### (33) technical inaccuracies of ai systems intended for the remote biometric identification of natural persons can lead to biased results and entail discriminatory effects. this is particularly relevant when it comes to age , ethnicity , sex or disabilities. therefore , ‘real-time’ and ‘post’ remote biometric identification systems should be classified as high-risk. in view of the risks that they pose , both types of remote biometric identification systems should be subject to specific requirements on logging capabilities and human oversight. ### (33) technical inaccuracies of ai systems intended for the remote biometric identification of natural persons can lead to biased results and entail discriminatory effects. this is particularly relevant when it comes to age , ethnicity , sex or disabilities. therefore , ‘real-time’ and ‘post’ remote biometric identification systems should be classified as high-risk , except for verification or authentification systems whose sole purpose is to confirm that a specific natural person is the person he or she claims to be , and systems that are used to confirm the identity of a natural person for the sole purpose of having access to a service , a device or premises. in view of the risks that they pose , both types of remote biometric identification systems should be subject to specific requirements on logging capabilities and human oversight.


### (34) as regards the management and operation of critical infrastructure , it is appropriate to classify as high-risk the ai systems intended to be used as safety components in the management and operation of road traffic and the supply of water , gas , heating and electricity , since their failure or malfunctioning may put at risk the life and health of persons at large scale and lead to appreciable disruptions in the ordinary conduct of social and economic activities. ### (34) as regards the management and operation of critical infrastructure , it is appropriate to classify as high-risk the ai systems intended to be used as safety components in the management and operation of road traffic and the supply of water , gas , heating and electricity , and internet , since their failure or malfunctioning may put at risk the life and health of persons at large scale and lead to appreciable disruptions in the ordinary conduct of social and economic activities.


### (37) another area in which the use of ai systems deserves special consideration is the access to and enjoyment of certain essential private and public services and benefits necessary for people to fully participate in society or to improve one’s standard of living. in particular , ai systems used to evaluate the credit score or creditworthiness of natural persons should be classified as high-risk ai systems , since they determine those persons’ access to financial resources or essential services such as housing , electricity , and telecommunication services. ai systems used for this purpose may lead to discrimination of persons or groups and perpetuate historical patterns of discrimination , for example based on racial or ethnic origins , disabilities , age , sexual orientation , or create new forms of discriminatory impacts. considering the very limited scale of the impact and the available alternatives on the market , it is appropriate to exempt ai systems for the purpose of creditworthiness assessment and credit scoring when put into service by small-scale providers for their own use. natural persons applying for or receiving public assistance benefits and services from public authorities are typically dependent on those benefits and services and in a vulnerable position in relation to the responsible authorities. if ai systems are used for determining whether such benefits and services should be denied , reduced , revoked or reclaimed by authorities , they may have a significant impact on persons’ livelihood and may infringe their fundamental rights , such as the right to social protection , non-discrimination , human dignity or an effective remedy. those systems should therefore be classified as high-risk. nonetheless , this regulation should not hamper the development and use of innovative approaches in the public administration , which would stand to benefit from a wider use of compliant and safe ai systems , provided that those systems do not entail a high risk to legal and natural persons. finally , ai systems used to dispatch or establish priority in the dispatching of emergency first response services should also be classified as high-risk since they make decisions in very critical situations for the life and health of persons and their property. ### (37) another area in which the use of ai systems deserves special consideration is the access to and enjoyment of certain essential private and public services and benefits necessary for people to fully participate in society or to improve one’s standard of living. in particular , ai systems used to evaluate the credit score or creditworthiness of natural persons should be classified as high-risk ai systems , since they determine those persons’ access to financial resources or essential services such as housing , electricity , and telecommunication services. ai systems used for this purpose may lead to discrimination of persons or groups and perpetuate historical patterns of discrimination , for example based on racial or ethnic origins , disabilities , age , sexual orientation , or create new forms of discriminatory impacts. considering the very limited scale of the impact and the available alternatives on the market , it is appropriate to exempt ai systems for the purpose of creditworthiness assessment and credit scoring when put into service by smes and start-ups for their own use. natural persons applying for or receiving public assistance benefits and services from public authorities are typically dependent on those benefits and services and in a vulnerable position in relation to the responsible authorities. if ai systems are used for determining whether such benefits and services should be denied , reduced , revoked or reclaimed by authorities , they may have a significant impact on persons’ livelihood and may infringe their fundamental rights , such as the right to social protection , non-discrimination , human dignity or an effective remedy. those systems should therefore be classified as high-risk. nonetheless , this regulation should not hamper the development and use of innovative approaches in the public administration , which would stand to benefit from a wider use of compliant and safe ai systems , provided that those systems do not entail a high risk to legal and natural persons. finally , ai systems used to dispatch or establish priority in the dispatching of emergency first response services should also be classified as high-risk since they make decisions in very critical situations for the life and health of persons and their property.


### (37) another area in which the use of ai systems deserves special consideration is the access to and enjoyment of certain essential private and public services and benefits necessary for people to fully participate in society or to improve one’s standard of living. in particular , ai systems used to evaluate the credit score or creditworthiness of natural persons should be classified as high-risk ai systems , since they determine those persons’ access to financial resources or essential services such as housing , electricity , and telecommunication services. ai systems used for this purpose may lead to discrimination of persons or groups and perpetuate historical patterns of discrimination , for example based on racial or ethnic origins , disabilities , age , sexual orientation , or create new forms of discriminatory impacts. considering the very limited scale of the impact and the available alternatives on the market , it is appropriate to exempt ai systems for the purpose of creditworthiness assessment and credit scoring when put into service by small-scale providers for their own use. natural persons applying for or receiving public assistance benefits and services from public authorities are typically dependent on those benefits and services and in a vulnerable position in relation to the responsible authorities. if ai systems are used for determining whether such benefits and services should be denied , reduced , revoked or reclaimed by authorities , they may have a significant impact on persons’ livelihood and may infringe their fundamental rights , such as the right to social protection , non-discrimination , human dignity or an effective remedy. those systems should therefore be classified as high-risk. nonetheless , this regulation should not hamper the development and use of innovative approaches in the public administration , which would stand to benefit from a wider use of compliant and safe ai systems , provided that those systems do not entail a high risk to legal and natural persons. finally , ai systems used to dispatch or establish priority in the dispatching of emergency first response services should also be classified as high-risk since they make decisions in very critical situations for the life and health of persons and their property. ### (37) another area in which the use of ai systems deserves special consideration is the access to and enjoyment of certain essential private and public services and benefits necessary for people to fully participate in society or to improve one’s standard of living. in particular , ai systems used to evaluate the credit score or creditworthiness of natural persons should be classified as high-risk ai systems , since they determine those persons’ access to financial resources or essential services such as housing , electricity , and telecommunication services. ai systems used for this purpose may lead to discrimination of persons or groups and perpetuate historical patterns of discrimination , for example based on racial or ethnic origins , disabilities , age , sexual orientation , or create new forms of discriminatory impacts. considering the very limited scale of the impact and the available alternatives on the market , it is appropriate to exempt ai systems for the purpose of creditworthiness assessment and credit scoring when put into service by small-scale providers for their own use. natural persons applying for or receiving public assistance benefits and services from public authorities are typically dependent on those benefits and services and in a vulnerable position in relation to the responsible authorities. if ai systems are used for determining whether such benefits and services should be denied , reduced , revoked or reclaimed by authorities , they may have a significant impact on persons’ livelihood and may infringe their fundamental rights , such as the right to social protection , non-discrimination , human dignity or an effective remedy. those systems should therefore be banned. nonetheless , this regulation should not hamper the development and use of innovative approaches in the public administration , which would stand to benefit from a wider use of compliant and safe ai systems , provided that those systems do not entail an unacceptable risk to legal and natural persons. finally , ai systems used to dispatch or establish priority in the dispatching of emergency first response services should also be classified as high-risk since they make decisions in very critical situations for the life and health of persons and their property.


