### (47) to address the opacity that may make certain ai systems incomprehensible to or too complex for natural persons , a certain degree of transparency should be required for high-risk ai systems. users should be able to interpret the system output and use it appropriately. high-risk ai systems should therefore be accompanied by relevant documentation and instructions of use and include concise and clear information , including in relation to possible risks to fundamental rights and discrimination , where appropriate. ### (47) to address the opacity that may make certain ai systems incomprehensible to or too complex for natural persons , a sufficient degree of transparency should be required for high-risk ai systems. users should be able to easily interpret the system output and use it appropriately. high-risk ai systems should therefore be accompanied by relevant documentation and instructions of use and include concise and clear information , including in relation to possible risks to fundamental rights and discrimination. the same applies to ai systems with general purposes that may have high-risk uses that are not forbidden by their developer. in such cases , sufficient information should be made available allowing deployers to carry out tests and analysis on performance , data and usage. the systems and information should also be registered in the eu database for stand-alone high-risk ai systems foreseen in article 60 of this regulation.


### (47) to address the opacity that may make certain ai systems incomprehensible to or too complex for natural persons , a certain degree of transparency should be required for high-risk ai systems. users should be able to interpret the system output and use it appropriately. high-risk ai systems should therefore be accompanied by relevant documentation and instructions of use and include concise and clear information , including in relation to possible risks to fundamental rights and discrimination , where appropriate. ### (47) to address the opacity that may make certain ai systems incomprehensible to or too complex for natural persons , a sufficient degree of transparency should be required for high-risk ai systems. users should be able to interpret the system output and use it appropriately. high-risk ai systems should therefore be accompanied by relevant documentation and instructions of use and include concise and clear information , including in relation to possible risks to fundamental rights and discrimination , where appropriate. the same applies to ai systems with general purposes that may have high-risk uses that are not forbidden by their developer. in such cases , sufficient information should be made available allowing deployers to carry out tests and analysis on performance , data and usage. the systems and information should also be registered in the eu database for stand-alone high-risk ai systems foreseen in article 60 of this regulation.


### (47) to address the opacity that may make certain ai systems incomprehensible to or too complex for natural persons , a certain degree of transparency should be required for high-risk ai systems. users should be able to interpret the system output and use it appropriately. high-risk ai systems should therefore be accompanied by relevant documentation and instructions of use and include concise and clear information , including in relation to possible risks to fundamental rights and discrimination , where appropriate. ### (47) to address the opacity that may make certain ai systems incomprehensible to or too complex for natural persons , a certain degree of transparency and comprehensibility should be required for high-risk ai systems and their algorithms. users should be able to interpret both the algorithmic decision-making and the system output and use it appropriately. high-risk ai systems should therefore be accompanied by relevant documentation and instructions of use and include concise and clear information , including in relation to possible risks to fundamental rights and discrimination , where appropriate.


### (49) high-risk ai systems should perform consistently throughout their lifecycle and meet an appropriate level of accuracy , robustness and cybersecurity in accordance with the generally acknowledged state of the art. the level of accuracy and accuracy metrics should be communicated to the users. ### (49) high-risk ai systems should perform consistently throughout their lifecycle and meet an appropriate level of accuracy , robustness and cybersecurity in accordance with the generally acknowledged state of the art. the level of accuracy and accuracy metrics should be communicated in an intelligible manner to the deployers and users


### (49) high-risk ai systems should perform consistently throughout their lifecycle and meet an appropriate level of accuracy , robustness and cybersecurity in accordance with the generally acknowledged state of the art. the level of accuracy and accuracy metrics should be communicated to the users. ### (49) high-risk ai systems should perform consistently throughout their lifecycle and meet an appropriate level of accuracy , robustness and cybersecurity in accordance with the acknowledged state of the art. accuracy metrics and their expected level must be defined with the primary objective to mitigate risks and negative impact of the ai system to individuals and the society at large , the expected level of accuracy and accuracy metrics should be communicated to the users. the declaration of accuracy metrics cannot however be considered proof of future levels but relevant methods need to be applied to ensure sustainable levels during use


### (49) high-risk ai systems should perform consistently throughout their lifecycle and meet an appropriate level of accuracy , robustness and cybersecurity in accordance with the generally acknowledged state of the art. the level of accuracy and accuracy metrics should be communicated to the users. ### (49) high-risk ai systems should perform consistently throughout their lifecycle and meet an appropriate level of accuracy , robustness and cybersecurity in accordance with the generally acknowledged state of the art. the level of accuracy and accuracy metrics should be communicated in an intelligible manner to the deployers and users.


### (50) the technical robustness is a key requirement for high-risk ai systems. they should be resilient against risks connected to the limitations of the system (e.g. errors , faults , inconsistencies , unexpected situations) as well as against malicious actions that may compromise the security of the ai system and result in harmful or otherwise undesirable behaviour. failure to protect against these risks could lead to safety impacts or negatively affect the fundamental rights , for example due to erroneous decisions or wrong or biased outputs generated by the ai system. ### (50) the technical robustness is a key requirement for high-risk ai systems. they should be resilient against risks connected to the limitations of the system (e.g. errors , faults , inconsistencies , unexpected situations) as well as against malicious actions that may compromise the security of the ai system and result in harmful or otherwise undesirable behaviour. failure to protect against these risks could lead to safety impacts or negatively affect the fundamental rights , for example due to erroneous decisions or wrong or biased outputs generated by the ai system. users of the ai system should take steps to ensure that the possible trade-off between robustness and accuracy does not lead to discriminatory or negative outcomes for minority subgroups.


