### (70) certain ai systems intended to interact with natural persons or to generate content may pose specific risks of impersonation or deception irrespective of whether they qualify as high-risk or not. in certain circumstances , the use of these systems should therefore be subject to specific transparency obligations without prejudice to the requirements and obligations for high-risk ai systems. in particular , natural persons should be notified that they are interacting with an ai system , unless this is obvious from the circumstances and the context of use. moreover , natural persons should be notified when they are exposed to an emotion recognition system or a biometric categorisation system. such information and notifications should be provided in accessible formats for persons with disabilities. further , users , who use an ai system to generate or manipulate image , audio or video content that appreciably resembles existing persons , places or events and would falsely appear to a person to be authentic , should disclose that the content has been artificially created or manipulated by labelling the artificial intelligence output accordingly and disclosing its artificial origin. ### (70) certain ai systems intended to interact with natural persons or to generate content may pose specific risks of impersonation or deception irrespective of whether they qualify as high-risk or not. in these circumstances , the use of these systems should therefore be subject to specific transparency obligations without prejudice to the requirements and obligations for high-risk ai systems. in particular , natural persons should be notified that they are interacting with an ai system , unless this is obvious from the circumstances and the context of use. moreover , natural persons should be notified when they are exposed to an emotion recognition system or a biometric categorisation system. such information and notifications should be provided in a timely and accessible format paying particular attention to persons with disabilities. further , users , who use an ai system to generate or manipulate image , audio or video content that appreciably resembles existing persons , places or events and would falsely appear to a person to be authentic , should disclose that the content has been artificially created or manipulated by labelling the artificial intelligence output accordingly and disclosing its artificial origin.


### (79) in order to ensure an appropriate and effective enforcement of the requirements and obligations set out by this regulation , which is union harmonisation legislation , the system of market surveillance and compliance of products established by regulation (eu) 2019/1020 should apply in its entirety. where necessary for their mandate , national public authorities or bodies , which supervise the application of union law protecting fundamental rights , including equality bodies , should also have access to any documentation created under this regulation. ### (79) in order to ensure an appropriate and effective enforcement of the requirements and obligations set out by this regulation , which is union harmonisation legislation , the system of market surveillance and compliance of products established by regulation (eu) 2019/1020 should apply in its entirety. where necessary for their mandate , national public authorities or bodies , which supervise the application of union law protecting fundamental rights , including equality bodies , should also have access to any documentation created under this regulation. a reasonable suspicion of breach of fundamental rights , such as in the case of a consumer complaint or a notification of a breach submitted by a civil society organisation shall be deemed as a sufficient reason for the commencement of an evaluation of an ai system at national level.


### (81) the development of ai systems other than high-risk ai systems in accordance with the requirements of this regulation may lead to a larger uptake of trustworthy artificial intelligence in the union. providers of non-high-risk ai systems should be encouraged to create codes of conduct intended to foster the voluntary application of the mandatory requirements applicable to high-risk ai systems. providers should also be encouraged to apply on a voluntary basis additional requirements related , for example , to environmental sustainability , accessibility to persons with disability , stakeholders’ participation in the design and development of ai systems , and diversity of the development teams. the commission may develop initiatives , including of a sectorial nature , to facilitate the lowering of technical barriers hindering cross-border exchange of data for ai development , including on data access infrastructure , semantic and technical interoperability of different types of data. ### (81) the development of ai systems other than high-risk ai systems in accordance with the requirements of this regulation should lead to a larger uptake of trustworthy artificial intelligence in the union. providers of non-high-risk ai systems should be encouraged to create codes of conduct intended to foster the voluntary application of the mandatory requirements applicable to high-risk ai systems. providers should also be encouraged to apply on a voluntary basis additional requirements related , for example , to take a risk-based approach to focus on the direct and indirect effects on environmental sustainability , accessibility to persons with disability , stakeholders’ participation in the design and development of ai systems , and diversity of the development teams. the commission may develop initiatives , including of a sectorial nature , to facilitate the lowering of technical barriers hindering cross-border exchange of data for ai development , including on data access infrastructure , semantic and technical interoperability of different types of data.


### (85) in order to ensure that the regulatory framework can be adapted where necessary , the power to adopt acts in accordance with article 290 tfeu should be delegated to the commission to amend the techniques and approaches referred to in annex i to define ai systems , the union harmonisation legislation listed in annex ii , the high-risk ai systems listed in annex iii , the provisions regarding technical documentation listed in annex iv , the content of the eu declaration of conformity in annex v , the provisions regarding the conformity assessment procedures in annex vi and vii and the provisions establishing the high-risk ai systems to which the conformity assessment procedure based on assessment of the quality management system and assessment of the technical documentation should apply. it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level , and that those consultations be conducted in accordance with the principles laid down in the interinstitutional agreement of 13 april 2016 on better law-making58 . in particular , to ensure equal participation in the preparation of delegated acts , the european parliament and the council receive all documents at the same time as member states’ experts , and their experts systematically have access to meetings of commission expert groups dealing with the preparation of delegated acts. ### (85) in order to ensure that the regulatory framework can be adapted where necessary , the power to adopt acts in accordance with article 290 tfeu should be delegated to the commission to amend the techniques and approaches referred to in annex i to define ai systems , the union harmonisation legislation listed in annex ii , the high-risk ai systems listed in annex iii , the provisions regarding technical documentation listed in annex iv , the content of the eu declaration of conformity in annex v , the provisions regarding the conformity assessment procedures in annex vi and vii and the provisions establishing the high-risk ai systems to which the conformity assessment procedure based on assessment of the quality management system and assessment of the technical documentation should apply. it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level , and that those consultations be conducted in accordance with the principles laid down in the interinstitutional agreement of 13 april 2016 on better law-making58 . these consultations should involve the participation of a balanced selection of stakeholders , including consumer organisation , associations representing affected persons , businesses representatives from different sectors and sizes , as well as researchers and scientists. in particular , to ensure equal participation in the preparation of delegated acts , the european parliament and the council receive all documents at the same time as member states’ experts , and their experts systematically have access to meetings of commission expert groups dealing with the preparation of delegated acts.


### harmonised rules for the placing on the market , the putting into service and the use of artificial intelligence systems (‘ai systems’) in the union; ### harmonised rules for the placing on the market , the development , the putting into service , the deployment and the use of human-centric and trustworthy artificial intelligence systems (‘ai systems’) in the union;


### harmonised rules for the placing on the market , the putting into service and the use of artificial intelligence systems (‘ai systems’) in the union; ### harmonised rules to ensure the protection for the public interest , the health and safety of consumers and the protection of the environment for the placing on the market , the putting into service and the use of artificial intelligence systems (‘ai systems’) in the union;


### harmonised rules for the placing on the market , the putting into service and the use of artificial intelligence systems (‘ai systems’) in the union; ### harmonised rules for the development , the placing on the market , the putting into service and the use of human-centric and trustworthy artificial intelligence systems (‘ai systems’) in the union;


### harmonised transparency rules for ai systems intended to interact with natural persons , emotion recognition systems and biometric categorisation systems , and ai systems used to generate or manipulate image , audio or video content; ### harmonised transparency rules for ai systems intended to interact with natural persons and ai systems used to generate or manipulate image , audio or video content;


### harmonised transparency rules for ai systems intended to interact with natural persons , emotion recognition systems and biometric categorisation systems , and ai systems used to generate or manipulate image , audio or video content; ### harmonised transparency rules for ai systems;


### harmonised transparency rules for ai systems intended to interact with natural persons , emotion recognition systems and biometric categorisation systems , and ai systems used to generate or manipulate image , audio or video content; ### harmonised transparency rules for ai systems , including emotion recognition systems and biometric categorisation systems , and ai systems used to generate or manipulate image , audio or video content;


### (8) ‘operator’ means the provider , the user , the authorised representative , the importer and the distributor; ### (8) ‘operator’ means the provider , the deployer , the authorised representative , the importer and the distributor;


### the placing on the market , putting into service or use of an ai system that exploits any of the vulnerabilities of a specific group of persons due to their age , physical or mental disability , in order to materially distort the behaviour of a person pertaining to that group in a manner that causes or is likely to cause that person or another person physical or psychological harm; ### the placing on the market , putting into service or use of an ai system that exploits any of the vulnerabilities of a specific group of persons due to their age , physical or mental disability including addiction , bereavement or distress , in order to materially distort the behaviour of a person pertaining to that group in a manner that causes or is likely to cause that person or another person economic , physical or psychological harm;