### (44) high data quality is essential for the performance of many ai systems , especially when techniques involving the training of models are used , with a view to ensure that the high-risk ai system performs as intended and safely and it does not become the source of discrimination prohibited by union law. high quality training , validation and testing data sets require the implementation of appropriate data governance and management practices. training , validation and testing data sets should be sufficiently relevant , representative and free of errors and complete in view of the intended purpose of the system. they should also have the appropriate statistical properties , including as regards the persons or groups of persons on which the high-risk ai system is intended to be used. in particular , training , validation and testing data sets should take into account , to the extent required in the light of their intended purpose , the features , characteristics or elements that are particular to the specific geographical , behavioural or functional setting or context within which the ai system is intended to be used. in order to protect the right of others from the discrimination that might result from the bias in ai systems , the providers shouldbe able to process also special categories of personal data , as a matter of substantial public interest , in order to ensure the bias monitoring , detection and correction in relation to high-risk ai systems. ### (44) high data quality is essential for the performance of many ai systems , especially when techniques involving the training of models are used , with a view to ensure that the high-risk ai system performs as intended and safely and it does not become the source of discrimination prohibited by union law. high quality training , validation and testing data sets require the implementation of appropriate data governance and management practices. training , validation and testing data sets should be sufficiently relevant , representative , up-to-date , free of errors to the best extent possible and as complete as possible in view of the intended purpose of the system. they should also have the appropriate statistical properties , including as regards the persons or groups of persons on which the high-risk ai system is intended to be used. in particular , training , validation and testing data sets should take into account , to the extent required in the light of their intended purpose , the features , characteristics or elements that are particular to the specific geographical , sectorial , behavioural or functional setting or context within which the ai system is intended to be used. in order to protect the right of others from the discrimination that might result from the bias in ai systems , the providers shouldbe able to process also special categories of personal data , as a matter of substantial public interest , in order to ensure the bias monitoring , detection , update and correction in relation to high-risk ai systems.


### (71) artificial intelligence is a rapidly developing family of technologies that requires novel forms of regulatory oversight and a safe space for experimentation , while ensuring responsible innovation and integration of appropriate safeguards and risk mitigation measures. to ensure a legal framework that is innovation-friendly , future-proof and resilient to disruption , national competent authorities from one or more member states should be encouraged to establish artificial intelligence regulatory sandboxes to facilitate the development and testing of innovative ai systems under strict regulatory oversight before these systems are placed on the market or otherwise put into service. ### (71) artificial intelligence is a rapidly developing family of technologies that requires novel forms of regulatory oversight and a safe space for experimentation , while ensuring responsible innovation and integration of appropriate safeguards and risk mitigation measures. to ensure a legal framework that is innovation-friendly , future-proof and resilient to disruption , national competent authorities from one or more member states should be encouraged to establish artificial intelligence regulatory sandboxes to facilitate the development and testing of innovative ai systems under strict regulatory oversight before these systems are placed on the market or otherwise put into service. it is especially important to ensure that smes and start-ups can easily access these sandboxes , are actively involved and participate in the development and testing of innovative ai systems , in order to be able to contribute with their knowhow and experience. their participation should be supported and facilitated.


### (76) in order to facilitate a smooth , effective and harmonised implementation of this regulation a european artificial intelligence board should be established. the board should be responsible for a number of advisory tasks , including issuing opinions , recommendations , advice or guidance on matters related to the implementation of this regulation , including on technical specifications or existing standards regarding the requirements established in this regulation and providing advice to and assisting the commission on specific questions related to artificial intelligence. ### (76) in order to facilitate a smooth , effective and harmonised implementation of this regulation a european artificial intelligence board should be established. the board should be responsible for a number of advisory tasks , including issuing opinions , recommendations , advice or guidance on matters related to the implementation of this regulation , including on technical specifications or existing standards regarding the requirements established in this regulation and providing advice to and assisting the commission on specific questions related to artificial intelligence. in order to ensure a common and consistent approach to the development of ai and ensure good cooperation and exchange of views , the board should regularly consult other eu institutions as well as all sector-specific relevant stakeholders.


### 2. for high-risk ai systems that are safety components of products or systems , or which are themselves products or systems , falling within the scope of the following acts , only article 84 of this regulation shall apply: ### 2. for ai systems classified as high-risk ai in accordance with article 6 related to products covered by union harmonisation legislation listed in annex ii , section b only article 84 of this regulation shall apply.


### 3. this regulation shall not apply to ai systems developed or used exclusively for military purposes. ### 3. this regulation shall not apply to ai systems developed or used exclusively for military purposes , unless the ai system is subsequently used for non-military purposes.


### (1) ‘artificial intelligence system’ (ai system) means software that is developed with one or more of the techniques and approaches listed in annex i and can , for a given set of human-defined objectives , generate outputs such as content , predictions , recommendations , or decisions influencing the environments they interact with; ### (1) 'artificial intelligence' (ai) systems are software (and also hardware) systems designed by humans that , given a complex goal , act in the physical or digital dimension by perceiving their environment through data acquisition , interpreting the collected structured or unstructured data , reasoning on the knowledge , or processing the information , derived from this data and deciding the best action(s) to take to achieve the given goal. ai systems can either use symbolic rules or learn a numeric model , and they can also adapt their behaviour by analysing how the environment is affected by their previous actions;


### (1) ‘artificial intelligence system’ (ai system) means software that is developed with one or more of the techniques and approaches listed in annex i and can , for a given set of human-defined objectives , generate outputs such as content , predictions , recommendations , or decisions influencing the environments they interact with; ### (1) ‘artificial intelligence system’ (ai system) means software that can , for a given set of human-defined objectives , generate outputs such as predictions , recommendations , or decisions influencing real or virtual environments; ai systems can be designed to operate with varying levels of autonomy and can be developed with one or more of the techniques and approaches listed in annex i;


### (1) ‘artificial intelligence system’ (ai system) means software that is developed with one or more of the techniques and approaches listed in annex i and can , for a given set of human-defined objectives , generate outputs such as content , predictions , recommendations , or decisions influencing the environments they interact with; ### (1) ‘artificial intelligence system’ (ai system) means software that can , for a given set of human-defined objectives , make predictions , recommendations , or decisions influencing real or virtual environments; ai systems can be designed to operate with varying levels of autonomy and can be developed with one or more of the techniques and approaches listed in annex i;


### (1) ‘artificial intelligence system’ (ai system) means software that is developed with one or more of the techniques and approaches listed in annex i and can , for a given set of human-defined objectives , generate outputs such as content , predictions , recommendations , or decisions influencing the environments they interact with; ### (1) ‘artificial intelligence system’ (ai system) means a machine-based system that can for a given set of human-defined objectives , make predictions , recommendations , or decisions influencing real or virtual environments; ai systems can be designed to operate with varying levels of autonomy and can be developed with one or more of the techniques and approaches listed in annex i;


### (2) ‘provider’ means a natural or legal person , public authority , agency or other body that develops an ai system or that has an ai system developed with a view to placing it on the market or putting it into service under its own name or trademark , whether for payment or free of charge; ### (2) 'developer' means a natural or legal person , public authority , agency or other body that develops an ai system or that has an ai system developed and places it on the market or puts it into service under its own name or trademark , whether for payment or free of charge or that adapts general purpose ai systems to a specific intended purpose;


### (4) ‘user’ means any natural or legal person , public authority , agency or other body using an ai system under its authority , except where the ai system is used in the course of a personal non-professional activity; ### (4) ‘user’ means any natural or legal person , public authority , educational and training institution , agency or other body using an ai system under its authority , except where the ai system is used in the course of a personal non-professional activity


### (4) ‘user’ means any natural or legal person , public authority , agency or other body using an ai system under its authority , except where the ai system is used in the course of a personal non-professional activity; ### (4) ‘deployer’ means any natural or legal person , public authority , agency or other body using an ai system under its authority , except where the ai system is used in the course of a personal non-professional activity;


### (35) ‘biometric categorisation system’ means an ai system for the purpose of assigning natural persons to specific categories , such as sex , age , hair colour , eye colour , tattoos , ethnic origin or sexual or political orientation , on the basis of their biometric data; ### (35) ‘biometric categorisation system’ means an ai system for the purpose of assigning natural persons to specific categories , such as sex , age , hair colour , eye colour , tattoos , ethnic origin , or sexual or political orientation , and others on the basis of their biometric data;


### the commission is empowered to adopt delegated acts in accordance with article 73 to amend the list of techniques and approaches listed in annex i , in order to update that list to market and technological developments on the basis of characteristics that are similar to the techniques and approaches listed therein. ### the commission is empowered to adopt delegated acts in accordance with article 73 to amend the list of techniques and approaches listed in annex i within the scope of the definition of an ai system as provided for in article 3(1) , in order to update that list to market and technological developments on the basis of characteristics that are similar to the techniques and approaches listed therein.