### (56) to enable enforcement of this regulation and create a level-playing field for operators , and taking into account the different forms of making available of digital products , it is important to ensure that , under all circumstances , a person established in the union can provide authorities with all the necessary information on the compliance of an ai system. therefore , prior to making their ai systems available in the union , where an importer cannot be identified , providers established outside the union shall , by written mandate , appoint an authorised representative established in the union. ### (56) to enable enforcement of this regulation and create a level-playing field for operators , and taking into account the different forms of making available of digital products , it is important to ensure that , under all circumstances , a person established in the union can provide authorities with all the necessary information on the compliance of an ai system. therefore , prior to placing any ai system on the union market , putting it into service or using it , where an importer cannot be identified , operators established outside the union should , by written mandate , appoint a legal representative established in the union. the legal representative should act on behalf of the operator and may be addressed by any competent authorities for the purpose of this regulation. the designation of such a legal representative does not affect the responsibility or liability of the operator under this regulation. such a legal representative should perform its tasks according to the mandate received from the operator , including cooperating with the national supervisory authorities with regard to any action taken to ensure compliance with this regulation. the designated legal representative should be subject to enforcement proceedings in the event of non-compliance by the operator.


### estimation and evaluation of the risks that may emerge when the high-risk ai system is used in accordance with its intended purpose and under conditions of reasonably foreseeable misuse; ### estimation and evaluation of the risks that may emerge when the high-risk ai system is used in accordance with its intended purpose or reasonably foreseeable use and under conditions of reasonably foreseeable misuse;


### (7) the notion of biometric data used in this regulation is in line with and should be interpreted consistently with the notion of biometric data as defined in article 4(14) of regulation (eu) 2016/679 of the european parliament and of the council35 , article 3(18) of regulation (eu) 2018/1725 of the european parliament and of the council36 and article 3(13) of directive (eu) 2016/680 of the european parliament and of the council37 . ### (7) the notion of biometric data used in this regulation is the same as that defined in article 4(14) of regulation (eu) 2016/679 of the european parliament and of the council35.


### (11) in light of their digital nature , certain ai systems should fall within the scope of this regulation even when they are neither placed on the market , nor put into service , nor used in the union. this is the case for example of an operator established in the union that contracts certain services to an operator established outside the union in relation to an activity to be performed by an ai system that would qualify as high-risk and whose effects impact natural persons located in the union. in those circumstances , the ai system used by the operator outside the union could process data lawfully collected in and transferred from the union , and provide to the contracting operator in the union the output of that ai system resulting from that processing , without that ai system being placed on the market , put into service or used in the union. to prevent the circumvention of this regulation and to ensure an effective protection of natural persons located in the union , this regulation should also apply to providers and users of ai systems that are established in a third country , to the extent the output produced by those systems is used in the union. nonetheless , to take into account existing arrangements and special needs for cooperation with foreign partners with whom information and evidence is exchanged , this regulation should not apply to public authorities of a third country and international organisations when acting in the framework of international agreements concluded at national or european level for law enforcement and judicial cooperation with the union or with its member states. such agreements have been concluded bilaterally between member states and third countries or between the european union , europol and other eu agencies and third countries and international organisations. ### (11) in light of their digital nature , certain ai systems should fall within the scope of this regulation even when they are neither placed on the market , nor put into service , nor used in the union. this is the case for example of an operator established in the union that contracts certain services to an operator established outside the union in relation to an activity to be performed by an ai system that would qualify as high-risk and whose effects impact natural persons located in the union. in those circumstances , the ai system used by the operator outside the union could process data lawfully collected in and transferred from the union , and provide to the contracting operator in the union the output of that ai system resulting from that processing , without that ai system being placed on the market , put into service or used in the union. to prevent the circumvention of this regulation and to ensure an effective protection of natural persons located in the union , this regulation should also apply to providers and users of ai systems that are established in a third country , to the extent the output produced by those systems is used in the union.


### (11) in light of their digital nature , certain ai systems should fall within the scope of this regulation even when they are neither placed on the market , nor put into service , nor used in the union. this is the case for example of an operator established in the union that contracts certain services to an operator established outside the union in relation to an activity to be performed by an ai system that would qualify as high-risk and whose effects impact natural persons located in the union. in those circumstances , the ai system used by the operator outside the union could process data lawfully collected in and transferred from the union , and provide to the contracting operator in the union the output of that ai system resulting from that processing , without that ai system being placed on the market , put into service or used in the union. to prevent the circumvention of this regulation and to ensure an effective protection of natural persons located in the union , this regulation should also apply to providers and users of ai systems that are established in a third country , to the extent the output produced by those systems is used in the union. nonetheless , to take into account existing arrangements and special needs for cooperation with foreign partners with whom information and evidence is exchanged , this regulation should not apply to public authorities of a third country and international organisations when acting in the framework of international agreements concluded at national or european level for law enforcement and judicial cooperation with the union or with its member states. such agreements have been concluded bilaterally between member states and third countries or between the european union , europol and other eu agencies and third countries and international organisations. ### (11) in light of their digital nature , certain ai systems should fall within the scope of this regulation even when they are neither placed on the market , nor put into service , nor used in the union. this is the case for example of an operator established in the union that contracts certain services to an operator established outside the union in relation to an activity to be performed by an ai system whose effects impact natural persons located in the union. in those circumstances , the ai system used by the operator outside the union could process data lawfully collected in and transferred from the union , and provide to the contracting operator in the union the output of that ai system resulting from that processing , without that ai system being placed on the market , put into service or used in the union. to prevent the circumvention of this regulation and to ensure an effective protection of natural persons located in the union , this regulation should also apply to providers and users of ai systems that are established in a third country , to the extent the output produced by those systems is used in the union or it affects natural persons within the union.


