-preserving , secure , timely , transparent and trustworthy manner , and with an appropriate institutional governance. relevant competent authorities , including sectoral ones , providing or supporting the access to data may also support the provision of high-quality data for the training , validation and testing of ai systems. ### (45) for the development and assessment of high-risk ai systems , certain actors , such as providers , notified bodies and other relevant entities , such as digital innovation hubs , testing experimentation facilities and researchers , should be able to access and use high quality datasets within their respective fields of activities which are related to this regulation. european common data spaces established by the commission and the facilitation of data sharing between businesses and with government in the public interest will be instrumental to provide trustful , accountable and non-discriminatory access to high quality data for the training , validation and testing of ai systems. for example , in health , the european health data space will facilitate non-discriminatory access to health data and the training of artificial intelligence algorithms on those datasets , in a privacy-preserving , secure , timely , transparent and trustworthy manner , and with an appropriate institutional governance. relevant competent authorities , including sectoral ones , providing or supporting the access to data may also support the provision of high-quality data for the training , validation and testing of ai systems.


### (45) for the development of high-risk ai systems , certain actors , such as providers , notified bodies and other relevant entities , such as digital innovation hubs , testing experimentation facilities and researchers , should be able to access and use high quality datasets within their respective fields of activities which are related to this regulation. european common data spaces established by the commission and the facilitation of data sharing between businesses and with government in the public interest will be instrumental to provide trustful , accountable and non-discriminatory access to high quality data for the training , validation and testing of ai systems. for example , in health , the european health data space will facilitate non-discriminatory access to health data and the training of artificial intelligence algorithms on those datasets , in a privacy-preserving , secure , timely , transparent and trustworthy manner , and with an appropriate institutional governance. relevant competent authorities , including sectoral ones , providing or supporting the access to data may also support the provision of high-quality data for the training , validation and testing of ai systems. ### (45) for the development of high-risk ai systems , certain actors , such as providers , notified bodies and other relevant entities , such as digital innovation hubs , testing experimentation facilities and researchers , should be able to have increased access and use of high quality datasets within their respective fields of activities which are related to this regulation. european common data spaces established by the commission and the facilitation of data sharing between businesses and with government in the public interest will be instrumental to provide trustful , accountable and non-discriminatory access to high quality data for the training , validation and testing of ai systems. for example , in health , the european health data space will facilitate non-discriminatory access to health data and the training of artificial intelligence algorithms on those datasets , in a privacy-preserving , secure , timely , transparent and trustworthy manner , and with an appropriate institutional governance. relevant competent authorities , including sectoral ones , providing or supporting the access to data may also support the provision of high-quality data for the training , validation and testing of ai systems.


### (46) having information on how high-risk ai systems have been developed and how they perform throughout their lifecycle is essential to verify compliance with the requirements under this regulation. this requires keeping records and the availability of a technical documentation , containing information which is necessary to assess the compliance of the ai system with the relevant requirements. such information should include the general characteristics , capabilities and limitations of the system , algorithms , data , training , testing and validation processes used as well as documentation on the relevant risk management system. the technical documentation should be kept up to date. ### (46) having information on how high-risk ai systems have been developed and how they perform throughout their lifecycle is essential to verify compliance with the requirements under this regulation. this requires keeping records and the availability of a technical documentation , containing information which is necessary to assess the compliance of the ai system with the relevant requirements. such information should include the general characteristics , capabilities and limitations of the system , algorithms , data , training , testing and validation processes used as well as documentation on the relevant risk management system. the technical documentation should be kept up to date. the required technical documentation may contain trade secrets in accordance with directive (eu) 2016/943 of the european parliament and of the council of 8 june 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition , use and disclosure. possible trade secrets in the required documentation must be treated and kept in accordance with national legislation put in place in accordance with mentioned directive.


### (46) having information on how high-risk ai systems have been developed and how they perform throughout their lifecycle is essential to verify compliance with the requirements under this regulation. this requires keeping records and the availability of a technical documentation , containing information which is necessary to assess the compliance of the ai system with the relevant requirements. such information should include the general characteristics , capabilities and limitations of the system , algorithms , data , training , testing and validation processes used as well as documentation on the relevant risk management system. the technical documentation should be kept up to date. ### (46) having information on how high-risk ai systems have been developed and how they perform throughout their lifetime is essential to verify compliance with the requirements under this regulation. this requires keeping records and the availability of a technical documentation , containing information which is necessary to assess the compliance of the ai system with the relevant requirements , while preserving trade secrets. such information should include the general characteristics , capabilities and limitations of the system , algorithms , data , training , testing and validation processes used as well as documentation on the relevant risk management system. the technical documentation should be kept up to date.