### the placing on the market , putting into service or use of an ai system that deploys subliminal techniques beyond a person’s consciousness in order to materially distort a person’s behaviour in a manner that causes or is likely to cause that person or another person physical or psychological harm; ### the placing on the market , putting into service or use of an ai system that deploys psychological techniques beyond a person’s consciousness with the purpose , the effect or likely effect of to materially distorting a person’s behaviour in a manner that causes or is likely to cause that person or another person physical or psychological harm;


### the placing on the market , putting into service or use of an ai system that deploys subliminal techniques beyond a person’s consciousness in order to materially distort a person’s behaviour in a manner that causes or is likely to cause that person or another person physical or psychological harm; ### the placing on the market , putting into service or use of an ai system that materially distorts a person’s behaviour without their knowledge.


### detrimental or unfavourable treatment of certain natural persons or whole groups thereof in social contexts which are unrelated to the contexts in which the data was originally generated or collected; ### deleted


### detrimental or unfavourable treatment of certain natural persons or whole groups thereof in social contexts which are unrelated to the contexts in which the data was originally generated or collected; ### detrimental or unfavourable treatment of certain natural persons or whole groups thereof in social contexts that are unrelated to the contexts in which the data was originally generated or collected;


### (ii) detrimental or unfavourable treatment of certain natural persons or whole groups thereof that is unjustified or disproportionate to their social behaviour or its gravity; ### deleted


### the targeted search for specific potential victims of crime , including missing children; ### deleted


### (ii) the prevention of a specific , substantial and imminent threat to the life or physical safety of natural persons or of a terrorist attack; ### deleted


### (iii) the detection , localisation , identification or prosecution of a perpetrator or suspect of a criminal offence referred to in article 2(2) of council framework decision 2002/584/jha62 and punishable in the member state concerned by a custodial sentence or a detention order for a maximum period of at least three years , as determined by the law of that member state. ### deleted


### 1. the commission is empowered to adopt delegated acts in accordance with article 73 to update the list in annex iii by adding high-risk ai systems where both of the following conditions are fulfilled: ### 1. the commission is empowered to adopt delegated acts in accordance with article 73 to update the list in annex iii by adding high-risk ai systems where the following conditions are fulfilled:


### the ai systems are intended to be used in any of the areas listed in points 1 to 8 of annex iii; ### deleted


### identification and analysis of the known and foreseeable risks associated with each high-risk ai system; ### identification and analysis of the known and reasonably foreseeable risks associated with each high-risk ai system with respect to health , safety , fundamental rights , and the values of the union as enshrined in article 2 teu;


### identification and analysis of the known and foreseeable risks associated with each high-risk ai system; ### identification and analysis of the known and foreseeable risks most likely to occur to health , safety and fundamental rights in view of the intended purpose of the high-risk ai system;


### evaluation of other possibly arising risks based on the analysis of data gathered from the post-market monitoring system referred to in article 61; ### evaluation of new arising significant risks based on the analysis of data gathered from the post-market monitoring system referred to in article 61;


### 3. the risk management measures referred to in paragraph 2 , point (d) shall give due consideration to the effects and possible interactions resulting from the combined application of the requirements set out in this chapter 2. they shall take into account the generally acknowledged state of the art , including as reflected in relevant harmonised standards or common specifications. ### 3. the risk management measures referred to in paragraph 2 , point (d) shall give due consideration to the effects and possible interactions resulting from the combined application of the requirements set out in this chapter 2 , with a view to minimising risks more effectively while achieving an appropriate balance in implementing the measures to fulfil those requirements.


### 4. the risk management measures referred to in paragraph 2 , point (d) shall be such that any residual risk associated with each hazard as well as the overall residual risk of the high-risk ai systems is judged acceptable , provided that the high-risk ai system is used in accordance with its intended purpose or under conditions of reasonably foreseeable misuse. those residual risks shall be communicated to the user. ### 4. the risk management measures referred to in paragraph 2 , point (d) shall be such that any residual significant risk associated with each hazard as well as the overall residual risk of the high-risk ai systems is reasonably judged to be acceptable , having regard to the benefits that the high-risk ai system is reasonably expected to deliver and provided that the high-risk ai system is used in accordance with its intended purpose or under conditions of reasonably foreseeable misuse. those residual significant risks shall be communicated to the user.


### 1. high-risk ai systems which make use of techniques involving the training of models with data shall be developed on the basis of training , validation and testing data sets that meet the quality criteria referred to in paragraphs 2 to 5. ### 1. high-risk ai systems which make use of techniques involving the training of models with data shall be developed on the basis of training , assessment , validation and testing data sets that meet the quality criteria referred to in paragraphs 2 to 5.


### 2. training , validation and testing data sets shall be subject to appropriate data governance and management practices. those practices shall concern in particular , ### 2. training , assessment , validation and testing data sets shall be subject to appropriate data governance and management practices. those practices shall concern in particular the following elements:


### examination in view of possible biases; ### examination in view of possible biases that are likely to affect health and safety of persons or lead to discrimination prohibited by union law;


### 3. training , validation and testing data sets shall be relevant , representative , free of errors and complete. they shall have the appropriate statistical properties , including , where applicable , as regards the persons or groups of persons on which the high-risk ai system is intended to be used. these characteristics of the data sets may be met at the level of individual data sets or a combination thereof. ### 3. training , validation and testing data sets shall be relevant , representative , up-to-date , free of errors to the best extent possible and as complete as possible. they shall have the appropriate statistical properties , including , where applicable , as regards the persons or groups of persons on which the high-risk ai system is intended to be used. these characteristics of the data sets may be met at the level of individual data sets or a combination thereof.


### 1. users of high-risk ai systems shall use such systems in accordance with the instructions of use accompanying the systems , pursuant to paragraphs 2 and 5. ### 1. users of high-risk ai systems shall use such systems and implement human oversight in accordance with the instructions of use accompanying the systems , pursuant to paragraphs 2 and 5 of this article.


### 1. users of high-risk ai systems shall use such systems in accordance with the instructions of use accompanying the systems , pursuant to paragraphs 2 and 5. ### 1. users of high-risk ai systems shall use such systems and implement human oversight in accordance with the instructions of use accompanying the systems , pursuant to paragraphs 2 and 5.


### 2. the commission , when preparing the common specifications referred to in paragraph 1 , shall gather the views of relevant bodies or expert groups established under relevant sectorial union law. ### 2. the commission , when preparing the common specifications referred to in paragraph 1 , shall gather the views of relevant bodies or expert groups established under relevant sectorial union law , as well as relevant sector-specific stakeholders.


### measures for small-scale providers and users ### measures for smes , start-ups and users


### 55 measures for small-scale providers and users ### 55 measures for smes , start-ups and users


### provide small-scale providers and start-ups with priority access to the ai regulatory sandboxes to the extent that they fulfil the eligibility conditions; ### provide smes and start-ups with priority access to the ai regulatory sandboxes to the extent that they fulfil the eligibility conditions;


### provide small-scale providers and start-ups with priority access to the ai regulatory sandboxes to the extent that they fulfil the eligibility conditions; ### provide sme providers , including start-ups with priority access to the ai regulatory sandboxes to the extent that they fulfil the eligibility conditions;


### organise specific awareness raising activities about the application of this regulation tailored to the needs of the small-scale providers and users; ### organise specific awareness raising activities about the application of this regulation tailored to the needs of smes , sart-ups and users;


### organise specific awareness raising activities about the application of this regulation tailored to the needs of the small-scale providers and users; ### organise specific awareness raising activities about the application of this regulation tailored to the needs of smes and start-ups;


### organise specific awareness raising activities about the application of this regulation tailored to the needs of the small-scale providers and users; ### organise specific awareness raising and enhanced digital skills development activities about the application of this regulation tailored to the needs of sme providers , including start-ups and users;


### where appropriate , establish a dedicated channel for communication with small-scale providers and user and other innovators to provide guidance and respond to queries about the implementation of this regulation. ### where appropriate , establish a dedicated channel for communication with smes , start-ups , users and other innovators to provide guidance and respond to queries about the implementation of this regulation.


### where appropriate , establish a dedicated channel for communication with small-scale providers and user and other innovators to provide guidance and respond to queries about the implementation of this regulation. ### where appropriate , establish a dedicated channel for communication with smes , start-ups and other innovators to provide guidance and respond to queries about the implementation of this regulation.


### where appropriate , establish a dedicated channel for communication with small-scale providers and user and other innovators to provide guidance and respond to queries about the implementation of this regulation. ### where appropriate , establish a dedicated channel for communication with sme providers , including start-ups , and user and other innovators to provide guidance and respond to queries about the implementation of this regulation.


### 1. the board shall be composed of the national supervisory authorities , who shall be represented by the head or equivalent high-level official of that authority , and the european data protection supervisor. other national authorities may be invited to the meetings , where the issues discussed are of relevance for them. ### 1. the board shall be composed of the national supervisory authorities , who shall be represented by the head or equivalent high-level official of that authority , and the european data protection supervisor. other national , regional and local authorities may be invited to the meetings , where the issues discussed are of relevance for them.