### (12) this regulation should also apply to union institutions , offices , bodies and agencies when acting as a provider or user of an ai system. ai systems exclusively developed or used for military purposes should be excluded from the scope of this regulation where that use falls under the exclusive remit of the common foreign and security policy regulated under title v of the treaty on the european union (teu). this regulation should be without prejudice to the provisions regarding the liability of intermediary service providers set out in directive 2000/31/ec of the european parliament and of the council [as amended by the digital services act]. ### (12) this regulation should also apply to union institutions , offices , bodies and agencies when acting as a provider or user of an ai system. this regulation should be without prejudice to the provisions regarding the liability of intermediary service providers set out in directive 2000/31/ec of the european parliament and of the council [as amended by the digital services act].


### 1. before making a high-risk ai system available on the market , distributors shall verify that the high-risk ai system bears the required ce conformity marking , that it is accompanied by the required documentation and instruction of use , and that the provider and the importer of the system , as applicable , have complied with the obligations set out in this regulation. ### 1. before making a high-risk ai system available on the market , distributors shall verify that the high-risk ai system bears the required ce conformity marking and the energy efficiency and carbon intensity marking , that it is accompanied by the required concise and clear documentation and instruction of use , including in relation to possible risks to fundamental rights and discrimination , and that the provider and the importer of the system , as applicable , have complied with the obligations set out in this regulation.


### 4. users shall monitor the operation of the high-risk ai system on the basis of the instructions of use. when they have reasons to consider that the use in accordance with the instructions of use may result in the ai system presenting a risk within the meaning of article 65(1) they shall inform the provider or distributor and suspend the use of the system. they shall also inform the provider or distributor when they have identified any serious incident or any malfunctioning within the meaning of article 62 and interrupt the use of the ai system. in case the user is not able to reach the provider , article 62 shall apply mutatis mutandis. ### 4. users shall monitor the operation of the high-risk ai system on the basis of the instructions of use. when they have reasons to consider that the use in accordance with the instructions of use may result in the ai system presenting a risk within the meaning of article 65(1) they shall immediately inform the provider or distributor and suspend the use of the system. they shall also immediately inform the provider or distributor when they have identified any serious incident or any malfunctioning , including near misses , within the meaning of article 62 and interrupt the use of the ai system. in case the user is not able to reach the provider , article 62 shall apply mutatis mutandis.


### 1. member states shall undertake the following actions: ### 1. the national supervisory authority shall undertake the following actions:


### 1 european artificial intelligence board ### 1 european agency for data and artificial intelligence (‘eada’)


### establishment of the european artificial intelligence board ### european artificial intelligence board


### establishment of the european artificial intelligence board ### european agency for data and artificial intelligence (‘eada’)


### 1. a ‘european artificial intelligence board’ (the ‘board’) is established. ### 1. an independent ‘european artificial intelligence board’ (the ‘board’) is hereby established as a body of the union and shall have legal personality.


### 1. a ‘european artificial intelligence board’ (the ‘board’) is established. ### 1. a european agency for data and artificial intelligence (the ‘agency’) is established to promote a trustworthy , effective and competitive internal market for the data and artificial intelligence sectors.


### 2. the board shall provide advice and assistance to the commission in order to: ### 2. the agency shall provide advice and assistance to the commission and the member states , when implementing union law related to data and artificial intelligence. it shall cooperate with the developers and deployers of ai systems , in order to:


### contribute to the effective cooperation of the national supervisory authorities and the commission with regard to matters covered by this regulation; ### promote and support the effective cooperation of the national supervisory authorities and the commission;


### contribute to the effective cooperation of the national supervisory authorities and the commission with regard to matters covered by this regulation; ### promote and support effective cooperation of the national supervisory authorities and the commission with regard to matters covered by this regulation;


### structure of the board ### structure and independence of the board


### structure of the board ### mandate and structure of the agency


### 2. the board shall adopt its rules of procedure by a simple majority of its members , following the consent of the commission. the rules of procedure shall also contain the operational aspects related to the execution of the board’s tasks as listed in article 58. the board may establish sub-groups as appropriate for the purpose of examining specific questions. ### 2. the board shall adopt its rules of procedure by a simple two-thirds majority of its voting members and organise its own operational arrangements.


### 2. the board shall adopt its rules of procedure by a simple majority of its members , following the consent of the commission. the rules of procedure shall also contain the operational aspects related to the execution of the board’s tasks as listed in article 58. the board may establish sub-groups as appropriate for the purpose of examining specific questions. ### 2. the agency’s board shall adopt its rules of procedure , namely with regard to the election of its chair , by a simple majority of its members , with the assistance of the agency’s secretariat. the agency’s secretariat shall convene the meetings and prepare the agenda in accordance with the task of the agency’s board pursuant with its rules of procedure. the agency’s secretariat will provide administrative and analytical support for the activities of the board pursuant to this regulation.