### the placing on the market , putting into service or use of an ai system that exploits any of the vulnerabilities of a specific group of persons due to their age , physical or mental disability , in order to materially distort the behaviour of a person pertaining to that group in a manner that causes or is likely to cause that person or another person physical or psychological harm; ### the placing on the market , putting into service or use of an ai system that exploits or may be reasonably foreseen to exploit any of the vulnerabilities of one or several individuals , including ones characteristic of such individuals’ known or predicted personality or social or economic situation , with the effect or likely effect of materially distorting the behaviour of a person in a manner that causes or is likely to cause that person or another person material or non-material harm , including physical , psychological or economic harm;


### the placing on the market , putting into service or use of ai systems by public authorities or on their behalf for the evaluation or classification of the trustworthiness of natural persons over a certain period of time based on their social behaviour or known or predicted personal or personality characteristics , with the social score leading to either or both of the following: ### the development , placing on the market , putting into service , deployment or use of ai systems for the evaluation or classification of the trustworthiness or social standing of natural persons over a certain period of time based on their social behaviour or known , inferred or predicted personal or personality characteristics , potentially leading to detrimental or unfavourable treatment of persons or whole groups;


### the placing on the market , putting into service or use of ai systems by public authorities or on their behalf for the evaluation or classification of the trustworthiness of natural persons over a certain period of time based on their social behaviour or known or predicted personal or personality characteristics , with the social score leading to either or both of the following: ### the placing on the market , putting into service or use of ai systems by public authorities or on their behalf for the evaluation or classification of natural persons over an extended period of time based on their social behaviour or known or predicted personal or personality characteristics (social scoring) ,with the social score leading to either of the following:


### the placing on the market , putting into service or use of ai systems by public authorities or on their behalf for the evaluation or classification of the trustworthiness of natural persons over a certain period of time based on their social behaviour or known or predicted personal or personality characteristics , with the social score leading to either or both of the following: ### the placing on the market , putting into service or use of ai systems for the evaluation or classification of the trustworthiness and social standing of natural persons over a certain period of time based on multiple data points on their social behaviour or known , inferred or predicted personal or personality characteristics , resulting in asocial scoring of natural persons.


### the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purpose of law enforcement , unless and in as far as such use is strictly necessary for one of the following objectives: ### the use of remote biometric identification systems in publicly accessible spaces , including where a space is temporarily used to fulfil a public function


### 4. a member state may decide to provide for the possibility to fully or partially authorise the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purpose of law enforcement within the limits and under the conditions listed in paragraphs 1 , point (d) , 2 and 3. that member state shall lay down in its national law the necessary detailed rules for the request , issuance and exercise of , as well as supervision relating to , the authorisations referred to in paragraph 3. those rules shall also specify in respect of which of the objectives listed in paragraph 1 , point (d) , including which of the criminal offences referred to in point (iii) thereof , the competent authorities may be authorised to use those systems for the purpose of law enforcement. ### deleted


### 8. when implementing the risk management system described in paragraphs 1 to 7 , specific consideration shall be given to whether the high-risk ai system is likely to be accessed by or have an impact on children. ### 8. when implementing the risk management system described in paragraphs 1 to 7 , specific consideration shall be given to whether the high-risk ai system is likely to:


### 1. high-risk ai systems shall be designed and developed with capabilities enabling the automatic recording of events (‘logs’) while the high-risk ai systems is operating. those logging capabilities shall conform to recognised standards or common specifications. ### 1. high-risk ai systems shall be designed and developed with capabilities enabling the automatic recording of events (‘logs’) while the high-risk ai systems is operating. those logging capabilities shall conform to recognised standards or common specifications especially in relation to energy efficiency , resource use , greenhouse gas emissions and the sustainability of data centres.


### 1. high-risk ai systems shall be designed and developed in such a way to ensure that their operation is sufficiently transparent to enable users to interpret the system’s output and use it appropriately. an appropriate type and degree of transparency shall be ensured , with a view to achieving compliance with the relevant obligations of the user and of the provider set out in chapter 3 of this title. ### 1. high-risk ai systems shall be designed and developed in such a way to ensure that their operation is sufficiently transparent to enable users to interpret the system’s output and use it appropriately. an appropriate type and degree of transparency shall be ensured , with a view to achieving compliance with the relevant obligations of the user and of the provider set out in chapter 3 of this title. where individuals are passively subject to ai systems (ai subjects) , information to ensure an appropriate type and degree of transparency shall be made publicly available , with full respect to the privacy , personality , and related rights of subjects.


### 1. high-risk ai systems shall be designed and developed in such a way that they achieve , in the light of their intended purpose , an appropriate level of accuracy , robustness and cybersecurity , and perform consistently in those respects throughout their lifecycle. ### 1. high-risk ai systems shall be designed and developed in such a way that they achieve , in the light of their intended purpose , an appropriate level of accuracy , reliability , robustness and cybersecurity , and perform consistently in those respects throughout their lifecycle.


### 1. high-risk ai systems shall be designed and developed in such a way that they achieve , in the light of their intended purpose , an appropriate level of accuracy , robustness and cybersecurity , and perform consistently in those respects throughout their lifecycle. ### 1. high-risk ai systems shall be designed and developed in such a way that they achieve security by design and by default in the light of their intended purpose , thus reaching an appropriate level of accuracy , robustness , safety and cybersecurity , throughout their lifecycle.


### providers of high-risk ai systems shall , upon request by a national competent authority , provide that authority with all the information and documentation necessary to demonstrate the conformity of the high-risk ai system with the requirements set out in chapter 2 of this title , in an official union language determined by the member state concerned. upon a reasoned request from a national competent authority , providers shall also give that authority access to the logs automatically generated by the high-risk ai system , to the extent such logs are under their control by virtue of a contractual arrangement with the user or otherwise by law. ### providers of high-risk ai systems shall , upon request by a national competent authority , provide that authority with all the information and documentation necessary to demonstrate the conformity of the high-risk ai system with the requirements set out in chapter 2 of this title , one or several official languages determined by the member state concerned. upon a reasoned request from a national competent authority , providers shall also give that authority access to the logs automatically generated by the high-risk ai system , to the extent such logs are under their control by virtue of a contractual arrangement with the user or otherwise by law.


### contribute to uniform administrative practices in the member states , including for the functioning of regulatory sandboxes referred to in article 53; ### contribute to uniform practices in the member states , including by assisting member states , the commission , and , where applicable , other authorities in the establishment , development , and functioning of regulatory sandboxes referred to in article 53 , including by providing input and support in drafting the delegated acts referred to in article 53(6);


### 2. the commission and the board shall encourage and facilitate the drawing up of codes of conduct intended to foster the voluntary application to ai systems of requirements related for example to environmental sustainability , accessibility for persons with a disability , stakeholders participation in the design and development of the ai systems and diversity of development teams on the basis of clear objectives and key performance indicators to measure the achievement of those objectives. ### 2. the commission and the ai office shall encourage and facilitate the drawing up of codes of conduct intended to foster the voluntary application to ai systems of requirements related for example to environmental sustainability , accessibility for persons with a disability , stakeholders participation in the design and development of the ai systems and diversity of development teams on the basis of clear objectives and key performance indicators to measure the achievement of those objectives.


### 2. the commission and the board shall encourage and facilitate the drawing up of codes of conduct intended to foster the voluntary application to ai systems of requirements related for example to environmental sustainability , accessibility for persons with a disability , stakeholders participation in the design and development of the ai systems and diversity of development teams on the basis of clear objectives and key performance indicators to measure the achievement of those objectives. ### 2. the commission and the board shall encourage and facilitate the drawing up of codes of conduct intended to foster the voluntary application to ai systems of requirements related for example a european code for data centre energy efficiency should contain key sustainability indictors related to environmental sustainability , resource usage and energy efficiency , the proportion of energy generated from renewable energy sources and reuse of any heat or waste , accessibility for persons with a disability , stakeholders participation in the design and development of the ai systems and diversity of development teams on the basis of clear objectives and key performance indicators to measure the achievement of those objectives.


### 2. the commission and the board shall encourage and facilitate the drawing up of codes of conduct intended to foster the voluntary application to ai systems of requirements related for example to environmental sustainability , accessibility for persons with a disability , stakeholders participation in the design and development of the ai systems and diversity of development teams on the basis of clear objectives and key performance indicators to measure the achievement of those objectives. ### 2. the commission and the board shall encourage and facilitate the drawing up of codes of conduct intended to foster the voluntary application to ai systems of requirements related for example to environmental sustainability , accessibility for persons with a disability , stakeholders participation in the design and development of the ai systems and diversity and gender-balance of development teams on the basis of clear objectives and key performance indicators to measure the achievement of those objectives.