### 1. the board shall be composed of the national supervisory authorities , who shall be represented by the head or equivalent high-level official of that authority , and the european data protection supervisor. other national authorities may be invited to the meetings , where the issues discussed are of relevance for them. ### 1. the board shall be composed of the national supervisory authorities , the european data protection supervisor as the eu agency for fundamental rights , the eu agency for cybersecurity , the joint research centre , the european committee for standardization , the european committee for electrotechnical standardization , and the european telecommunications standards institute , each with one representative. other national authorities may be invited to the meetings , where the issues discussed are of relevance for them.


### 4. the board may invite external experts and observers to attend its meetings and may hold exchanges with interested third parties to inform its activities to an appropriate extent. to that end the commission may facilitate exchanges between the board and other union bodies , offices , agencies and advisory groups. ### 4. the board may invite external experts and observers to attend its meetings and may hold exchanges with interested third parties to inform its activities to an appropriate extent , and hold consultations with relevant stakeholders and ensure appropriate participation. the commission may facilitate exchanges between the board and other union bodies , offices , agencies and advisory. the commission may facilitate exchanges between the board and other union bodies , offices , agencies and advisory groups.


### 4. member states shall ensure that national competent authorities are provided with adequate financial and human resources to fulfil their tasks under this regulation. in particular , national competent authorities shall have a sufficient number of personnel permanently available whose competences and expertise shall include an in-depth understanding of artificial intelligence technologies , data and data computing , fundamental rights , health and safety risks and knowledge of existing standards and legal requirements. ### 4. member states shall ensure that national competent authorities are provided with adequate financial , technical and human resources to fulfil their tasks under this regulation. in particular , national competent authorities shall have a sufficient number of personnel permanently available whose competences and expertise shall include an in-depth understanding of artificial intelligence technologies , data and data computing , fundamental rights , health and safety risks and knowledge of existing standards and legal requirements.


### 7. national competent authorities may provide guidance and advice on the implementation of this regulation , including to small-scale providers. whenever national competent authorities intend to provide guidance and advice with regard to an ai system in areas covered by other union legislation , the competent national authorities under that union legislation shall be consulted , as appropriate. member states may also establish one central contact point for communication with operators. ### 7. national competent authorities may provide guidance and advice on the implementation of this regulation , including to smes and start-ups. whenever national competent authorities intend to provide guidance and advice with regard to an ai system in areas covered by other union legislation , the competent national authorities under that union legislation shall be consulted ,as appropriate. member states shall also establish one central contact point for communication with operators and other stakeholders.


### 7. national competent authorities may provide guidance and advice on the implementation of this regulation , including to small-scale providers. whenever national competent authorities intend to provide guidance and advice with regard to an ai system in areas covered by other union legislation , the competent national authorities under that union legislation shall be consulted , as appropriate. member states may also establish one central contact point for communication with operators. ### 7. national competent authorities may provide guidance and advice on the implementation of this regulation , including to smes and start-ups. whenever national competent authorities intend to provide guidance and advice with regard to an ai system in areas covered by other union legislation , the competent national authorities under that union legislation shall be consulted , as appropriate. member states may also establish one central contact point for communication with operators.


### 3. information contained in the eu database shall be accessible to the public. ### 3. information contained in the eu database shall be accessible to the public , user-friendly , easily navigable and machine-readable.


### 4. the eu database shall contain personal data only insofar as necessary for collecting and processing information in accordance with this regulation. that information shall include the names and contact details of natural persons who are responsible for registering the system and have the legal authority to represent the provider. ### 4. the eu database shall contain personal data only insofar as necessary for collecting and processing information in accordance with this regulation. that information shall include the names and contact details of natural persons who are responsible for registering the system and have the legal authority to represent the provider or the user , if the user is a public authority or a union institution , body , office or agency or a user acting on their behalf.


### 2. the post-market monitoring system shall actively and systematically collect , document and analyse relevant data provided by users or collected through other sources on the performance of high-risk ai systems throughout their lifetime , and allow the provider to evaluate the continuous compliance of ai systems with the requirements set out in title iii , chapter 2. ### 2. the post-market monitoring system shall actively and systematically collect , document and analyse relevant data provided by users or collected through other sources , to the extent such data are readily accessible to the provider and taking into account the limits resulting from data protection , copyright and competition law , on the performance of high-risk ai systems throughout their lifetime , and allow the provider to evaluate the continuous compliance of ai systems with the requirements set out in title iii , chapter 2.


### 1. access to data and documentation in the context of their activities , the market surveillance authorities shall be granted full access to the training , validation and testing datasets used by the provider , including through application programming interfaces (‘api’) or other appropriate technical means and tools enabling remote access. ### 1. without prejudice to powers provided under regulation (eu) 2019/1020 , and where relevant and limited to what is necessary to fulfil their tasks , market surveillance authorities may request access to data and documentation in the context of their activities , the market surveillance authorities shall be granted full access to the training , validation and testing datasets used by the provider that are strictly necessary for the purpose of its request. , including , where appropriate and subject to security safeguards , through application programming interfaces (‘api’) or other appropriate technical means and tools enabling remote access.


### 2. where necessary to assess the conformity of the high-risk ai system with the requirements set out in title iii , chapter 2 and upon a reasoned request , the market surveillance authorities shall be granted access to the source code of the ai system. ### 2. where necessary to assess the conformity of the high-risk ai system with the requirements set out in title iii , chapter 2 , after all other reasonable ways to verify conformity have been exhausted and have proven to be insufficient , and upon a reasoned request , the market surveillance authorities or , where applicable , the commission , shall be granted access to the source code of the ai system. such access shall be subject to existing union law on the protection of intellectual property and trade secrets.


### 2. where necessary to assess the conformity of the high-risk ai system with the requirements set out in title iii , chapter 2 and upon a reasoned request , the market surveillance authorities shall be granted access to the source code of the ai system. ### 2. market surveillance authorities shall be granted access to the source code of the high-risk ai system upon a reasoned request and only when the following cumulative conditions are fulfilled:


### 1. ai systems presenting a risk shall be understood as a product presenting a risk defined in article 3 , point 19 of regulation (eu) 2019/1020 insofar as risks to the health or safety or to the protection of fundamental rights of persons are concerned. ### 1. ai systems presenting a risk shall be understood as a product presenting a risk defined in article 3 , point 19 of regulation (eu) 2019/1020 insofar as risks to the health or safety or to fundamental rights of persons are concerned.


### 1. where , having performed an evaluation under article 65 , the market surveillance authority of a member state finds that although an ai system is in compliance with this regulation , it presents a risk to the health or safety of persons , to the compliance with obligations under union or national law intended to protect fundamental rights or to other aspects of public interest protection , it shall require the relevant operator to take all appropriate measures to ensure that the ai system concerned , when placed on the market or put into service , no longer presents that risk , to withdraw the ai system from the market or to recall it within a reasonable period , commensurate with the nature of the risk , as it may prescribe. ### 1. where , having performed an evaluation under article 65 , the market surveillance authority of a member state finds that although an ai system is in compliance with this regulation , it presents a risk to the health or safety of persons or to the compliance with obligations under union or national law intended to protect fundamental rights , it shall require the relevant operator to take all appropriate measures to ensure that the ai system concerned , when placed on the market or put into service , no longer presents that risk


### 1. where , having performed an evaluation under article 65 , the market surveillance authority of a member state finds that although an ai system is in compliance with this regulation , it presents a risk to the health or safety of persons , to the compliance with obligations under union or national law intended to protect fundamental rights or to other aspects of public interest protection , it shall require the relevant operator to take all appropriate measures to ensure that the ai system concerned , when placed on the market or put into service , no longer presents that risk , to withdraw the ai system from the market or to recall it within a reasonable period , commensurate with the nature of the risk , as it may prescribe. ### 1. where , having performed an evaluation under article 65 , the market surveillance authority of a member state finds that although an ai system is in compliance with this regulation , it presents a risk to the health or safety of persons or to fundamental rights , it shall require the relevant operator to take all appropriate measures to ensure that the ai system concerned , when placed on the market or put into service , no longer presents that risk , to withdraw the ai system from the market or to recall it within a reasonable period , commensurate with the nature of the risk , as it may prescribe.