### tasks of the board ### tasks of the agency


### when providing advice and assistance to the commission in the context of article 56(2) , the board shall in particular: ### when providing advice and assistance to the commission and the national supervisory authorities in the context of article 56(2) , the board shall in particular:


### when providing advice and assistance to the commission in the context of article 56(2) , the board shall in particular: ### when providing advice and assistance to the commission , the member states and in cooperation with the developers , deployers and users of ai systems with regard to the application of this regulation , the agency shall:


### collect and share expertise and best practices among member states; ### collect and share expertise and best practices in implementation of this regulation;


### issue opinions , recommendations or written contributions on matters related to the implementation of this regulation , in particular ### issue opinions , recommendations or written contributions on matters related to the implementation of this regulation , in consultation with relevant stakeholders , in particular


### issue opinions , recommendations or written contributions on matters related to the implementation of this regulation , in particular ### issue opinions , recommendations or written contributions on matters related to the implementation of this regulation , after consulting relevant stakeholders , in particular


### issue opinions , recommendations or written contributions on matters related to the implementation of this regulation , in particular ### issue guidelines , opinions , recommendations or written contributions on matters related to the implementation of this regulation , in particular


### 2 national competent authorities ### 2 national competent authorities and national supervisory authorities


### 2. each member state shall designate a national supervisory authority among the national competent authorities. the national supervisory authority shall act as notifying authority and market surveillance authority unless a member state has organisational and administrative reasons to designate more than one authority. ### deleted


### 3. member states shall inform the commission of their designation or designations and , where applicable , the reasons for designating more than one authority. ### 3. member states shall inform the commission and the agency of their designation or designations and , where applicable , the reasons for designating more than one authority.


### 5. member states shall report to the commission on an annual basis on the status of the financial and human resources of the national competent authorities with an assessment of their adequacy. the commission shall transmit that information to the board for discussion and possible recommendations. ### 5. member states shall report to the commission on an annual basis on the status of the financial and human resources of the national competent authorities with an assessment of their adequacy. the commission shall transmit that information to the agency for discussion and possible recommendations.


### 6. the commission shall facilitate the exchange of experience between national competent authorities. ### 6. the commission and the board shall facilitate the exchange of experience between national competent authorities.


### 6. the commission shall facilitate the exchange of experience between national competent authorities. ### 6. the agency shall facilitate the exchange of experience between national competent authorities.


### 8. when union institutions , agencies and bodies fall within the scope of this regulation , the european data protection supervisor shall act as the competent authority for their supervision. ### 8. when union institutions , agencies and bodies fall within the scope of this regulation , the agency shall act as the competent authority for their supervision.


### eu database for stand-alone high-risk ai systems ### eu database for ai systems


### 1. the commission shall , in collaboration with the member states , set up and maintain a eu database containing information referred to in paragraph 2 concerning high-risk ai systems referred to in article 6(2) which are registered in accordance with article 51. ### 1. the commission shall , in collaboration with the member states , set up and maintain a eu database containing information referred to in paragraph 2 and 2a concerning ai systems which are registered in accordance with article 51 , as well as users of any ai systems by public authorities and union institutions , bodies , offices or agencies.


### 1. the commission shall , in collaboration with the member states , set up and maintain a eu database containing information referred to in paragraph 2 concerning high-risk ai systems referred to in article 6(2) which are registered in accordance with article 51. ### 1. the agency shall , in collaboration with the member states , set up and maintain a eu database containing information referred to in paragraph 2 concerning high-risk ai systems referred to in article 6(2) which are registered in accordance with article 51 , as well as the information referred to in new paragraph 3x new of article 52.


### 2. the data listed in annex viii shall be entered into the eu database by the providers. the commission shall provide them with technical and administrative support. ### 2. the data listed in annex viii shall be entered into the eu database by the providers. the agency shall provide them with technical and administrative support.


### 5. the commission shall be the controller of the eu database. it shall also ensure to providers adequate technical and administrative support. ### 5. the commission shall be the controller of the eu database.


### 5. the commission shall be the controller of the eu database. it shall also ensure to providers adequate technical and administrative support. ### 5. the agency shall be the controller of the eu database. it shall also ensure to providers adequate technical and administrative support.


### 1. providers of high-risk ai systems placed on the union market shall report any serious incident or any malfunctioning of those systems which constitutes a breach of obligations under union law intended to protect fundamental rights to the market surveillance authorities of the member states where that incident or breach occurred. ### 1. providers and , where users have identified a serious incident or malfunctioning , users of high-risk ai systems placed on the union market shall report any serious incident or any malfunctioning of those systems which constitutes a breach of obligations under union law to the market surveillance authorities of the member states where that incident or breach occurred and to the affected persons and , where the incident or breach occurs or is likely to occur in at least two member states , to the commission.


### 1. providers of high-risk ai systems placed on the union market shall report any serious incident or any malfunctioning of those systems which constitutes a breach of obligations under union law intended to protect fundamental rights to the market surveillance authorities of the member states where that incident or breach occurred. ### 1. providers and , where users have identified a serious incident or malfunctioning , users of ai systems placed on the union market shall report any serious incident or any malfunctioning , including near misses , of those systems which constitutes a breach of obligations under union law to the national supervisory authorities and the market surveillance authorities of the member states where that incident or breach occurred and , where relevant , to the commission and to the affected persons.


### such notification shall be made immediately after the provider has established a causal link between the ai system and the incident or malfunctioning or the reasonable likelihood of such a link , and , in any event , not later than 15 days after the providers becomes aware of the serious incident or of the malfunctioning. ### such notification shall be made immediately when an ai system is involved in an incident or malfunctioning , including near misses , and , in any event , not later than 72 hours after the providers or , where applicable , the user becomes aware of the serious incident or of the malfunctioning.