### 1. in compliance with the terms and conditions laid down in this regulation , member states shall lay down the rules on penalties , including administrative fines , applicable to infringements of this regulation and shall take all measures necessary to ensure that they are properly and effectively implemented. the penalties provided for shall be effective , proportionate , and dissuasive. they shall take into particular account the interests of small-scale providers and start-up and their economic viability. ### 1. in compliance with the terms and conditions laid down in this regulation , member states shall lay down the rules on penalties , including administrative fines , applicable to infringements of this regulation and shall take all measures necessary to ensure that they are properly and effectively implemented. the penalties provided for shall be effective , proportionate , and dissuasive.


### 1. in compliance with the terms and conditions laid down in this regulation , member states shall lay down the rules on penalties , including administrative fines , applicable to infringements of this regulation and shall take all measures necessary to ensure that they are properly and effectively implemented. the penalties provided for shall be effective , proportionate , and dissuasive. they shall take into particular account the interests of small-scale providers and start-up and their economic viability. ### 1. in compliance with the terms and conditions laid down in this regulation , member states shall lay down the rules on penalties , including administrative fines , applicable to infringements of this regulation and shall take all measures necessary to ensure that they are properly and effectively implemented. the penalties provided for shall be effective , proportionate , and dissuasive. they shall take into particular account the interests and size of small-scale providers and start-ups and their economic viability.


### 1. biometric identification and categorisation of natural persons: ### 1. 1.biometric and biometrics-based systems:


### 1. biometric identification and categorisation of natural persons: ### 1. biometric identification , biometrics-based data and categorisation of natural persons:


### ai systems intended to be used for the purpose of determining access or assigning natural persons to educational and vocational training institutions; ### ai systems that may be or are intended to be used for the purpose of determining access or assigning natural persons to educational and vocational training institutions;


### ai systems intended to be used for the purpose of assessing students in educational and vocational training institutions and for assessing participants in tests commonly required for admission to educational institutions. ### ai systems that may be or are intended to be used for the purpose of assessing students in educational and vocational training institutions or for assessing participants in tests commonly required for admission to educational institutions.


### ai systems intended to be used by public authorities or on behalf of public authorities to evaluate the eligibility of natural persons for public assistance benefits and services , as well as to grant , reduce , revoke , or reclaim such benefits and services; ### ai systems that may be or are intended to be used by public authorities or on behalf of public authorities to evaluate the eligibility of natural persons for public assistance benefits and services , as well as to grant , reduce , revoke , or reclaim such benefits and services;


### ai systems intended to be used by public authorities or on behalf of public authorities to evaluate the eligibility of natural persons for public assistance benefits and services , as well as to grant , reduce , revoke , or reclaim such benefits and services; ### ai systems intended to be used by public authorities or on behalf of public authorities to evaluate the eligibility of natural persons for public assistance benefits and services , as well as to grant , reduce , revoke , increase , or reclaim such benefits and services;


### ai systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score , with the exception of ai systems put into service by small scale providers for their own use; ### ai systems that may be or are intended to be used to evaluate the creditworthiness of natural persons or establish their credit score , with the exception of ai systems put into service by small scale providers for their own use;


### ai systems intended to be used to dispatch , or to establish priority in the dispatching of emergency first response services , including by firefighters and medical aid. ### ai systems that may be or are intended to be used to dispatch , or to establish priority in the dispatching of emergency first response services , including by firefighters and medical aid.


### ai systems intended to be used by law enforcement authorities for making individual risk assessments of natural persons in order to assess the risk of a natural person for offending or reoffending or the risk for potential victims of criminal offences; ### deleted


### ai systems intended to be used by law enforcement authorities as polygraphs and similar tools or to detect the emotional state of a natural person; ### deleted


### (89) the european data protection supervisor and the european data protection board were consulted in accordance with article 42(2) of regulation (eu) 2018/1725 and delivered an opinion on […]”. ### (89) the european data protection supervisor and the european data protection board were consulted in accordance with article 42(2) of regulation (eu) 2018/1725 and delivered an opinion on 18.6.2021”.


### this regulation lays down: ### 1.the purpose of this regulation is to ensure a high level of protection of public interests , such as health , safety , fundamental rights , the environment and democracy from harmful effects of artificial intelligence systems ("ai systems") in the union , whether individual , societal or environmental , while enhancing innovation.its provisions are underpinned by the precautionary principle.


### this regulation lays down: ### in the aim of ensuring a high level of protection of public interests , such as health and safety , of the environment and the protection against risks posed to fundamental rights and against potential harms caused by artificial intelligence , either individual , societal or environmental , this regulation lays down:


### rules on market monitoring and surveillance. ### rules on market monitoring , market surveillance and enforcement.


### providers placing on the market or putting into service ai systems in the union , irrespective of whether those providers are established within the union or in a third country; ### providers placing on the market , developing , putting into service or deploying ai systems in the union , irrespective of whether those providers are established within the union or in a third country;


### users of ai systems located within the union; ### deployers of ai systems located or established within the union;


### users of ai systems located within the union; ### users of ai systems located or established within the union;


### providers and users of ai systems that are located in a third country , where the output produced by the system is used in the union; ### providers and users of ai systems that are located in a third country , where the output produced by the system is used in the union or has effects in the union;


### 4. this regulation shall not apply to public authorities in a third country nor to international organisations falling within the scope of this regulation pursuant to paragraph 1 , where those authorities or organisations use ai systems in the framework of international agreements for law enforcement and judicial cooperation with the union or with one or more member states. ### deleted


### 4. this regulation shall not apply to public authorities in a third country nor to international organisations falling within the scope of this regulation pursuant to paragraph 1 , where those authorities or organisations use ai systems in the framework of international agreements for law enforcement and judicial cooperation with the union or with one or more member states. ### 4. this regulation shall not apply to public authorities in a third country nor to international organisations falling within the scope of this regulation pursuant to paragraph 1 , where those authorities or organisations use ai systems in the framework of international agreements for law enforcement and judicial cooperation with the union or with one or more member states and are subject of a decision of the commission adopted in accordance with article 36 of directive (eu)2016/680 or article 45 of regulation 2016/679 (‘adequacy decision’) or are part of an international agreement concluded between the union and that third country or international organisation pursuant to article 218 tfeu adducing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals;


### 4. this regulation shall not apply to public authorities in a third country nor to international organisations falling within the scope of this regulation pursuant to paragraph 1 , where those authorities or organisations use ai systems in the framework of international agreements for law enforcement and judicial cooperation with the union or with one or more member states. ### 4. this regulation shall not apply to public authorities in a third country nor to international organisations falling within the scope of this regulation pursuant to paragraph 1 , except where those authorities or organisations use ai systems in the framework of international agreements for law enforcement and judicial cooperation with the union or with one or more member states.


### (15) ‘instructions for use’ means the information provided by the provider to inform the user of in particular an ai system’s intended purpose and proper use , inclusive of the specific geographical , behavioural or functional setting within which the high-risk ai system is intended to be used; ### (15) ‘instructions for use’ means the information provided by the provider to inform the deployer of in particular an ai system’s intended purpose and proper use , inclusive of the specific geographical , behavioural or functional setting within which the high-risk ai system is intended to be used;


### (16) ‘recall of an ai system’ means any measure aimed at achieving the return to the provider of an ai system made available to users; ### (16) ‘recall of an ai system’ means any measure aimed at achieving the return to the provider of an ai system made available to deployers;


### (20) ‘conformity assessment’ means the process of verifying whether the requirements set out in title iii , chapter 2 of this regulation relating to an ai system have been fulfilled; ### (20) ‘conformity assessment’ means the process of verification by an independent third party whether the principles and requirements set out in title iii , chapter 2 of this regulation relating to an ai system have been fulfilled;


### (20) ‘conformity assessment’ means the process of verifying whether the requirements set out in title iii , chapter 2 of this regulation relating to an ai system have been fulfilled; ### (20) ‘conformity assessment’ means the process of verifying whether the principles and requirements set out in title iii , chapter 2 of this regulation relating to an ai system have been fulfilled;


### (23) ‘substantial modification’ means a change to the ai system following its placing on the market or putting into service which affects the compliance of the ai system with the requirements set out in title iii , chapter 2 of this regulation or results in a modification to the intended purpose for which the ai system has been assessed; ### (23) ‘substantial modification’ means a change to the ai system following its placing on the market or putting into service which affects the compliance of the ai system with the requirements set out in title iii , chapter 2 of this regulation or results in a modification to the intended purpose for which the ai system has been assessed or to its performance , including modifications of the intended purpose of an ai system which is not classified as high-risk and is already placed on the market or put into service;


### (23) ‘substantial modification’ means a change to the ai system following its placing on the market or putting into service which affects the compliance of the ai system with the requirements set out in title iii , chapter 2 of this regulation or results in a modification to the intended purpose for which the ai system has been assessed; ### (23) ‘substantial modification’ means a change to the ai system following its placing on the market or putting into service which affects the compliance of the ai system with the requirements set out in title iii , chapter 2 of this regulation or results in a modification to the intended purpose for which the ai system has been assessed or to its performance , including modifications of the intended purpose of an ai system which is not classified as high-risk and is already placed on the market or put into service.