### 3. codes of conduct may be drawn up by individual providers of ai systems or by organisations representing them or by both , including with the involvement of users and any interested stakeholders and their representative organisations. codes of conduct may cover one or more ai systems taking into account the similarity of the intended purpose of the relevant systems. ### 3. codes of conduct may be drawn up by national , regional or local authorities , by individual providers of ai systems or by organisations representing them or by both , including with the involvement of users and any interested stakeholders and their representative organisations. codes of conduct may cover one or more ai systems taking into account the similarity of the intended purpose of the relevant systems.


### 3. codes of conduct may be drawn up by individual providers of ai systems or by organisations representing them or by both , including with the involvement of users and any interested stakeholders and their representative organisations. codes of conduct may cover one or more ai systems taking into account the similarity of the intended purpose of the relevant systems. ### 3. codes of conduct may be drawn up by individual providers of ai systems or by organisations representing them or by the commission or the ai office , including with the involvement of users and any interested stakeholders and their representative organisations. codes of conduct may cover one or more ai systems taking into account the similarity of the intended purpose of the relevant systems.


### 1. national competent authorities and notified bodies involved in the application of this regulation shall respect the confidentiality of information and data obtained in carrying out their tasks and activities in such a manner as to protect , in particular: ### 1. national competent authorities , notified bodies , the commission , the board , and any other natural or legal person involved in the application of this regulation shall , in accordance with union or national law , put appropriate technical and organisational measures in place to ensure the confidentiality of information and data obtained in carrying out their tasks and activities in such a manner as to protect , in particular:


### 1. national competent authorities and notified bodies involved in the application of this regulation shall respect the confidentiality of information and data obtained in carrying out their tasks and activities in such a manner as to protect , in particular: ### 1. the commission , the ai office , national competent authorities and notified bodies involved in the application of this regulation shall respect the confidentiality of information and data obtained in carrying out their tasks and activities in such a manner as to protect , in particular:


### statistical approaches , bayesian estimation , search and optimization methods. ### deleted


### ai systems intended to be used for the ‘real-time’ and ‘post’ remote biometric identification of natural persons; ### deleted


### ai systems intended to be used for the ‘real-time’ and ‘post’ remote biometric identification of natural persons; ### ai systems intended to be used for the ‘real-time’ and ‘post’ remote biometric identification of natural persons , excluding verification/authentification systems whose sole purpose is to confirm that a specific natural person is the person he or she claims to be , and systems that are used to confirm the identity of a natural person for the sole purpose of having access to a service , a device or premises;


### ai systems intended to be used for recruitment or selection of natural persons , notably for advertising vacancies , screening or filtering applications , evaluating candidates in the course of interviews or tests; ### ai systems intended to make autonomous decisions or materially influence decisions about recruitment or selection of natural persons , notably for screening or filtering applications , evaluating candidates in the course of interviews or tests;


### ai systems intended to be used for recruitment or selection of natural persons , notably for advertising vacancies , screening or filtering applications , evaluating candidates in the course of interviews or tests; ### ai systems intended to be used in recruitment for advertising vacancies , screening or filtering applications , or evaluating candidates in the course of interviews or tests;


### ai systems intended to be used for recruitment or selection of natural persons , notably for advertising vacancies , screening or filtering applications , evaluating candidates in the course of interviews or tests; ### deleted


### ai intended to be used for making decisions on promotion and termination of work-related contractual relationships , for task allocation and for monitoring and evaluating performance and behavior of persons in such relationships. ### ai systems intended to be used for making decisions or to assist in making decisions on promotion and termination of work-related contractual relationships; for personalized task allocation based on biometrics , biometrics-based , or personal data; and for monitoring and evaluating performance and behaviour of natural persons in such relationships.


### ai intended to be used for making decisions on promotion and termination of work-related contractual relationships , for task allocation and for monitoring and evaluating performance and behavior of persons in such relationships. ### ai intended to make autonomous decisions or materially influence decisions on promotion and termination of work-related contractual relationships , for monitoring and evaluating performance and behavior of persons in such relationships.


### ai intended to be used for making decisions on promotion and termination of work-related contractual relationships , for task allocation and for monitoring and evaluating performance and behavior of persons in such relationships. ### deleted


### (2) artificial intelligence systems (ai systems) can be easily deployed in multiple sectors of the economy and society , including cross border , and circulate throughout the union. certain member states have already explored the adoption of national rules to ensure that artificial intelligence is safe and is developed and used in compliance with fundamental rights obligations. differing national rules may lead to fragmentation of the internal market and decrease legal certainty for operators that develop or use ai systems. a consistent and high level of protection throughout the union should therefore be ensured , while divergences hampering the free circulation of ai systems and related products and services within the internal market should be prevented , by laying down uniform obligations for operators and guaranteeing the uniform protection of overriding reasons of public interest and of rights of persons throughout the internal market based on article 114 of the treaty on the functioning of the european union (tfeu). to the extent that this regulation contains specific rules on the protection of individuals with regard to the processing of personal data concerning restrictions of the use of ai systems for ‘real-time’ remote biometric identification in publicly accessible spaces for the purpose of law enforcement , it is appropriate to base this regulation , in as far as those specific rules are concerned , on article 16 of the tfeu. in light of those specific rules and the recourse to article 16 tfeu , it is appropriate to consult the european data protection board. ### (2) artificial intelligence systems (ai systems) can be easily deployed in multiple sectors of the economy and society , including cross border , and circulate throughout the union. certain member states have already explored the adoption of national rules to ensure that artificial intelligence is safe and is developed and used in compliance with fundamental rights obligations. differing national rules may lead to fragmentation of the internal market and decrease legal certainty for operators that develop or use ai systems. a consistent and high level of protection throughout the union should therefore be ensured , while divergences hampering the free circulation , innovation and development of ai systems and related products and services within the internal market should be prevented , by laying down uniform obligations for operators and guaranteeing the uniform protection of overriding reasons of public interest and of rights of persons throughout the internal market based on article 114 of the treaty on the functioning of the european union (tfeu).to the extent that this regulation contains specific rules on the protection of individuals with regard to the processing of personal data concerning restrictions of the use of ai systems for ‘real-time’ remote biometric identification in publicly accessible spaces for the purpose of law enforcement , it is appropriate to base this regulation , in as far as those specific rules are concerned , on article 16 of the tfeu. in light of those specific rules and the recourse to article 16 tfeu , it is appropriate to consult the european data protection board.


### (3) artificial intelligence is a fast evolving family of technologies that can contribute to a wide array of economic and societal benefits across the entire spectrum of industries and social activities. by improving prediction , optimising operations and resource allocation , and personalising digital solutions available for individuals and organisations , the use of artificial intelligence can provide key competitive advantages to companies and support socially and environmentally beneficial outcomes , for example in healthcare , farming , education and training , infrastructure management , energy , transport and logistics , public services , security , justice , resource and energy efficiency , and climate change mitigation and adaptation. ### (3) artificial intelligence is a fast evolving family of technologies that can and already contribute to a wide array of economic and societal benefits across the entire spectrum of industries and social activities. by improving prediction , optimising operations and resource allocation , and personalising digital solutions available for individuals and organisations , the use of artificial intelligence can provide key competitive advantages to companies and support socially and environmentally beneficial outcomes , for example in healthcare , farming , education and training , media and culture , infrastructure management , energy , transport and logistics , public services , security , justice , resource and energy efficiency , and climate change mitigation and adaptation.


### (3) artificial intelligence is a fast evolving family of technologies that can contribute to a wide array of economic and societal benefits across the entire spectrum of industries and social activities. by improving prediction , optimising operations and resource allocation , and personalising digital solutions available for individuals and organisations , the use of artificial intelligence can provide key competitive advantages to companies and support socially and environmentally beneficial outcomes , for example in healthcare , farming , education and training , infrastructure management , energy , transport and logistics , public services , security , justice , resource and energy efficiency , and climate change mitigation and adaptation. ### (3) artificial intelligence is a fast evolving family of technologies that can contribute to a wide array of economic and societal benefits across the entire spectrum of industries and social activities. by improving prediction , optimising operations and resource allocation , and personalising digital solutions available for individuals and organisations , the use of artificial intelligence can provide key competitive advantages to companies and support socially and environmentally beneficial outcomes , for example in healthcare , farming , education and training , environmental monitoring , nature protection and restoration , infrastructure management , management of natural disasters , energy , transport and logistics , public services , security , justice , resource and energy efficiency , and climate change mitigation and adaptation.