### 3. for high-risk ai systems referred to in point 5(b) of annex iii which are placed on the market or put into service by providers that are credit institutions regulated by directive 2013/36/eu and for high-risk ai systems which are safety components of devices , or are themselves devices , covered by regulation (eu) 2017/745 and regulation (eu) 2017/746 , the notification of serious incidents or malfunctioning shall be limited to those that that constitute a breach of obligations under union law intended to protect fundamental rights. ### 3. for high-risk ai systems referred to in point 5(b) of annex iii which are placed on the market or put into service by providers that are credit institutions regulated by directive 2013/36/eu and for high-risk ai systems which are safety components of devices , or are themselves devices , covered by regulation (eu) 2017/745 and regulation(eu) 2017/746 , the notification of serious incidents or malfunctioning for the purposes of this regulation shall be limited to those that that constitute a breach of obligations under union law intended to protect fundamental rights and the environment.


### 5. for ai systems listed in point 1(a) in so far as the systems are used for law enforcement purposes , points 6 and 7 of annex iii , member states shall designate as market surveillance authorities for the purposes of this regulation either the competent data protection supervisory authorities under directive (eu) 2016/680 , or regulation 2016/679 or the national competent authorities supervising the activities of the law enforcement , immigration or asylum authorities putting into service or using those systems. ### 5. for ai systems that are used for law enforcement purposes , member states shall designate as market surveillance authorities for the purposes of this regulation the competent data protection supervisory authorities under directive (eu) 2016/680 , or regulation 2016/679.


### 5. for ai systems listed in point 1(a) in so far as the systems are used for law enforcement purposes , points 6 and 7 of annex iii , member states shall designate as market surveillance authorities for the purposes of this regulation either the competent data protection supervisory authorities under directive (eu) 2016/680 , or regulation 2016/679 or the national competent authorities supervising the activities of the law enforcement , immigration or asylum authorities putting into service or using those systems. ### 5. for ai systems listed in point 1(a) in so far as the systems are used for law enforcement purposes member states shall designate as market surveillance authorities for the purposes of this regulation the competent data protection supervisory authorities under directive (eu) 2016/680 or regulation 2016/679.


### 3. national public authorities or bodies which supervise or enforce the respect of obligations under union law protecting fundamental rights in relation to the use of high-risk ai systems referred to in annex iii shall have the power to request and access any documentation created or maintained under this regulation when access to that documentation is necessary for the fulfilment of the competences under their mandate within the limits of their jurisdiction. the relevant public authority or body shall inform the market surveillance authority of the member state concerned of any such request. ### 3. national public authorities or bodies , which supervise or enforce the respect of obligations under union law protecting fundamental rights in relation to the use of high-risk ai systems referred to in annex iii shall have the power to request and access any documentation created or maintained under this regulation when access to that documentation is necessary for the fulfilment of the competences under their mandate within the limits of their jurisdiction.


### 4. by 3 months after the entering into force of this regulation , each member state shall identify the public authorities or bodies referred to in paragraph 3 and make a list publicly available on the website of the national supervisory authority. member states shall notify the list to the commission and all other member states and keep the list up to date. ### deleted


### 5. where the documentation referred to in paragraph 3 is insufficient to ascertain whether a breach of obligations under union law intended to protect fundamental rights has occurred , the public authority or body referred to paragraph 3 may make a reasoned request to the market surveillance authority to organise testing of the high-risk ai system through technical means. the market surveillance authority shall organise the testing with the close involvement of the requesting public authority or body within reasonable time following the request. ### 5. where the documentation referred to in paragraph 3 is insufficient to ascertain whether a breach of obligations under union law intended to protect fundamental rights has occurred , the public authority or body referred to paragraph 3 may make a reasoned request to the national supervisory authority , the market surveillance authority , or where applicable the commission , to organise testing of the high-risk ai system through technical means. the national supervisory authority , the market surveillance authority or where applicable the commission shall organise the testing with the close involvement of the requesting public authority or body within reasonable time following the request.


### procedure for dealing with ai systems presenting a risk at national level ### procedure for dealing with ai systems presenting a risk


### 2. where the market surveillance authority of a member state has sufficient reasons to consider that an ai system presents a risk as referred to in paragraph 1 , they shall carry out an evaluation of the ai system concerned in respect of its compliance with all the requirements and obligations laid down in this regulation. when risks to the protection of fundamental rights are present , the market surveillance authority shall also inform the relevant national public authorities or bodies referred to in article 64(3). the relevant operators shall cooperate as necessary with the market surveillance authorities and the other national public authorities or bodies referred to in article 64(3). ### 2. where the market surveillance authority of a member state has sufficient reasons to consider that an ai system presents a risk as referred to in paragraph 1 , they shall carry out an evaluation of the ai system concerned in respect of its compliance with all the requirements and obligations laid down in this regulation. when risks to the protection of fundamental rights are present , the market surveillance authority shall also inform the relevant national public authorities or bodies referred to in article 64(3). where there is sufficient reason to consider that that an ai system exploits the vulnerabilities of children or violates their rights intentionally or unintentionally , the market surveillance authority shall have the duty to investigate the design goals , data inputs , model selection , implementation and outcomes of the ai system and the burden of proof shall be on the operator or operators of that system to demonstrate compliance with the provisions of this regulation. the relevant operators shall cooperate as necessary with the market surveillance authorities and the other national public authorities or bodies referred to in article 64(3) , including by providing access to personnel , documents , internal communications , code , data samples and on platform testing as necessary. where , in the course of its evaluation , the market surveillance authority finds that the ai system does not comply with the requirements and obligations laid down in this regulation , it shall without delay require the relevant operator to take all appropriate corrective actions to bring the ai system into compliance , to withdraw the ai system from the market , or to recall it within a reasonable period , commensurate with the nature of the risk , as it may prescribe. the corrective action can also be applied to ai systems in other products or services judged to be similar in their objectives , design or impact.