### (28) ‘common specifications’ means a document , other than a standard , containing technical solutions providing a means to , comply with certain requirements and obligations established under this regulation; ### (28) ‘common specifications’ means a document , other than a standard , containing technical solutions providing a means to , comply with certain requirements and obligations established under this regulation and horizontal union legislation;


### (29) ‘training data’ means data used for training an ai system through fitting its learnable parameters , including the weights of a neural network; ### (29) ‘training data’ means data used for training an ai system through fitting its learnable parameters;


### (30) ‘validation data’ means data used for providing an evaluation of the trained ai system and for tuning its non-learnable parameters and its learning process , among other things , in order to prevent overfitting; whereas the validation dataset can be a separate dataset or part of the training dataset , either as a fixed or variable split; ### (30) ‘validation data’ means data used for providing an evaluation of the trained ai system and for tuning its non-learnable parameters and its learning process , whereas the validation dataset can be a separate dataset or part of the training dataset , either as a fixed or variable split;


### (33) ‘biometric data’ means personal data resulting from specific technical processing relating to the physical , physiological or behavioural characteristics of a natural person , which allow or confirm the unique identification of that natural person , such as facial images or dactyloscopic data; ### (33) ‘biometric data’ means personal data resulting from specific technical processing relating to the physical , physiological or behavioural characteristics of a natural person , such as facial images or dactyloscopic data;


### (34) ‘emotion recognition system’ means an ai system for the purpose of identifying or inferring emotions or intentions of natural persons on the basis of their biometric data; ### (34) ‘emotion recognition system’ means an ai system for the purpose of identifying or inferring emotions , thoughts , states of mind , or intentions of natural persons on the basis of their biometric or biometrics-based data , whether or not allowing or confirming identification of a natural person;


### 1. where , within three months of receipt of the notification referred to in article 65(5) , objections are raised by a member state against a measure taken by another member state , or where the commission considers the measure to be contrary to union law , the commission shall without delay enter into consultation with the relevant member state and operator or operators and shall evaluate the national measure. on the basis of the results of that evaluation , the commission shall decide whether the national measure is justified or not within 9 months from the notification referred to in article 65(5) and notify such decision to the member state concerned. ### 1. where , within three months of receipt of the notification referred to in article 65(5) , objections are raised by a member state against a measure taken by another member state , or where the board considers the measure to be contrary to union law , the board shall without delay enter into consultation with the relevant member state and operator or operators and shall evaluate the national measure. on the basis of the results of that evaluation , the board shall decide whether the national measure is justified or not within 9 months from the notification referred to in article 65(5) and notify such decision to the member state concerned.


### 2. if the national measure is considered justified , all member states shall take the measures necessary to ensure that the non-compliant ai system is withdrawn from their market , and shall inform the commission accordingly. if the national measure is considered unjustified , the member state concerned shall withdraw the measure. ### 2. if the national measure is considered justified , all member states shall take the measures necessary to ensure that the non-compliant ai system is withdrawn from their market , and shall inform the board accordingly. if the national measure is considered unjustified , the member state concerned shall withdraw the measure.


### 3. the member state shall immediately inform the commission and the other member states. that information shall include all available details , in particular the data necessary for the identification of the ai system concerned , the origin and the supply chain of the ai system , the nature of the risk involved and the nature and duration of the national measures taken. ### 3. the member state shall immediately inform the commission , the ai office , and the other member states. that information shall include all available details , in particular the data necessary for the identification of the ai system concerned , the origin and the supply chain of the ai system , the nature of the risk involved and the nature and duration of the national measures taken.


### 3. the member state shall immediately inform the commission and the other member states. that information shall include all available details , in particular the data necessary for the identification of the ai system concerned , the origin and the supply chain of the ai system , the nature of the risk involved and the nature and duration of the national measures taken. ### 3. the member state shall immediately inform the board and the other member states. that information shall include all available details , in particular the data necessary for the identification of the ai system concerned , the origin and the supply chain of the ai system , the nature of the risk involved and the nature and duration of the national measures taken.


### 4. the commission shall without delay enter into consultation with the member states and the relevant operator and shall evaluate the national measures taken. on the basis of the results of that evaluation , the commission shall decide whether the measure is justified or not and , where necessary , propose appropriate measures. ### 4. the board shall without delay enter into consultation with the member states and the relevant operator and shall evaluate the national measures taken. on the basis of the results of that evaluation , the board shall decide whether the measure is justified or not and , where necessary , propose appropriate measures.


### 5. the commission shall address its decision to the member states. ### 5. the board shall address its decision to the member states.


### 4. the commission and the board shall take into account the specific interests and needs of the small-scale providers and start-ups when encouraging and facilitating the drawing up of codes of conduct. ### 4. the commission and the ai office shall take into account the specific interests and needs of the small-scale providers and start-ups when encouraging and facilitating the drawing up of codes of conduct.


### 4. the commission and the board shall take into account the specific interests and needs of the small-scale providers and start-ups when encouraging and facilitating the drawing up of codes of conduct. ### 4. the commission and the board shall take into account the specific interests and needs of the small-scale providers , smes and start-ups when encouraging and facilitating the drawing up of codes of conduct.


### intellectual property rights , and confidential business information or trade secrets of a natural or legal person , including source code , except the cases referred to in article 5 of directive 2016/943 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition , use and disclosure apply. ### confidential business information or trade secrets of a natural or legal person , except the cases referred to in article 5 of directive 2016/943 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition , use and disclosure apply.


### 2. without prejudice to paragraph 1 , information exchanged on a confidential basis between the national competent authorities and between national competent authorities and the commission shall not be disclosed without the prior consultation of the originating national competent authority and the user when high-risk ai systems referred to in points 1 , 6 and 7 of annex iii are used by law enforcement , immigration or asylum authorities , when such disclosure would jeopardise public and national security interests. ### 2. without prejudice to paragraph 1 , information exchanged on a confidential basis between the national competent authorities and between national competent authorities and the commission shall not be disclosed without the prior consultation of the originating national competent authority and the deployer when high-risk ai systems referred to in points 1 , 6 and 7 of annex iii are used by law enforcement , immigration or asylum authorities , when such disclosure would jeopardise public or national security.


### 3. the following infringements shall be subject to administrative fines of up to 30 000 000 eur or , if the offender is company , up to 6 % of its total worldwide annual turnover for the preceding financial year , whichever is higher: ### 3. non-compliance with the prohibition of the artificial intelligence practices referred to in article 5 shall be subject to administrative fines of up to 30 000 000 eur or , if the offender is a company , up to 6 % of its total worldwide annual turnover for the preceding financial year , whichever is higher;


### non-compliance with the prohibition of the artificial intelligence practices referred to in article 5; ### deleted


### non-compliance of the ai system with the requirements laid down in article 10. ### deleted


### 4. the non-compliance of the ai system with any requirements or obligations under this regulation , other than those laid down in articles 5 and 10 , shall be subject to administrative fines of up to 20 000 000 eur or , if the offender is a company , up to 4 % of its total worldwide annual turnover for the preceding financial year , whichever is higher. ### 4. the non-compliance of the ai system with any requirements or obligations under this regulation , other than those laid down in articles 5 and 10 , shall be subject to administrative fines of up to 20 000 000 eur or , if the offender is a company , up to 6 % of its total worldwide annual turnover for the preceding financial year , whichever is higher.