### (8) the notion of remote biometric identification system as used in this regulation should be defined functionally , as an ai system intended for the identification of natural persons at a distance through the comparison of a person’s biometric data with the biometric data contained in a reference database , and without prior knowledge whether the targeted person will be present and can be identified , irrespectively of the particular technology , processes or types of biometric data used. considering their different characteristics and manners in which they are used , as well as the different risks involved , a distinction should be made between ‘real-time’ and ‘post’ remote biometric identification systems. in the case of ‘real-time’ systems , the capturing of the biometric data , the comparison and the identification occur all instantaneously , near-instantaneously or in any event without a significant delay. in this regard , there should be no scope for circumventing the rules of this regulation on the ‘real-time’ use of the ai systems in question by providing for minor delays. ‘real-time’ systems involve the use of ‘live’ or ‘near-‘live’ material , such as video footage , generated by a camera or other device with similar functionality. in the case of ‘post’ systems , in contrast , the biometric data have already been captured and the comparison and identification occur only after a significant delay. this involves material , such as pictures or video footage generated by closed circuit television cameras or private devices , which has been generated before the use of the system in respect of the natural persons concerned. ### (8) the notion of remote biometric identification system as used in this regulation should be defined functionally , as an ai system intended for the identification of natural persons at a distance through the comparison of a person’s biometric data with the biometric data contained in a reference database , and without prior knowledge whether the targeted person will be present and can be identified , irrespectively of the particular technology , processes or types of biometric data used. considering their different characteristics and manners in which they are used , as well as the different risks involved , a distinction should be made between ‘real-time’ and ‘post’ remote biometric identification systems. in the case of ‘real-time’ systems , the capturing of the biometric data , the comparison and the identification occur all instantaneously , near-instantaneously or in any event without a significant delay. in this regard , there should be no scope for circumventing the rules of this regulation on the ‘real-time’ use of the ai systems in question by providing for minor delays. ‘real-time’ systems involve the use of ‘live’ or ‘near-‘live’ material , such as video footage , generated by a camera or other device with similar functionality. in the case of ‘post’ systems , in contrast , the biometric data have already been captured and the comparison and identification occur only after a significant delay. this involves material , such as pictures or video footage generated by closed circuit television cameras or private devices , which has been generated before the use of the system in respect of the natural persons concerned. the notion of remote biometric identification system shall not include verification or authentification systems whose sole purpose is to confirm that a specific natural person is the person he or she claims to be , and systems that are used to confirm the identity of a natural person for the sole purpose of having access to a service , a device or premises.


### (8) the notion of remote biometric identification system as used in this regulation should be defined functionally , as an ai system intended for the identification of natural persons at a distance through the comparison of a person’s biometric data with the biometric data contained in a reference database , and without prior knowledge whether the targeted person will be present and can be identified , irrespectively of the particular technology , processes or types of biometric data used. considering their different characteristics and manners in which they are used , as well as the different risks involved , a distinction should be made between ‘real-time’ and ‘post’ remote biometric identification systems. in the case of ‘real-time’ systems , the capturing of the biometric data , the comparison and the identification occur all instantaneously , near-instantaneously or in any event without a significant delay. in this regard , there should be no scope for circumventing the rules of this regulation on the ‘real-time’ use of the ai systems in question by providing for minor delays. ‘real-time’ systems involve the use of ‘live’ or ‘near-‘live’ material , such as video footage , generated by a camera or other device with similar functionality. in the case of ‘post’ systems , in contrast , the biometric data have already been captured and the comparison and identification occur only after a significant delay. this involves material , such as pictures or video footage generated by closed circuit television cameras or private devices , which has been generated before the use of the system in respect of the natural persons concerned. ### (8) the notion of remote biometric identification system as used in this regulation should be defined functionally , as an ai system intended for the identification of natural persons at a distance through the comparison of a person’s biometric data with the biometric data contained in a reference database , and without prior knowledge whether the targeted person will be present and can be identified , irrespectively of the particular technology , processes or types of biometric data used. considering their different characteristics and manners in which they are used , as well as the different risks involved , a distinction should be made between ‘real-time’ and ‘post’ remote biometric identification systems. in the case of ‘real-time’ systems , the capturing of the biometric data , the comparison and the identification occur all instantaneously , near-instantaneously or in any event without a significant delay. in this regard , there should be no scope for circumventing the rules of this regulation on the ‘real-time’ use of the ai systems in question by providing for minor delays. ‘real-time’ systems involve the use of ‘live’ or ‘near-‘live’ material , such as video footage , generated by a camera or other device with similar functionality. in the case of ‘post’ systems , in contrast , the biometric data have already been captured and the comparison and identification occur only after a significant delay. this involves material , such as pictures or video footage generated by closed circuit television cameras or private devices , which has been generated before the use of the system in respect of the natural persons concerned. the notion of remote biometric identification system shall not include authentification and verification systems whose purpose is to confirm , based on prior consent , that a specific natural person is the person he or she claims to be or to confirm the identity of a natural person for the purpose of having access to a service , a device or premises.


### (9) for the purposes of this regulation the notion of publicly accessible space should be understood as referring to any physical place that is accessible to the public , irrespective of whether the place in question is privately or publicly owned. therefore , the notion does not cover places that are private in nature and normally not freely accessible for third parties , including law enforcement authorities , unless those parties have been specifically invited or authorised , such as homes , private clubs , offices , warehouses and factories. online spaces are not covered either , as they are not physical spaces. however , the mere fact that certain conditions for accessing a particular space may apply , such as admission tickets or age restrictions , does not mean that the space is not publicly accessible within the meaning of this regulation. consequently , in addition to public spaces such as streets , relevant parts of government buildings and most transport infrastructure , spaces such as cinemas , theatres , shops and shopping centres are normally also publicly accessible. whether a given space is accessible to the public should however be determined on a case-by-case basis , having regard to the specificities of the individual situation at hand. ### (9) for the purposes of this regulation the notion of publicly accessible space should be understood as referring to any physical place that is accessible to the public , irrespective of whether the place in question is privately or publicly owned. therefore , the notion does not cover places that are private in nature and normally not freely accessible for third parties , including law enforcement authorities , unless those parties have been specifically invited or authorised ,such as homes , private clubs , offices , warehouses , and factories and other private spaces. online spaces whether publicly accessible or not , either for free or for various fees and conditions are not covered either , as they are not physical spaces. however , the mere fact that certain conditions for accessing a particular space may apply , such as admission tickets or age restrictions , does not mean that the space is not publicly accessible within the meaning of this regulation. consequently , in addition to public spaces such as streets , relevant parts of government buildings and most transport infrastructure , spaces such as cinemas , theatres , shops and shopping centres are normally also publicly accessible. whether a given space is accessible to the public should however be determined on a case-by-case basis , having regard to the specificities of the individual situation at hand. if certain online spaces conduct illegal activities defined as such by international and european union legislation they will be subject to the specific legislation in place.


### (14) in order to introduce a proportionate and effective set of binding rules for ai systems , a clearly defined risk-based approach should be followed. that approach should tailor the type and content of such rules to the intensity and scope of the risks that ai systems can generate. it is therefore necessary to prohibit certain artificial intelligence practices , to lay down requirements for high-risk ai systems and obligations for the relevant operators , and to lay down transparency obligations for certain ai systems. ### (14) in order to introduce a proportionate and effective set of binding rules for ai systems , a clearly defined risk-based approach should be followed. that approach should tailor the type and content of such rules to the intensity and scope of the risks that ai systems can generate for individuals and society , rather than depend on the type of technology. it is therefore necessary to prohibit certain artificial intelligence practices , to lay down requirements for high-risk ai systems and obligations for the relevant operators , and to lay down transparency obligations for certain ai systems.


### (16) the placing on the market , putting into service or use of certain ai systems intended to distort human behaviour , whereby physical or psychological harms are likely to occur , should be forbidden. such ai systems deploy subliminal components individuals cannot perceive or exploit vulnerabilities of children and people due to their age , physical or mental incapacities. they do so with the intention to materially distort the behaviour of a person and in a manner that causes or is likely to cause harm to that or another person. the intention may not be presumed if the distortion of human behaviour results from factors external to the ai system which are outside of the control of the provider or the user. research for legitimate purposes in relation to such ai systems should not be stifled by the prohibition , if such research does not amount to use of the ai system in human-machine relations that exposes natural persons to harm and such research is carried out in accordance with recognised ethical standards for scientific research. ### (16) the placing on the market , putting into service or use of certain ai systems intended to distort human behaviour , whereby physical or psychological harms are likely to occur , should be forbidden. in particular , ai systems that deploy subliminal components that natural persons cannot perceive , that exploit the vulnerabilities of any groups ,or that use purposefully manipulative techniques with the intention to materially distort the behaviour of a person and in a manner that causes or is likely to cause harm to that or another person or to their rights or to the values of the union should be prohibited. the intention may not be presumed if the distortion of human behaviour results from factors external to the ai system which are outside of the control of the provider or the user. research for legitimate purposes in relation to such ai systems should not be stifled by the prohibition , if such research does not amount to use of the ai system inhuman-machine relations that exposes natural persons to harm and such research is carried out in accordance with recognised ethical standards for scientific research.