### 2. where the market surveillance authority of a member state has sufficient reasons to consider that an ai system presents a risk as referred to in paragraph 1 , they shall carry out an evaluation of the ai system concerned in respect of its compliance with all the requirements and obligations laid down in this regulation. when risks to the protection of fundamental rights are present , the market surveillance authority shall also inform the relevant national public authorities or bodies referred to in article 64(3). the relevant operators shall cooperate as necessary with the market surveillance authorities and the other national public authorities or bodies referred to in article 64(3). ### 2. where the market surveillance authority of a member state has sufficient reasons to consider that an ai system presents a risk to the health and safety of persons , they shall carry out an evaluation of the ai system concerned in respect of its compliance with all the requirements and obligations laid down in this regulation.


### 2. where the market surveillance authority of a member state has sufficient reasons to consider that an ai system presents a risk as referred to in paragraph 1 , they shall carry out an evaluation of the ai system concerned in respect of its compliance with all the requirements and obligations laid down in this regulation. when risks to the protection of fundamental rights are present , the market surveillance authority shall also inform the relevant national public authorities or bodies referred to in article 64(3). the relevant operators shall cooperate as necessary with the market surveillance authorities and the other national public authorities or bodies referred to in article 64(3). ### 2. where the market surveillance authority of a member state has sufficient reasons to consider that an ai system presents a risk as referred to in paragraph 1 , they shall carry out an evaluation of the ai system concerned in respect of its compliance with all the requirements and obligations laid down in this regulation. when risks to the protection of fundamental rights are present , the market surveillance authority ex-officio or following a complaint by civil society organisations or other stakeholders shall also inform the relevant national public authorities or bodies referred to in article 64(3). the relevant operators shall cooperate as necessary with the market surveillance authorities and the other national public authorities or bodies referred to in article 64(3).


### where , in the course of that evaluation , the market surveillance authority finds that the ai system does not comply with the requirements and obligations laid down in this regulation , it shall without delay require the relevant operator to take all appropriate corrective actions to bring the ai system into compliance , to withdraw the ai system from the market , or to recall it within a reasonable period , commensurate with the nature of the risk , as it may prescribe. ### where , in the course of that evaluation , the market surveillance authority or , where relevant , the national public authority referred to in article 64(3) finds that the ai system does not comply with the requirements and obligations laid down in this regulation , it shall without delay require the relevant operator to take all appropriate corrective actions to bring the ai system into compliance , to withdraw the ai system from the market , or to recall it within a reasonable period , commensurate with the nature of the risk , as it may prescribe , and in any case no later than 15 working days.


### 3. where the market surveillance authority considers that non-compliance is not restricted to its national territory , it shall inform the commission and the other member states of the results of the evaluation and of the actions which it has required the operator to take. ### 3. where the market surveillance authority or , where relevant , the national supervisory authority , considers that non-compliance is not restricted to its national territory , it shall inform the board , the commission and the member states’ competent authorities of the results of the evaluation and of the actions which it has required the operator to take.


### 3. where the market surveillance authority considers that non-compliance is not restricted to its national territory , it shall inform the commission and the other member states of the results of the evaluation and of the actions which it has required the operator to take. ### 3. where the market surveillance authority considers that non-compliance is not restricted to its national territory , it shall inform the agency , the commission and the other member states of the results of the evaluation and of the actions which it has required the operator to take.


### 5. where the operator of an ai system does not take adequate corrective action within the period referred to in paragraph 2 , the market surveillance authority shall take all appropriate provisional measures to prohibit or restrict the ai system's being made available on its national market , to withdraw the product from that market or to recall it. that authority shall inform the commission and the other member states , without delay , of those measures. ### 5. where the operator of an ai system does not take adequate corrective action within the period referred to in paragraph 2b , the market surveillance authority or , where relevant , the national supervisory authority , shall take all appropriate provisional measures to prohibit or restrict the ai system's being made available on its national market or put into service , to withdraw the ai system from that market or to recall it. that authority shall immediately inform the commission , the board and the member states’ market surveillance authorities , of those measures.


### 5. where the operator of an ai system does not take adequate corrective action within the period referred to in paragraph 2 , the market surveillance authority shall take all appropriate provisional measures to prohibit or restrict the ai system's being made available on its national market , to withdraw the product from that market or to recall it. that authority shall inform the commission and the other member states , without delay , of those measures. ### 5. where the operator of an ai system does not take adequate corrective action within the period referred to in paragraph 2 , the market surveillance authority shall take all appropriate provisional measures to prohibit or restrict the ai system's being made available on its national market or put into service , to withdraw the ai system from that market or to recall it. that authority shall immediately inform the commission , the board and the other member states , of those measures.


### 5. where the operator of an ai system does not take adequate corrective action within the period referred to in paragraph 2 , the market surveillance authority shall take all appropriate provisional measures to prohibit or restrict the ai system's being made available on its national market , to withdraw the product from that market or to recall it. that authority shall inform the commission and the other member states , without delay , of those measures. ### 5. where the operator of an ai system does not take adequate corrective action within the period referred to in paragraph 2 , the market surveillance authority shall take all appropriate provisional measures to prohibit or restrict the ai system's being made available on its national market , to withdraw the product from that market or to recall it. that authority shall inform the agency , the commission and the other member states , without delay , of those measures.