### (49) high-risk ai systems should perform consistently throughout their lifecycle and meet an appropriate level of accuracy , robustness and cybersecurity in accordance with the generally acknowledged state of the art. the level of accuracy and accuracy metrics should be communicated to the users. ### (49) high-risk ai systems should perform consistently throughout their lifetime and meet an appropriate level of accuracy , robustness and cybersecurity in accordance with the generally acknowledged state of the art. the level of accuracy and accuracy metrics should be communicated to the users. while standardisation organisations exist to establish standards , coordination on benchmarking is needed to establish how these standards should be met and measured. the european artificial intelligence board should bring together national metrology and benchmarking authorities and provide guidance to address the technical aspects of how to measure the appropriate levels of accuracy and robustness. their work should not be seen as a replacement of the standardisation organisations , but as a complementary function to provide specific technical expertise on measurement.


### (49) high-risk ai systems should perform consistently throughout their lifecycle and meet an appropriate level of accuracy , robustness and cybersecurity in accordance with the generally acknowledged state of the art. the level of accuracy and accuracy metrics should be communicated to the users. ### (49) high-risk ai systems should perform consistently throughout their lifecycle and meet an appropriate level of accuracy , robustness and cybersecurity in accordance with the generally acknowledged state of the art. the level of accuracy and accuracy metrics should be communicated to the users. where applicable , changes in the level of accuracy and accuracy metrics should also be communicated to the users.


### estimation and evaluation of the risks that may emerge when the high-risk ai system is used in accordance with its intended purpose and under conditions of reasonably foreseeable misuse; ### deleted


### estimation and evaluation of the risks that may emerge when the high-risk ai system is used in accordance with its intended purpose and under conditions of reasonably foreseeable misuse; ### estimation and evaluation of the risks that may emerge when the high-risk ai system is used in accordance with its intended purpose;


### adoption of suitable risk management measures in accordance with the provisions of the following paragraphs. ### adoption of appropriate and targeted risk management measures designed to address identified known and foreseeable risks to health and safety or fundamental rights , in accordance with the provisions of the following paragraphs.


### (7) the notion of biometric data used in this regulation is in line with and should be interpreted consistently with the notion of biometric data as defined in article 4(14) of regulation (eu) 2016/679 of the european parliament and of the council35 , article 3(18) of regulation (eu) 2018/1725 of the european parliament and of the council36 and article 3(13) of directive (eu) 2016/680 of the european parliament and of the council37 . ### (7) the notion of biometric data used in this regulation is in line with and should be applied and interpreted consistently with the notion of biometric data as defined in article 4(14) of regulation (eu) 2016/679 of the european parliament and of the council35 , article 3(18) of regulation (eu) 2018/1725 of the european parliament and of the council36 and article 3(13) of directive (eu) 2016/680 of the european parliament and of the council37.


### (10) in order to ensure a level playing field and an effective protection of rights and freedoms of individuals across the union , the rules established by this regulation should apply to providers of ai systems in a non-discriminatory manner , irrespective of whether they are established within the union or in a third country , and to users of ai systems established within the union. ### (10) in order to ensure a level playing field and an effective protection of rights and freedoms of individuals across the union and on international level , the rules established by this regulation should apply to providers of ai systems in a non-discriminatory manner , irrespective of whether they are established within the union or in a third country , and to users of ai systems established within the union.


### (10) in order to ensure a level playing field and an effective protection of rights and freedoms of individuals across the union , the rules established by this regulation should apply to providers of ai systems in a non-discriminatory manner , irrespective of whether they are established within the union or in a third country , and to users of ai systems established within the union. ### (10) in order to ensure a balanced approach in a climate of legal certainty in the european market , a level playing field for european businesses and an effective protection of rights and freedoms of individuals across the union , the rules established by this regulation should apply to providers of ai systems in a non-discriminatory manner , irrespective of whether they are established within the union or in a third country , and to users of ai systems established within the union.


### (11) in light of their digital nature , certain ai systems should fall within the scope of this regulation even when they are neither placed on the market , nor put into service , nor used in the union. this is the case for example of an operator established in the union that contracts certain services to an operator established outside the union in relation to an activity to be performed by an ai system that would qualify as high-risk and whose effects impact natural persons located in the union. in those circumstances , the ai system used by the operator outside the union could process data lawfully collected in and transferred from the union , and provide to the contracting operator in the union the output of that ai system resulting from that processing , without that ai system being placed on the market , put into service or used in the union. to prevent the circumvention of this regulation and to ensure an effective protection of natural persons located in the union , this regulation should also apply to providers and users of ai systems that are established in a third country , to the extent the output produced by those systems is used in the union. nonetheless , to take into account existing arrangements and special needs for cooperation with foreign partners with whom information and evidence is exchanged , this regulation should not apply to public authorities of a third country and international organisations when acting in the framework of international agreements concluded at national or european level for law enforcement and judicial cooperation with the union or with its member states. such agreements have been concluded bilaterally between member states and third countries or between the european union , europol and other eu agencies and third countries and international organisations. ### (11) in light of their digital nature , certain ai systems should fall within the scope of this regulation even when they are neither placed on the market , nor put into service , nor used in the union. this is the case for example of an operator established in the union that contracts certain services to an operator established outside the union in relation to an activity to be performed by an ai system that would qualify as high-risk. in those circumstances , the ai system used by the operator outside the union could process data lawfully collected in and transferred from the union , and provide to the contracting operator in the union the output of that ai system resulting from that processing , without that ai system being placed on the market , put into service or used in the union. to prevent the circumvention of this regulation and to ensure an effective protection of natural persons located in the union , this regulation should also apply to providers and users of ai systems that are established in a third country , to the extent the output produced by those systems is intended for use in the union. nonetheless , to take into account existing arrangements and special needs for future cooperation with foreign partners with whom information and evidence is exchanged , this regulation should not apply to public authorities of a third country and international organisations when acting in the framework of international agreements concluded at national or european level for law enforcement and judicial cooperation with the union or with its member states. such agreements have been concluded bilaterally between member states and third countries or between the european union , europol and other eu agencies and third countries and international organisations.