### (16) the placing on the market , putting into service or use of certain ai systems intended to distort human behaviour , whereby physical or psychological harms are likely to occur , should be forbidden. such ai systems deploy subliminal components individuals cannot perceive or exploit vulnerabilities of children and people due to their age , physical or mental incapacities. they do so with the intention to materially distort the behaviour of a person and in a manner that causes or is likely to cause harm to that or another person. the intention may not be presumed if the distortion of human behaviour results from factors external to the ai system which are outside of the control of the provider or the user. research for legitimate purposes in relation to such ai systems should not be stifled by the prohibition , if such research does not amount to use of the ai system in human-machine relations that exposes natural persons to harm and such research is carried out in accordance with recognised ethical standards for scientific research. ### (16) the placing on the market , putting into service or use of certain ai systems with the objective to or the effect of distorting human behaviour , whereby physical or psychological harms are reasonably likely to occur , should be forbidden. such ai systems deploy subliminal components individuals cannot perceive or exploit vulnerabilities of specific groups of persons due to their age , disabilities , social or economic situation. they do so with the intention to materially distort the behaviour of a person and in a manner that causes or is likely to cause harm to that or another person. the intention may not be presumed if the distortion of human behaviour results from factors external to the ai system which are outside of the control of the provider or the user. research for legitimate purposes in relation to such ai systems should not be stifled by the prohibition , if such research does not amount to use of the ai system inhuman-machine relations that exposes natural persons to harm and such research is carried out in accordance with recognised ethical standards for scientific research.


### (16) the placing on the market , putting into service or use of certain ai systems intended to distort human behaviour , whereby physical or psychological harms are likely to occur , should be forbidden. such ai systems deploy subliminal components individuals cannot perceive or exploit vulnerabilities of children and people due to their age , physical or mental incapacities. they do so with the intention to materially distort the behaviour of a person and in a manner that causes or is likely to cause harm to that or another person. the intention may not be presumed if the distortion of human behaviour results from factors external to the ai system which are outside of the control of the provider or the user. research for legitimate purposes in relation to such ai systems should not be stifled by the prohibition , if such research does not amount to use of the ai system in human-machine relations that exposes natural persons to harm and such research is carried out in accordance with recognised ethical standards for scientific research. ### (16) the placing on the market , putting into service or use of certain ai systems intended to distort human behaviour without the affected persons' knowledge , should be forbidden. such ai systems deploy components individuals cannot perceive or exploit vulnerabilities of persons or groups of persons with protected characteristics. they do so with the intention to materially distort the behaviour of a person. such distortions are likely to cause harm to that or another person. the intention may not be presumed if the distortion of human behaviour results from factors external to the ai system which are outside of the control of the provider or the user. research for legitimate purposes in relation to such ai systems should not be stifled by the prohibition , if such research does not amount to use of the ai system in human-machine relations that exposes natural persons to harm and such research is carried out in accordance with recognised ethical standards for scientific research.


### (17) ai systems providing social scoring of natural persons for general purpose by public authorities or on their behalf may lead to discriminatory outcomes and the exclusion of certain groups. they may violate the right to dignity and non-discrimination and the values of equality and justice. such ai systems evaluate or classify the trustworthiness of natural persons based on their social behaviour in multiple contexts or known or predicted personal or personality characteristics. the social score obtained from such ai systems may lead to the detrimental or unfavourable treatment of natural persons or whole groups thereof in social contexts , which are unrelated to the context in which the data was originally generated or collected or to a detrimental treatment that is disproportionate or unjustified to the gravity of their social behaviour. such ai systems should be therefore prohibited. ### (17) ai systems providing social scoring of natural persons for general purpose by public authorities , educational institutions or on their behalf may lead to discriminatory outcomes and the exclusion of certain groups. they may violate the right to dignity and non-discrimination and the values of equality and justice. such ai systems evaluate or classify the trustworthiness of natural persons based on their social behaviour in multiple contexts or known or predicted personal or personality characteristics. the social score obtained from such ai systems may lead to the detrimental or unfavourable treatment of natural persons or whole groups thereof in social and educational contexts , which are unrelated to the context in which the data was originally generated or collected or to a detrimental treatment that is disproportionate or unjustified to the gravity of their social behaviour. such ai systems used directly or indirectly by public authorities an educational institutions for general purpose should be therefore prohibited.


### (17) ai systems providing social scoring of natural persons for general purpose by public authorities or on their behalf may lead to discriminatory outcomes and the exclusion of certain groups. they may violate the right to dignity and non-discrimination and the values of equality and justice. such ai systems evaluate or classify the trustworthiness of natural persons based on their social behaviour in multiple contexts or known or predicted personal or personality characteristics. the social score obtained from such ai systems may lead to the detrimental or unfavourable treatment of natural persons or whole groups thereof in social contexts , which are unrelated to the context in which the data was originally generated or collected or to a detrimental treatment that is disproportionate or unjustified to the gravity of their social behaviour. such ai systems should be therefore prohibited. ### (17) ai systems providing social scoring of natural persons for general purpose by public authorities or on their behalf may lead to discriminatory outcomes and the exclusion of certain groups. they may violate the right to dignity and non-discrimination and the values of equality and justice. such ai systems evaluate or classify natural persons based on their social behaviour in multiple contexts or known or predicted personal or personality characteristics using trustworthiness , good citizenship , patriotism , deviancy , or any other such metric as a proxi. the social score obtained from such ai systems may lead to the detrimental or unfavourable treatment of natural persons or whole groups thereof in social contexts , which are unrelated to the context in which the data was originally generated or collected or to a detrimental treatment that is disproportionate or unjustified to the gravity of their social behaviour. this detrimental treatment can also be effected by providing undue and unjustified privileges to groups of people based on their social score. such ai systems should be therefore prohibited.


### (17) ai systems providing social scoring of natural persons for general purpose by public authorities or on their behalf may lead to discriminatory outcomes and the exclusion of certain groups. they may violate the right to dignity and non-discrimination and the values of equality and justice. such ai systems evaluate or classify the trustworthiness of natural persons based on their social behaviour in multiple contexts or known or predicted personal or personality characteristics. the social score obtained from such ai systems may lead to the detrimental or unfavourable treatment of natural persons or whole groups thereof in social contexts , which are unrelated to the context in which the data was originally generated or collected or to a detrimental treatment that is disproportionate or unjustified to the gravity of their social behaviour. such ai systems should be therefore prohibited. ### (17) ai systems providing social scoring of natural persons for general purpose may lead to discriminatory outcomes and the exclusion of certain groups. they may violate the right to dignity and non-discrimination and the values of equality and justice. such ai systems evaluate or classify the trustworthiness of natural persons based on their social behaviour in multiple contexts or known or predicted personal or personality characteristics. the social score obtained from such ai systems may lead to the detrimental or unfavourable treatment of natural persons or whole groups thereof in social contexts , which are unrelated to the context in which the data was originally generated or collected or to a detrimental treatment that is disproportionate or unjustified to the gravity of their social behaviour. such ai systems should be therefore prohibited.


### (35) ai systems used in education or vocational training , notably for determining access or assigning persons to educational and vocational training institutions or to evaluate persons on tests as part of or as a precondition for their education should be considered high-risk , since they may determine the educational and professional course of a person’s life and therefore affect their ability to secure their livelihood. when improperly designed and used , such systems may violate the right to education and training as well as the right not to be discriminated against and perpetuate historical patterns of discrimination. ### (35) ai systems used on a compulsory bases by education and training institutions in education , or vocational training , notably for determining access or assigning persons to educational and vocational training institutions or to evaluate persons on tests as part of or as a precondition for their education or for determining the areas of study a student should follow should be considered high-risk , since they may determine the educational and professional course of a person’s life and therefore affect their ability to secure their livelihood. when improperly designed and used , such systems may violate the right to education and training as well as the right not to be discriminated against and perpetuate historical patterns of discrimination. however , these systems should be developed and used with the purpose of improving education and vocational training with full respect of the gdpr and other applicable laws. ai systems used to monitor students during tests at education and training institutions should not be considered high-risk , if they use un internal system or database and are fully aligned with the data protection.