### 4. the non-compliance of the ai system with any requirements or obligations under this regulation , other than those laid down in articles 5 and 10 , shall be subject to administrative fines of up to 20 000 000 eur or , if the offender is a company , up to 4 % of its total worldwide annual turnover for the preceding financial year , whichever is higher. ### 4. non-compliance of the ai system with any requirements or obligations under this regulation , other than those laid down in articles 5 and 10 , shall be subject to administrative fines of up to 10 000 000 eur or , if the offender is a company , up to 2 % of its total worldwide annual turnover for the preceding financial year , whichever is higher.


### 5. the supply of incorrect , incomplete or misleading information to notified bodies and national competent authorities in reply to a request shall be subject to administrative fines of up to 10 000 000 eur or , if the offender is a company , up to 2 % of its total worldwide annual turnover for the preceding financial year , whichever is higher. ### 5. the supply of incorrect , incomplete or misleading information to notified bodies and national competent authorities in reply to a request shall be subject to administrative fines of up to 10 000 000 eur or , if the offender is a company , up to 4 % of its total worldwide annual turnover for the preceding financial year , whichever is higher.


### 7. each member state shall lay down rules on whether and to what extent administrative fines may be imposed on public authorities and bodies established in that member state. ### 7. each member state shall lay down rules on administrative fines to be imposed on public authorities and bodies established in that member state , with a view to ensure compliance with this regulation.


### 2. the following infringements shall be subject to administrative fines of up to 500 000 eur: ### 2. non-compliance with the prohibition of the artificial intelligence practices referred to in article 5 shall be subject to administrative fines of up to 1.000 000 eur;


### 3. the non-compliance of the ai system with any requirements or obligations under this regulation , other than those laid down in articles 5 and 10 , shall be subject to administrative fines of up to 250 000 eur. ### 3. the non-compliance of the ai system with any requirements or obligations under this regulation , other than those laid down in articles 5 and 10 , shall be subject to administrative fines of up to 300 000 eur.


### 4. as soon as it adopts a delegated act , the commission shall notify it simultaneously to the european parliament and to the council. ### 4. once the commission decides to draft a delegated act , it shall notify the european parliament of this fact. this notification does not place an obligation on the commission to adopt the said act. i as soon as it adopts a delegated act , the commission shall notify it simultaneously to the european parliament and to the council.


### 4. as soon as it adopts a delegated act , the commission shall notify it simultaneously to the european parliament and to the council. ### 4. as soon as it adopts a delegated act , the commission shall notify it simultaneously to the european parliament , the council , and the ai office.


### 1. this regulation shall not apply to the ai systems which are components of the large-scale it systems established by the legal acts listed in annex ix that have been placed on the market or put into service before [12 months after the date of application of this regulation referred to in article 85(2)] , unless the replacement or amendment of those legal acts leads to a significant change in the design or intended purpose of the ai system or ai systems concerned. ### 1. operators of the ai systems which are components of the large-scale it systems established by the legal acts listed in annex ix that have been placed on the market or put into service before [the date of application of this regulation referred to in article 85(2)] shall take the necessary steps to comply with the requirements of the present regulation within 4 years of its entry into force.


### 1. this regulation shall not apply to the ai systems which are components of the large-scale it systems established by the legal acts listed in annex ix that have been placed on the market or put into service before [12 months after the date of application of this regulation referred to in article 85(2)] , unless the replacement or amendment of those legal acts leads to a significant change in the design or intended purpose of the ai system or ai systems concerned. ### 1. this regulation shall apply to the ai systems which are components of the large-scale it systems established by the legal acts listed in annex ix starting [ on the date of application of this regulation referred to in article 85(2)] , or as soon as there is a significant change in the design or intended purpose of the ai system or ai systems concerned in which case it shall apply from [the date of application of this regulation]


### 1. this regulation shall not apply to the ai systems which are components of the large-scale it systems established by the legal acts listed in annex ix that have been placed on the market or put into service before [12 months after the date of application of this regulation referred to in article 85(2)] , unless the replacement or amendment of those legal acts leads to a significant change in the design or intended purpose of the ai system or ai systems concerned. ### 1. this regulation shall apply to the ai systems which are components of the large-scale it systems established by the legal acts listed in annex ix starting [12 months after the date of application of this regulation referred to in article 85(2)] , or as soon as there is a significant change in the design or intended purpose of the ai system or ai systems concerned in which case it shall apply from [the date of application of this regulation].


### (42) to mitigate the risks from high-risk ai systems placed or otherwise put into service on the union market for users and affected persons , certain mandatory requirements should apply , taking into account the intended purpose of the use of the system and according to the risk management system to be established by the provider. ### (42) to mitigate the risks from high-risk ai systems placed or otherwise put into service on the union market for users and affected persons , certain mandatory requirements should apply , taking into account the intended purpose of the use of the system and according to the risk management system to be established by the provider. these requirements should be objective-driven , fit to purpose , reasonable and effective , without adding undue regulatory burdens or costs on operators.


### (42) to mitigate the risks from high-risk ai systems placed or otherwise put into service on the union market for users and affected persons , certain mandatory requirements should apply , taking into account the intended purpose of the use of the system and according to the risk management system to be established by the provider. ### (42) to mitigate the risks from high-risk ai systems placed or otherwise put into service on the union market for deployers and ai subjects , certain mandatory requirements should apply , taking into account the intended purpose , the potential or reasonably foreseeable use or misuse of the system , and should be in accordance with the risk management system to be established by the provider.


### (46) having information on how high-risk ai systems have been developed and how they perform throughout their lifecycle is essential to verify compliance with the requirements under this regulation. this requires keeping records and the availability of a technical documentation , containing information which is necessary to assess the compliance of the ai system with the relevant requirements. such information should include the general characteristics , capabilities and limitations of the system , algorithms , data , training , testing and validation processes used as well as documentation on the relevant risk management system. the technical documentation should be kept up to date. ### (46) having information on how high-risk ai systems have been developed and how they perform throughout their lifecycle is essential to verify compliance with the requirements under this regulation. this requires keeping records and the availability of a technical documentation , containing information which is necessary to assess the compliance of the ai system with the relevant requirements. such information should include the general characteristics , capabilities and limitations of the system , algorithms , data , training , testing and validation processes used as well as documentation on the relevant risk management system. the technical documentation should be kept up to date throughout the entire lifecycle of the ai system.


### (46) having information on how high-risk ai systems have been developed and how they perform throughout their lifecycle is essential to verify compliance with the requirements under this regulation. this requires keeping records and the availability of a technical documentation , containing information which is necessary to assess the compliance of the ai system with the relevant requirements. such information should include the general characteristics , capabilities and limitations of the system , algorithms , data , training , testing and validation processes used as well as documentation on the relevant risk management system. the technical documentation should be kept up to date. ### (46) having information on how high-risk ai systems have been developed and how they perform throughout their lifecycle is essential to verify compliance with the requirements that should include a multicriteria environmental lifecycle assessment under this regulation. this requires keeping records and the availability of a technical documentation , containing information which is necessary to assess the compliance of the ai system with the relevant requirements. such information should include the general characteristics , capabilities and limitations of the system , algorithms , data , training , testing and validation processes used as well as documentation on the relevant risk management system. the technical documentation should be kept up to date.


### (47) to address the opacity that may make certain ai systems incomprehensible to or too complex for natural persons , a certain degree of transparency should be required for high-risk ai systems. users should be able to interpret the system output and use it appropriately. high-risk ai systems should therefore be accompanied by relevant documentation and instructions of use and include concise and clear information , including in relation to possible risks to fundamental rights and discrimination , where appropriate. ### (47) to address the opacity that may make certain ai systems incomprehensible to or too complex for natural persons , a certain degree of transparency should be required for high-risk ai systems. deployers should be able to interpret the system’s goals , priorities and output and use it appropriately. high-risk ai systems should therefore be accompanied by relevant documentation and instructions of use and include concise and clear information , including in relation to possible risks to fundamental rights and discrimination , where appropriate. where individuals are passively subject to ai systems (ai subjects) , information to ensure an appropriate type and degree of transparency should be made publicly available , with full respect to the privacy , personality , and related rights of subjects.


### (49) high-risk ai systems should perform consistently throughout their lifecycle and meet an appropriate level of accuracy , robustness and cybersecurity in accordance with the generally acknowledged state of the art. the level of accuracy and accuracy metrics should be communicated to the users. ### (49) high-risk ai systems should perform consistently throughout their lifecycle and meet an appropriate level of accuracy , robustness , reliability and security in accordance with the generally acknowledged state of the art. the level of accuracy and accuracy metrics should be communicated to the deployers.