### (55) where a high-risk ai system that is a safety component of a product which is covered by a relevant new legislative framework sectorial legislation is not placed on the market or put into service independently from the product , the manufacturer of the final product as defined under the relevant new legislative framework legislation should comply with the obligations of the provider established in this regulation and notably ensure that the ai system embedded in the final product complies with the requirements of this regulation. ### (55) where a high-risk ai system that is a safety component of a product which is covered by a relevant new legislative framework sectorial legislation is not placed on the market or put into service independently from the product , the manufacturer of the final product as defined under the relevant new legislative framework legislation should comply with the obligations of the provider established in this regulation , including the information about the energy consumption and carbon intensity of the component , and notably ensure that the ai system embedded in the final product complies with the requirements of this regulation.


### (68) under certain conditions , rapid availability of innovative technologies may be crucial for health and safety of persons and for society as a whole. it is thus appropriate that under exceptional reasons of public security or protection of life and health of natural persons and the protection of industrial and commercial property , member states could authorise the placing on the market or putting into service of ai systems which have not undergone a conformity assessment. ### (68) under certain conditions , rapid availability of innovative technologies may be crucial for health and safety of persons , the environment and climate change and for society as a whole. it is thus appropriate that under exceptional reasons of public security or protection of life and health of natural persons , the protection of the environment and the protection of industrial and commercial property , member states could authorise the placing on the market or putting into service of ai systems which have not undergone a conformity assessment.


### (68) under certain conditions , rapid availability of innovative technologies may be crucial for health and safety of persons and for society as a whole. it is thus appropriate that under exceptional reasons of public security or protection of life and health of natural persons and the protection of industrial and commercial property , member states could authorise the placing on the market or putting into service of ai systems which have not undergone a conformity assessment. ### (68) under certain conditions , rapid availability of innovative technologies may be crucial for health and safety of persons and for society as a whole. it is thus appropriate that under exceptional and ethically justified reasons of public security or protection of life and health of natural persons and the protection of industrial and commercial property , member states could authorise the placing on the market or putting into service of ai systems which have not undergone a conformity assessment.


### (78) in order to ensure that providers of high-risk ai systems can take into account the experience on the use of high-risk ai systems for improving their systems and the design and development process or can take any possible corrective action in a timely manner , all providers should have a post-market monitoring system in place. this system is also key to ensure that the possible risks emerging from ai systems which continue to ‘learn’ after being placed on the market or put into service can be more efficiently and timely addressed. in this context , providers should also be required to have a system in place to report to the relevant authorities any serious incidents or any breaches to national and union law protecting fundamental rights resulting from the use of their ai systems. ### (78) in order to ensure that providers of high-risk ai systems can take into account the experience on the use of high-risk ai systems for improving their systems and the design and development process or can take any possible corrective action in a timely manner , all providers should have a post-market monitoring system in place. this system is also key to ensure that the possible risks emerging from ai systems which continue to ‘learn’ after being placed on the market or put into service can be more efficiently and timely addressed. in this context , providers should also be required to have a system in place to report to the relevant authorities any serious incidents or any breaches to national and union law protecting fundamental rights resulting from the use of their ai systems. likewise , civil society organisations and other stakeholders should be enabled to provide input and lodge complaints if the protection of fundamental rights or public interest is at risk.


### 5. to the extent that it is strictly necessary for the purposes of ensuring bias monitoring , detection and correction in relation to the high-risk ai systems , the providers of such systems may process special categories of personal data referred to in article 9(1) of regulation (eu) 2016/679 , article 10 of directive (eu) 2016/680 and article 10(1) of regulation (eu) 2018/1725 , subject to appropriate safeguards for the fundamental rights and freedoms of natural persons , including technical limitations on the re-use and use of state-of-the-art security and privacy-preserving measures , such as pseudonymisation , or encryption where anonymisation may significantly affect the purpose pursued. ### 5. to the extent that it is strictly necessary for the purposes of ensuring bias monitoring , detection and correction in relation to the high-risk ai systems and to ensure algorithmic non-discrimination , the providers of such systems may process special categories of personal data referred to in article 9(1) of regulation (eu) 2016/679 , article 10 of directive (eu) 2016/680 and article 10(1) of regulation (eu) 2018/1725 , subject to appropriate safeguards for the fundamental rights and freedoms of natural persons , including technical limitations on the re-use and use of state-of-the-art security and privacy-preserving measures , such as pseudonymisation , or encryption where anonymisation may significantly affect the purpose pursued.


### to affix the ce marking to their high-risk ai systems to indicate the conformity with this regulation in accordance with article 49; ### to affix the ce marking and the energy efficiency and carbon intensity marking to their high-risk ai systems to indicate the conformity with this regulation in accordance with article 49 and their energy consumption and carbon intensity in accordance with article 49a , respectively;


### the system bears the required conformity marking and is accompanied by the required documentation and instructions of use. ### the system bears the required conformity marking and is accompanied by the required concise and clear documentation and instructions of use , including in relation to possible risks to fundamental rights and discrimination.