### 5. importers shall provide national competent authorities , upon a reasoned request , with all necessary information and documentation to demonstrate the conformity of a high-risk ai system with the requirements set out in chapter 2 of this title in a language which can be easily understood by that national competent authority , including access to the logs automatically generated by the high-risk ai system to the extent such logs are under the control of the provider by virtue of a contractual arrangement with the user or otherwise by law. they shall also cooperate with those authorities on any action national competent authority takes in relation to that system. ### 5. where no authorised representative has been established , importers shall provide national competent authorities , upon a reasoned request , with all necessary information and documentation to demonstrate the conformity of a high-risk ai system with the requirements set out in chapter 2 of this title in a language which can be easily understood by that national competent authority. to this purpose they shall also ensure that the technical documentation can be made available to those authorities.


### 1. before making a high-risk ai system available on the market , distributors shall verify that the high-risk ai system bears the required ce conformity marking , that it is accompanied by the required documentation and instruction of use , and that the provider and the importer of the system , as applicable , have complied with the obligations set out in this regulation. ### 1. before making a high-risk ai system available on the market , distributors shall verify that the high-risk ai system bears the required ce conformity marking , that it is accompanied by the required documentation and instruction of use , and that the provider and the importer of the system , as applicable , have complied with their obligations set out in this regulation in article 16 and article 26(3) , respectively.


### 2. where a distributor considers or has reason to consider that a high-risk ai system is not in conformity with the requirements set out in chapter 2 of this title , it shall not make the high-risk ai system available on the market until that system has been brought into conformity with those requirements. furthermore , where the system presents a risk within the meaning of article 65(1) , the distributor shall inform the provider or the importer of the system , as applicable , to that effect. ### 2. where a distributor considers or has reason to consider , on the basis of the information in its possession , that a high-risk ai system is not in conformity with the requirements set out in chapter 2 of this title , it shall not make the high-risk ai system available on the market until that system has been brought into conformity with those requirements. furthermore , where the system presents a risk within the meaning of article 65(1) , the distributor shall inform the provider or the importer of the system , as applicable , to that effect , and the market surveillance authorities.


### 4. a distributor that considers or has reason to consider that a high-risk ai system which it has made available on the market is not in conformity with the requirements set out in chapter 2 of this title shall take the corrective actions necessary to bring that system into conformity with those requirements , to withdraw it or recall it or shall ensure that the provider , the importer or any relevant operator , as appropriate , takes those corrective actions. where the high-risk ai system presents a risk within the meaning of article 65(1) , the distributor shall immediately inform the national competent authorities of the member states in which it has made the product available to that effect , giving details , in particular , of the non-compliance and of any corrective actions taken. ### 4. a distributor that considers , on the basis of the information in its possession , or has reason to consider that a high-risk ai system which it has made available on the market is not in conformity with the requirements set out in chapter 2 of this title shall take the corrective actions necessary to bring that system into conformity with those requirements , to withdraw it or recall it or shall ensure that the provider , the importer or any relevant operator , as appropriate , takes those corrective actions. where the high-risk ai system presents a risk within the meaning of article 65(1) , the distributor shall immediately inform the provider or importer of the system and the national competent authorities of the member states in which it has made the product available to that effect , giving details , in particular , of the non-compliance and of any corrective actions taken.


### 5. upon a reasoned request from a national competent authority , distributors of high-risk ai systems shall provide that authority with all the information and documentation necessary to demonstrate the conformity of a high-risk system with the requirements set out in chapter 2 of this title. distributors shall also cooperate with that national competent authority on any action taken by that authority. ### 5. upon a reasoned request from a national competent authority and where no authorised representative has been appointed , distributors of high-risk ai systems shall provide that authority with all the information and documentation regarding its activities as described in paragraphs 1 to 4.


### article 28 ### deleted


### 2. the obligations in paragraph 1 are without prejudice to other user obligations under union or national law and to the user’s discretion in organising its own resources and activities for the purpose of implementing the human oversight measures indicated by the provider. ### 2. the obligations in paragraph 1 and 1a are without prejudice to other user obligations under union or national law and to the user’s discretion in organising its own resources and activities for the purpose of implementing the human oversight measures indicated by the provider.