### (49) high-risk ai systems should perform consistently throughout their lifecycle and meet an appropriate level of accuracy , robustness and cybersecurity in accordance with the generally acknowledged state of the art. the level of accuracy and accuracy metrics should be communicated to the users. ### (49) high-risk ai systems should perform consistently throughout their environmental lifecycle and meet a high level of accuracy , robustness and cybersecurity in accordance with the generally acknowledged state of the art. the level of energy efficiency and resource use , accuracy and accuracy metrics should be communicated to the users.


### (50) the technical robustness is a key requirement for high-risk ai systems. they should be resilient against risks connected to the limitations of the system (e.g. errors , faults , inconsistencies , unexpected situations) as well as against malicious actions that may compromise the security of the ai system and result in harmful or otherwise undesirable behaviour. failure to protect against these risks could lead to safety impacts or negatively affect the fundamental rights , for example due to erroneous decisions or wrong or biased outputs generated by the ai system. ### (50) technical robustness is a key requirement for high-risk ai systems. they should be resilient against risks connected to the limitations of the system (e.g. errors , faults , inconsistencies , unexpected situations) as well as adequately protected against malicious actions that may compromise the security of the ai system and result in harmful or otherwise undesirable behaviour. failure to protect against these risks could lead to safety impacts or negatively affect fundamental rights , for example due to erroneous decisions or wrong or biased outputs generated by the ai system.


### (53) it is appropriate that a specific natural or legal person , defined as the provider , takes the responsibility for the placing on the market or putting into service of a high-risk ai system , regardless of whether that natural or legal person is the person who designed or developed the system. ### (53) it is appropriate that a specific natural or legal person , defined as the provider , takes the responsibility for the placing on the market , putting into service or deploying of a high-risk ai system , regardless of whether that natural or legal person is the person who designed or developed the system.


### estimation and evaluation of the risks that may emerge when the high-risk ai system is used in accordance with its intended purpose and under conditions of reasonably foreseeable misuse; ### estimation and evaluation of the risks that may emerge when the high-risk ai system is used in accordance with its intended purpose and under conditions of reasonably foreseeable use or misuse;


### adoption of suitable risk management measures in accordance with the provisions of the following paragraphs. ### adoption of risk management measures in accordance with the provisions of the following paragraphs.


### (7) the notion of biometric data used in this regulation is in line with and should be interpreted consistently with the notion of biometric data as defined in article 4(14) of regulation (eu) 2016/679 of the european parliament and of the council35 , article 3(18) of regulation (eu) 2018/1725 of the european parliament and of the council36 and article 3(13) of directive (eu) 2016/680 of the european parliament and of the council37 . ### (7) the notion of biometric data used in this regulation is in line with and should be interpreted consistently with the notion of biometric data as defined in article 4(14) of regulation (eu) 2016/679 of the european parliament and of the council35 , article 3(18) of regulation (eu) 2018/1725 of the european parliament and of the council36 and article 3(13) of directive (eu) 2016/680 of the european parliament and of the council37 . the notion of “biometrics-based data” is broader , covering situations where the data in question may not , of itself , confirm the unique identification of an individual.


### (10) in order to ensure a level playing field and an effective protection of rights and freedoms of individuals across the union , the rules established by this regulation should apply to providers of ai systems in a non-discriminatory manner , irrespective of whether they are established within the union or in a third country , and to users of ai systems established within the union. ### (10) in order to ensure a level playing field and an effective protection of rights and freedoms of individuals across the union , the rules established by this regulation should apply to providers of ai systems in a non-discriminatory manner , irrespective of whether they are established within the union or in a third country , and to deployers of ai systems established within the union. this regulation and the rules it establishes should take into account different development and business models and the fact that standard implementations , or free and open source software development and licensing models might entail less knowledge about and little to no control over further use , modification , and deployment within an ai system.


### (11) in light of their digital nature , certain ai systems should fall within the scope of this regulation even when they are neither placed on the market , nor put into service , nor used in the union. this is the case for example of an operator established in the union that contracts certain services to an operator established outside the union in relation to an activity to be performed by an ai system that would qualify as high-risk and whose effects impact natural persons located in the union. in those circumstances , the ai system used by the operator outside the union could process data lawfully collected in and transferred from the union , and provide to the contracting operator in the union the output of that ai system resulting from that processing , without that ai system being placed on the market , put into service or used in the union. to prevent the circumvention of this regulation and to ensure an effective protection of natural persons located in the union , this regulation should also apply to providers and users of ai systems that are established in a third country , to the extent the output produced by those systems is used in the union. nonetheless , to take into account existing arrangements and special needs for cooperation with foreign partners with whom information and evidence is exchanged , this regulation should not apply to public authorities of a third country and international organisations when acting in the framework of international agreements concluded at national or european level for law enforcement and judicial cooperation with the union or with its member states. such agreements have been concluded bilaterally between member states and third countries or between the european union , europol and other eu agencies and third countries and international organisations. ### (11) in light of their digital nature , certain ai systems should fall within the scope of this regulation even when they are neither placed on the market , nor put into service , nor used in the union. this is the case for example of an operator established in the union that contracts certain services to an operator established outside the union in relation to an activity to be performed by an ai system that would qualify as high-risk and whose effects impact natural persons located in the union. in those circumstances , the ai system used by the operator outside the union could process data lawfully collected in and transferred from the union , and provide to the contracting operator in the union the output of that ai system resulting from that processing , without that ai system being placed on the market , put into service or used in the union. to prevent the circumvention of this regulation and to ensure an effective protection of natural persons located in the union , this regulation should also apply to providers and deployers of ai systems that are established in a third country , to the extent the output produced by those systems is used in the union or affects people in the union.


### (11) in light of their digital nature , certain ai systems should fall within the scope of this regulation even when they are neither placed on the market , nor put into service , nor used in the union. this is the case for example of an operator established in the union that contracts certain services to an operator established outside the union in relation to an activity to be performed by an ai system that would qualify as high-risk and whose effects impact natural persons located in the union. in those circumstances , the ai system used by the operator outside the union could process data lawfully collected in and transferred from the union , and provide to the contracting operator in the union the output of that ai system resulting from that processing , without that ai system being placed on the market , put into service or used in the union. to prevent the circumvention of this regulation and to ensure an effective protection of natural persons located in the union , this regulation should also apply to providers and users of ai systems that are established in a third country , to the extent the output produced by those systems is used in the union. nonetheless , to take into account existing arrangements and special needs for cooperation with foreign partners with whom information and evidence is exchanged , this regulation should not apply to public authorities of a third country and international organisations when acting in the framework of international agreements concluded at national or european level for law enforcement and judicial cooperation with the union or with its member states. such agreements have been concluded bilaterally between member states and third countries or between the european union , europol and other eu agencies and third countries and international organisations. ### (11) in light of their digital nature , certain ai systems should fall within the scope of this regulation even when they are neither placed on the market , nor put into service , nor used in the union. this is the case for example of an operator established in the union that contracts certain services to an operator established outside the union in relation to an activity to be performed by an ai system that would qualify as high-risk and whose effects impact natural persons located in the union. in those circumstances , the ai system used by the operator outside the union could process data lawfully collected in and transferred from the union , and provide to the contracting operator in the union the output of that ai system resulting from that processing , without that ai system being placed on the market , put into service or used in the union. to prevent the circumvention of this regulation and to ensure an effective protection of natural persons located in the union , this regulation should also apply to providers and users of ai systems that are established in a third country , to the extent the output produced by those systems is used in the union. nonetheless , to take into account existing arrangements and special needs for cooperation with foreign partners with whom information and evidence is exchanged , this regulation should not apply to public authorities of a third country and international organisations when acting in the framework of international agreements concluded at national or european level for law enforcement and judicial cooperation with the union or with its member states. such agreements have been concluded bilaterally between member states and third countries or between the european union , europol and other eu agencies and third countries and international organisations. this exception should nevertheless be limited to trusted countries and international organizations that share the union’s values.


### (12) this regulation should also apply to union institutions , offices , bodies and agencies when acting as a provider or user of an ai system. ai systems exclusively developed or used for military purposes should be excluded from the scope of this regulation where that use falls under the exclusive remit of the common foreign and security policy regulated under title v of the treaty on the european union (teu). this regulation should be without prejudice to the provisions regarding the liability of intermediary service providers set out in directive 2000/31/ec of the european parliament and of the council [as amended by the digital services act]. ### (12) this regulation should also apply to union institutions , offices , bodies and agencies when acting as a provider or deployer of an ai system. this regulation should be without prejudice to the provisions regarding the liability of intermediary service providers set out in directive 2000/31/ec of the european parliament and of the council [as amended by the digital services act].