### (35) ai systems used in education or vocational training , notably for determining access or assigning persons to educational and vocational training institutions or to evaluate persons on tests as part of or as a precondition for their education should be considered high-risk , since they may determine the educational and professional course of a person’s life and therefore affect their ability to secure their livelihood. when improperly designed and used , such systems may violate the right to education and training as well as the right not to be discriminated against and perpetuate historical patterns of discrimination. ### (35) ai systems used in education or vocational training , notably for determining access or assigning persons to educational and vocational training institutions or to evaluate persons on tests as part of or as a precondition for their education should be prohibited , since they may determine the educational and professional course of a person’s life and therefore affect their ability to secure their livelihood. due to the reproduction of the inherent biases of our societies , such systems may violate the right to education and training as well as the right not to be discriminated against and perpetuate historical patterns of discrimination.


### (36) ai systems used in employment , workers management and access to self-employment , notably for the recruitment and selection of persons , for making decisions on promotion and termination and for task allocation , monitoring or evaluation of persons in work-related contractual relationships , should also be classified as high-risk , since those systems may appreciably impact future career prospects and livelihoods of these persons. relevant work-related contractual relationships should involve employees and persons providing services through platforms as referred to in the commission work programme 2021. such persons should in principle not be considered users within the meaning of this regulation. throughout the recruitment process and in the evaluation , promotion , or retention of persons in work-related contractual relationships , such systems may perpetuate historical patterns of discrimination , for example against women , certain age groups , persons with disabilities , or persons of certain racial or ethnic origins or sexual orientation. ai systems used to monitor the performance and behaviour of these persons may also impact their rights to data protection and privacy. ### (36) ai systems used in employment , workers management and access to self-employment , notably for the recruitment and selection of persons , for making decisions on promotion and termination and for personalised task allocation based on personal or biometric data , monitoring or evaluation of persons in work-related contractual relationships , should also be classified as high-risk , since those systems may appreciably impact future career prospects and livelihoods of these persons. relevant work-related contractual relationships should involve employees and persons providing services through platforms as referred to in the commission work programme 2021. such persons should in principle not be considered users within the meaning of this regulation. throughout the recruitment process and in the evaluation , promotion , or retention of persons in work-related contractual relationships , such systems may perpetuate historical patterns of discrimination , for example against women , certain age groups , persons with disabilities , or persons of certain racial or ethnic origins or sexual orientation. ai systems used to monitor the performance and behaviour of these persons may also impact their rights to data protection and privacy.


### (36) ai systems used in employment , workers management and access to self-employment , notably for the recruitment and selection of persons , for making decisions on promotion and termination and for task allocation , monitoring or evaluation of persons in work-related contractual relationships , should also be classified as high-risk , since those systems may appreciably impact future career prospects and livelihoods of these persons. relevant work-related contractual relationships should involve employees and persons providing services through platforms as referred to in the commission work programme 2021. such persons should in principle not be considered users within the meaning of this regulation. throughout the recruitment process and in the evaluation , promotion , or retention of persons in work-related contractual relationships , such systems may perpetuate historical patterns of discrimination , for example against women , certain age groups , persons with disabilities , or persons of certain racial or ethnic origins or sexual orientation. ai systems used to monitor the performance and behaviour of these persons may also impact their rights to data protection and privacy. ### (36) ai systems used for making autonomous decisions or materially influencing decisions in employment , workers management and access to self-employment , notably for the selection of persons , for making decisions on promotion and termination and for monitoring or evaluation of persons in work-related contractual relationships , should also be classified as high-risk , since those systems may appreciably impact future career prospects and livelihoods of these persons. relevant work-related contractual relationships should involve employees and persons providing services through platforms as referred to in the commission work programme 2021. such persons should in principle not be considered users within the meaning of this regulation. throughout the recruitment process and in the evaluation , promotion , or retention of persons in work-related contractual relationships , such systems may perpetuate historical patterns of discrimination , for example against women , certain age groups , persons with disabilities , or persons of certain racial or ethnic origins or sexual orientation. ai systems used to monitor the performance and behaviour of these persons may also impact their rights to data protection and privacy.


### (36) ai systems used in employment , workers management and access to self-employment , notably for the recruitment and selection of persons , for making decisions on promotion and termination and for task allocation , monitoring or evaluation of persons in work-related contractual relationships , should also be classified as high-risk , since those systems may appreciably impact future career prospects and livelihoods of these persons. relevant work-related contractual relationships should involve employees and persons providing services through platforms as referred to in the commission work programme 2021. such persons should in principle not be considered users within the meaning of this regulation. throughout the recruitment process and in the evaluation , promotion , or retention of persons in work-related contractual relationships , such systems may perpetuate historical patterns of discrimination , for example against women , certain age groups , persons with disabilities , or persons of certain racial or ethnic origins or sexual orientation. ai systems used to monitor the performance and behaviour of these persons may also impact their rights to data protection and privacy. ### (36) ai systems used in employment , workers management and access to self-employment , notably for the recruitment and selection of persons , for making decisions on promotion and termination and for task allocation , monitoring or evaluation of persons in work-related contractual relationships , should also be prohibited , since those systems may appreciably impact future career prospects and livelihoods of these persons. throughout the recruitment process and in the evaluation , promotion , or retention of persons in work-related contractual relationships , such systems perpetuate historical patterns of discrimination , for example against women , certain age groups , persons with disabilities , or persons of certain racial or ethnic origins or sexual orientation. ai systems used to monitor the performance and behaviour of these persons may also impact their rights to data protection and privacy.


### (38) actions by law enforcement authorities involving certain uses of ai systems are characterised by a significant degree of power imbalance and may lead to surveillance , arrest or deprivation of a natural person’s liberty as well as other adverse impacts on fundamental rights guaranteed in the charter. in particular , if the ai system is not trained with high quality data , does not meet adequate requirements in terms of its accuracy or robustness , or is not properly designed and tested before being put on the market or otherwise put into service , it may single out people in a discriminatory or otherwise incorrect or unjust manner. furthermore , the exercise of important procedural fundamental rights , such as the right to an effective remedy and to a fair trial as well as the right of defence and the presumption of innocence , could be hampered , in particular , where such ai systems are not sufficiently transparent , explainable and documented. it is therefore appropriate to classify as high-risk a number of ai systems intended to be used in the law enforcement context where accuracy , reliability and transparency is particularly important to avoid adverse impacts , retain public trust and ensure accountability and effective redress. in view of the nature of the activities in question and the risks relating thereto , those high-risk ai systems should include in particular ai systems intended to be used by law enforcement authorities for individual risk assessments , polygraphs and similar tools or to detect the emotional state of natural person , to detect ‘deep fakes’ , for the evaluation of the reliability of evidence in criminal proceedings , for predicting the occurrence or reoccurrence of an actual or potential criminal offence based on profiling of natural persons , or assessing personality traits and characteristics or past criminal behaviour of natural persons or groups , for profiling in the course of detection , investigation or prosecution of criminal offences , as well as for crime analytics regarding natural persons. ai systems specifically intended to be used for administrative proceedings by tax and customs authorities should not be considered high-risk ai systems used by law enforcement authorities for the purposes of prevention , detection , investigation and prosecution of criminal offences. ### (38) actions by law enforcement authorities involving certain uses of ai systems are characterised by a significant degree of power imbalance and may lead to surveillance , arrest or deprivation of a natural person’s liberty as well as other adverse impacts on fundamental rights guaranteed in the charter. in particular , if the ai system is not trained with high quality data , does not meet adequate requirements in terms of its accuracy or robustness , or is not properly designed and tested before being put on the market or otherwise put into service , it may single out people in a discriminatory or otherwise incorrect or unjust manner. furthermore , the exercise of important procedural fundamental rights , such as the right to an effective remedy and to a fair trial as well as the right of defence and the presumption of innocence , could be hampered , in particular , where such ai systems are not sufficiently transparent , explainable and documented. it is therefore appropriate to classify as high-risk a number of ai systems intended to be used in the law enforcement context where accuracy , reliability and transparency is particularly important to avoid adverse impacts , retain public trust and ensure accountability and effective redress. in view of the nature of the activities in question and the risks relating thereto , those high-risk ai systems should include in particular ai systems intended to be used by law enforcement authorities for individual risk assessments , polygraphs and similar tools or to detect the emotional state of natural person , to detect ‘deep fakes’ , for the evaluation of the reliability of evidence in criminal proceedings , for profiling in the course of detection , investigation or prosecution of criminal offences , as well as for crime analytics regarding natural persons. ai systems specifically intended to be used for administrative proceedings by tax and customs authorities should not be considered high-risk ai systems used by law enforcement authorities for the purposes of prevention , detection , investigation and prosecution of criminal offences.