### 2. where a distributor considers or has reason to consider that a high-risk ai system is not in conformity with the requirements set out in chapter 2 of this title , it shall not make the high-risk ai system available on the market until that system has been brought into conformity with those requirements. furthermore , where the system presents a risk within the meaning of article 65(1) , the distributor shall inform the provider or the importer of the system , as applicable , to that effect. ### 2. where a distributor considers or has reason to consider that a high-risk ai system is not in conformity with the requirements set out in chapter 2 of this title , it shall not make the high-risk ai system available on the market until that system has been brought into conformity with those requirements. furthermore , where the system presents a risk within the meaning of article 65(1) , the distributor shall inform the market surveillance authority and the provider or the importer of the system , as applicable , to that effect.


### 2. where a distributor considers or has reason to consider that a high-risk ai system is not in conformity with the requirements set out in chapter 2 of this title , it shall not make the high-risk ai system available on the market until that system has been brought into conformity with those requirements. furthermore , where the system presents a risk within the meaning of article 65(1) , the distributor shall inform the provider or the importer of the system , as applicable , to that effect. ### 2. where a distributor considers or has reason to consider that a high-risk ai system is not in conformity with the requirements set out in chapter 2 of this title , it shall not make the high-risk ai system available on the market until that system has been brought into conformity with those requirements. furthermore , where the system presents a risk within the meaning of article 65(1) , the distributor shall inform the competent authorities and the provider or the importer of the system , as applicable , to that effect.


### 4. a distributor that considers or has reason to consider that a high-risk ai system which it has made available on the market is not in conformity with the requirements set out in chapter 2 of this title shall take the corrective actions necessary to bring that system into conformity with those requirements , to withdraw it or recall it or shall ensure that the provider , the importer or any relevant operator , as appropriate , takes those corrective actions. where the high-risk ai system presents a risk within the meaning of article 65(1) , the distributor shall immediately inform the national competent authorities of the member states in which it has made the product available to that effect , giving details , in particular , of the non-compliance and of any corrective actions taken. ### 4. a distributor that considers or has reason to consider that a high-risk ai system which it has made available on the market is not in conformity with the requirements set out in chapter 2 of this title shall take the corrective actions necessary to bring that system into conformity with those requirements , to withdraw it or recall it or shall ensure that the provider , the importer or any relevant operator , as appropriate , takes those corrective actions. where the high-risk ai system presents a risk within the meaning of article 65(1) , the distributor shall immediately inform the competent authorities of the member states in which it has made the product available to that effect , giving details , in particular , of the non-compliance and of any corrective actions taken.


### 5. upon a reasoned request from a national competent authority , distributors of high-risk ai systems shall provide that authority with all the information and documentation necessary to demonstrate the conformity of a high-risk system with the requirements set out in chapter 2 of this title. distributors shall also cooperate with that national competent authority on any action taken by that authority. ### 5. upon a reasoned request from a national competent authority , distributors of high-risk ai systems shall provide that authority with all the information and documentation in its possession or available to it , in accordance with the obligations of distributors as outlined by this regulation , that are necessary to demonstrate the conformity of a high-risk system with the requirements set out in chapter 2 of this title. distributors shall also cooperate with that national competent authority on any action taken by that authority.


### 5. upon a reasoned request from a national competent authority , distributors of high-risk ai systems shall provide that authority with all the information and documentation necessary to demonstrate the conformity of a high-risk system with the requirements set out in chapter 2 of this title. distributors shall also cooperate with that national competent authority on any action taken by that authority. ### 5. upon request from a competent authority , distributors of high-risk ai systems shall provide that authority with all the information and documentation necessary to demonstrate the conformity of a high-risk system with the requirements set out in chapter 2 of this title. distributors shall also cooperate with that competent authority on any action taken by that authority.


### 5. upon a reasoned request from a national competent authority , distributors of high-risk ai systems shall provide that authority with all the information and documentation necessary to demonstrate the conformity of a high-risk system with the requirements set out in chapter 2 of this title. distributors shall also cooperate with that national competent authority on any action taken by that authority. ### 5. upon a reasoned request from a national competent authority , distributors of high-risk ai systems shall provide that authority with all the information and documentation necessary to demonstrate the conformity of a high-risk system with the requirements set out in chapter 2 of this title. distributors shall also cooperate with that competent authority on any action taken by that authority.


### obligations of distributors , importers , users or any other third-party ### obligations of distributors , importers , deployers or any other third-party


### 1. any distributor , importer , user or other third-party shall be considered a provider for the purposes of this regulation and shall be subject to the obligations of the provider under article 16 , in any of the following circumstances: ### 1. any distributor , importer , deployer or other third-party shall be considered a provider for the purposes of this regulation and shall be subject to the obligations of the provider under article 16 , in any of the following circumstances:


### 29 obligations of users of high-risk ai systems ### 29 obligations of deployers of high-risk ai systems


### obligations of users of high-risk ai systems ### obligations of deployers of high-risk ai systems


### 2. the obligations in paragraph 1 are without prejudice to other user obligations under union or national law and to the user’s discretion in organising its own resources and activities for the purpose of implementing the human oversight measures indicated by the provider. ### 2. the obligations in paragraph 1 are without prejudice to other deployer obligations under union or national law and shall take due account of the deployer's discretion in organising its own resources and activities for the purpose of implementing the human oversight measures indicated by the provider.


### 3. without prejudice to paragraph 1 , to the extent the user exercises control over the input data , that user shall ensure that input data is relevant in view of the intended purpose of the high-risk ai system. ### 3. without prejudice to paragraph 1 , to the extent the user exercises control over the input data , that user shall ensure that input data is relevant in view of the intended purpose of the high-risk ai system. to the extent the user exercises control over the high-risk ai system , that user shall also ensure that relevant and appropriate robustness and cybersecurity measures are in place and are regularly adjusted or updated.


### 5. users of high-risk ai systems shall keep the logs automatically generated by that high-risk ai system , to the extent such logs are under their control. the logs shall be kept for a period that is appropriate in the light of the intended purpose of the high-risk ai system and applicable legal obligations under union or national law. ### 5. users of high-risk ai systems shall keep the logs automatically generated by that high-risk ai system , to the extent such logs are under their control. the logs shall be kept for a period of at least ten years , or as long as is appropriate in the light of the intended purpose of the high-risk ai system and applicable legal obligations under union or national law.


### there are effective monitoring mechanisms to identify if any high risks to the fundamental rights of the data subjects may arise during the sandbox experimentation as well as response mechanism to promptly mitigate those risks and , where necessary , stop the processing; ### there are effective monitoring mechanisms to identify if any risks to the fundamental rights of the data subjects and holders of intellectual property rights or trade secrets may arise during the sandbox experimentation as well as response mechanism to promptly mitigate those risks and , where necessary , stop the processing;


### any personal data to be processed in the context of the sandbox are in a functionally separate , isolated and protected data processing environment under the control of the participants and only authorised persons have access to that data; ### any personal data or data protected by intellectual property rights or trade secrets to be processed in the context of the sandbox are in a functionally separate , isolated and protected data processing environment under the control of the participants and only authorised persons have access to those data;


### any personal data processed are not be transmitted , transferred or otherwise accessed by other parties; ### any personal data or data protected by intellectual property rights or trade secrets processed are not be transmitted , transferred or otherwise accessed by other parties;


### any personal data processed in the context of the sandbox are deleted once the participation in the sandbox has terminated or the personal data has reached the end of its retention period; ### any personal data or data protected by intellectual property rights or trade secrets processed in the context of the sandbox are deleted once the participation in the sandbox has terminated or the personal data has reached the end of its retention period;


### the logs of the processing of personal data in the context of the sandbox are kept for the duration of the participation in the sandbox and 1 year after its termination , solely for the purpose of and only as long as necessary for fulfilling accountability and documentation obligations under this article or other application union or member states legislation; ### the logs of the processing of personal data or data protected by intellectual property rights or trade secrets in the context of the sandbox are kept for the duration of the participation in the sandbox and 1 year after its termination , solely for the purpose of and only as long as necessary for fulfilling accountability and documentation obligations under this article or other applicable union or member states legislation;


### a short summary of the ai project developed in the sandbox , its objectives and expected results published on the website of the competent authorities. ### a short summary of the ai project developed in the sandbox , its objectives , hypotheses and expected results , and non-confidential testing results , is published on the website of the competent authorities.


### a short summary of the ai project developed in the sandbox , its objectives and expected results published on the website of the competent authorities. ### a short summary of the ai system developed in the sandbox , its objectives and expected results published on the website of the competent authorities.


### 2. paragraph 1 is without prejudice to union or member states legislation excluding processing for other purposes than those explicitly mentioned in that legislation. ### 2. paragraph 1 further specifies article 89 of regulation (eu) 2016/679 and is without prejudice to union or member states legislation excluding processing for other purposes than those explicitly mentioned in that legislation or to union or member states legislation excluding the use of data protected by intellectual property or trade secrets under the conditions covered by paragraph 1.


### 1 european artificial intelligence board ### 1 european artificial intelligence office


### establishment of the european artificial intelligence board ### establishment of the european artificial intelligence office


### 1. a ‘european artificial intelligence board’ (the ‘board’) is established. ### deleted


### 2. the board shall provide advice and assistance to the commission in order to: ### deleted


### article 57 ### deleted


### 2. the board shall adopt its rules of procedure by a simple majority of its members , following the consent of the commission. the rules of procedure shall also contain the operational aspects related to the execution of the board’s tasks as listed in article 58. the board may establish sub-groups as appropriate for the purpose of examining specific questions. ### 2. the board shall adopt its rules of procedure by two-thirds majority and shall take decisions by a simple majority of its members. the rules of procedure shall also contain the operational aspects related to the execution of the board’s tasks as listed in article 58. the board may establish sub-groups as appropriate for the purpose of examining specific questions.


### tasks of the board ### tasks


### when providing advice and assistance to the commission in the context of article 56(2) , the board shall in particular: ### in fulfilling its objectives , the ai office shall in particular:


### when providing advice and assistance to the commission in the context of article 56(2) , the board shall in particular: ### 1. when providing advice and assistance to the commission in the context of article 56(2) , the board shall in particular:


### issue opinions , recommendations or written contributions on matters related to the implementation of this regulation , in particular ### issue opinions , recommendations , written contributions , or studies on matters related to the technical specifications or existing standards regarding the requirements set out in title iii , chapter 2 and on the use of harmonised standards or common specifications referred to in articles 40and 41;


### issue opinions , recommendations or written contributions on matters related to the implementation of this regulation , in particular ### conduct independent expert evaluations , issue opinions , recommendations or written contributions on matters related to the implementation of this regulation , in particular


### on technical specifications or existing standards regarding the requirements set out in title iii , chapter 2 , ### deleted


### (ii) on the use of harmonised standards or common specifications referred to in articles 40 and 41 , ### deleted


### (iii) on the preparation of guidance documents , including the guidelines concerning the setting of administrative fines referred to in article 71. ### deleted


### 1. national competent authorities shall be established or designated by each member state for the purpose of ensuring the application and implementation of this regulation. national competent authorities shall be organised so as to safeguard the objectivity and impartiality of their activities and tasks. ### 1. national competent authorities shall be established or designated by each member state for the purpose of ensuring the application , implementation and enforcement of this regulation. national competent authorities shall be organised so as to safeguard the objectivity and impartiality of their activities and tasks.


### 1. national competent authorities shall be established or designated by each member state for the purpose of ensuring the application and implementation of this regulation. national competent authorities shall be organised so as to safeguard the objectivity and impartiality of their activities and tasks. ### 1. national competent authorities shall be established or designated by each member state for the purpose of ensuring the application and implementation of this regulation and horizontal union legislation. national competent authorities shall be organised so as to safeguard the objectivity and impartiality of their activities and tasks to avoid any conflicts of interest.


### 2. each member state shall designate a national supervisory authority among the national competent authorities. the national supervisory authority shall act as notifying authority and market surveillance authority unless a member state has organisational and administrative reasons to designate more than one authority. ### 2. 2. each member state shall designate the national data protection authority as tthe national supervisory authority among the national competent authorities. the national supervisory authority shall act as notifying authority and market surveillance authority unless a member state has organisational and administrative reasons to designate more than one authority.


### 5. member states shall report to the commission on an annual basis on the status of the financial and human resources of the national competent authorities with an assessment of their adequacy. the commission shall transmit that information to the board for discussion and possible recommendations. ### 5. member states shall report to the commission on an annual basis on the status of the financial and human resources of the national competent authorities with a qualified assessment of their adequacy. the commission shall transmit that information to the board for discussion and possible recommendations and formally accept or reject the assessments. where an assessment is rejected , a new assessment shall be requested.


### 5. member states shall report to the commission on an annual basis on the status of the financial and human resources of the national competent authorities with an assessment of their adequacy. the commission shall transmit that information to the board for discussion and possible recommendations. ### 5. member states shall report to the commission on an annual basis on the status of the financial and human resources of the national competent authorities with an assessment of their adequacy. the commission shall transmit that information to the ai office for discussion and possible recommendations.


### 6. the commission shall facilitate the exchange of experience between national competent authorities. ### 6. the board shall facilitate the exchange of experience between national competent authorities.


### eu database for stand-alone high-risk ai systems ### eu database for stand-alone ai systems


### 1. the commission shall , in collaboration with the member states , set up and maintain a eu database containing information referred to in paragraph 2 concerning high-risk ai systems referred to in article 6(2) which are registered in accordance with article 51. ### 1. the commission shall , in collaboration with the member states , set up and maintain a public eu database containing information referred to in paragraph 2 concerning high-risk ai systems which are registered in accordance with article 51.


### 2. the data listed in annex viii shall be entered into the eu database by the providers. the commission shall provide them with technical and administrative support. ### 2. the data listed in annex viii shall be entered into the eu database by the providers , and , where relevant , deployers. the commission shall provide them with technical and administrative support.


### 5. the commission shall be the controller of the eu database. it shall also ensure to providers adequate technical and administrative support. ### 5. the commission shall be the controller of the eu database. it shall also ensure to providers and , where relevant , deployers , adequate technical and administrative support.


### 1. providers of high-risk ai systems placed on the union market shall report any serious incident or any malfunctioning of those systems which constitutes a breach of obligations under union law intended to protect fundamental rights to the market surveillance authorities of the member states where that incident or breach occurred. ### 1. providers and deployers of ai systems placed on the union market shall report any serious incident or any malfunctioning of those systems which constitutes a breach of obligations under union law or of fundamental rights to the market surveillance authorities of the member states where that incident or breach occurred.


### 1. providers of high-risk ai systems placed on the union market shall report any serious incident or any malfunctioning of those systems which constitutes a breach of obligations under union law intended to protect fundamental rights to the market surveillance authorities of the member states where that incident or breach occurred. ### 1. providers of high-risk ai systems placed on the union market shall report any serious incident or any malfunctioning of those systems which constitutes a breach of obligations under union law intended to protect fundamental or legal rights to the market surveillance authorities of the member states where that incident or breach occurred.


### 1. providers of high-risk ai systems placed on the union market shall report any serious incident or any malfunctioning of those systems which constitutes a breach of obligations under union law intended to protect fundamental rights to the market surveillance authorities of the member states where that incident or breach occurred. ### 1. providers of high-risk ai systems placed on the union market shall report any serious incident or any malfunctioning of those systems which constitutes a breach of obligations under union law or fundamental rights to the market surveillance authorities of the member states where that incident or breach occurred.


### such notification shall be made immediately after the provider has established a causal link between the ai system and the incident or malfunctioning or the reasonable likelihood of such a link , and , in any event , not later than 15 days after the providers becomes aware of the serious incident or of the malfunctioning. ### such notification shall be made immediately after the provider has established a causal link between the ai system and the incident or malfunctioning or the reasonable likelihood of such a link , and , in any event , not later than 72 hours after the providers becomes aware of the serious incident or of the malfunctioning.


### 2. upon receiving a notification related to a breach of obligations under union law intended to protect fundamental rights , the market surveillance authority shall inform the national public authorities or bodies referred to in article 64(3). the commission shall develop dedicated guidance to facilitate compliance with the obligations set out in paragraph 1. that guidance shall be issued 12 months after the entry into force of this regulation , at the latest. ### 2. upon receiving a notification related to a breach of obligations under union law or of fundamental rights , the market surveillance authority shall inform the national public authorities or bodies referred to in article 64(3). the commission shall develop dedicated guidance to facilitate compliance with the obligations set out in paragraph 1. that guidance shall be issued 3 months after the entry into force of this regulation , at the latest.