### 2. for high-risk ai systems referred to in points 2 to 8 of annex iii , providers shall follow the conformity assessment procedure based on internal control as referred to in annex vi , which does not provide for the involvement of a notified body. for high-risk ai systems referred to in point 5(b) of annex iii , placed on the market or put into service by credit institutions regulated by directive 2013/36/eu , the conformity assessment shall be carried out as part of the procedure referred to in articles 97 to101 of that directive. ### 2. for high-risk ai systems referred to in points 2 to 9 of annex iii , providers shall follow the conformity assessment procedure based on internal control as referred to in annex vi , which does not provide for the involvement of a notified body. for high-risk ai systems referred to in point 5(b) of annex iii , placed on the market or put into service by credit institutions regulated by directive 2013/36/eu , the conformity assessment shall be carried out as part of the procedure referred to in articles 97 to101 of that directive.


### (ii) public safety and public health , including disease prevention , control and treatment; ### (ii) public safety and public health , including disease prevention , control and treatment , and the health challenges in relation to the inter-linkage between human and animal health , in particular zoonotic diseases;


### instructions of use for the user and , where applicable installation instructions; ### clear and concise instructions of use for the user including in relation to possible risks to fundamental rights and discrimination and , where applicable installation instructions;


### 6. where union institutions , agencies and bodies fall within the scope of this regulation , the european data protection supervisor shall act as their market surveillance authority. ### 6. where union institutions , agencies and bodies fall within the scope of this regulation , the agency shall act as their market surveillance authority.


### confidentiality and penalties ### confidentiality , remedies and penalties


### 4. before taking decisions pursuant to this article , the european data protection supervisor shall give the union institution , agency or body which is the subject of the proceedings conducted by the european data protection supervisor the opportunity of being heard on the matter regarding the possible infringement. the european data protection supervisor shall base his or her decisions only on elements and circumstances on which the parties concerned have been able to comment. complainants , if any , shall be associated closely with the proceedings. ### 4. before taking decisions pursuant to this article , the agency shall give the union institution , agency or body which is the subject of the proceedings conducted by the agency the opportunity of being heard on the matter regarding the possible infringement. the european agency shall base its decisions only on elements and circumstances on which the parties concerned have been able to comment. complainants , if any , shall be associated closely with the proceedings.


### 2. this regulation shall apply to the high-risk ai systems , other than the ones referred to in paragraph 1 , that have been placed on the market or put into service before [date of application of this regulation referred to in article 85(2)] , only if , from that date , those systems are subject to significant changes in their design or intended purpose. ### 2. this regulation shall apply to the high-risk ai systems , other than the ones referred to in paragraph 1 , that have been placed on the market or put into service before [date of application of this regulation referred to in article 85(2)] , only if , from that date , those systems are subject to substantial modifications as defined in article 3(23) in their design or intended purpose.


### (72) the objectives of the regulatory sandboxes should be to foster ai innovation by establishing a controlled experimentation and testing environment in the development and pre-marketing phase with a view to ensuring compliance of the innovative ai systems with this regulation and other relevant union and member states legislation; to enhance legal certainty for innovators and the competent authorities’ oversight and understanding of the opportunities , emerging risks and the impacts of ai use , and to accelerate access to markets , including by removing barriers for small and medium enterprises (smes) and start-ups. to ensure uniform implementation across the union and economies of scale , it is appropriate to establish common rules for the regulatory sandboxes’ implementation and a framework for cooperation between the relevant authorities involved in the supervision of the sandboxes. this regulation should provide the legal basis for the use of personal data collected for other purposes for developing certain ai systems in the public interest within the ai regulatory sandbox , in line with article 6(4) of regulation (eu) 2016/679 , and article 6 of regulation (eu) 2018/1725 , and without prejudice to article 4(2) of directive (eu) 2016/680. participants in the sandbox should ensure appropriate safeguards and cooperate with the competent authorities , including by following their guidance and acting expeditiously and in good faith to mitigate any high-risks to safety and fundamental rights that may arise during the development and experimentation in the sandbox. the conduct of the participants in the sandbox should be taken into account when competent authorities decide whether to impose an administrative fine under article 83(2) of regulation 2016/679 and article 57 of directive 2016/680. ### (72) the objectives of the regulatory sandboxes should be to foster ai innovation by establishing a controlled experimentation and testing environment in the development and pre-marketing phase with a view to ensuring compliance of the innovative ai systems with this regulation and other relevant union and member states legislation; to enhance legal certainty for innovators and the competent authorities’ oversight and understanding of the opportunities , emerging risks and the impacts of ai use , and to accelerate access to markets , including by removing barriers for small and medium enterprises (smes) and start-ups; to contribute to the development of ethical , socially responsible and environmentally sustainable ai systems , in line with the ethical principles outlined in this regulation. to ensure uniform implementation across the union and economies of scale , it is appropriate to establish common rules for the regulatory sandboxes’ implementation and a framework for cooperation between the relevant authorities involved in the supervision of the sandboxes. this regulation should provide the legal basis for the use of personal data collected for other purposes for developing certain ai systems in the public interest within the ai regulatory sandbox , in line with article 6(4) of regulation (eu) 2016/679 , and article 6 of regulation (eu) 2018/1725 , and without prejudice to article 4(2) of directive (eu) 2016/680. participants in the sandbox should ensure appropriate safeguards and cooperate with the competent authorities , including by following their guidance and acting expeditiously and in good faith to mitigate any high-risks to safety and fundamental rights that may arise during the development and experimentation in the sandbox. the conduct of the participants in the sandbox should be taken into account when competent authorities decide whether to impose an administrative fine under article 83(2) of regulation 2016/679 and article 57 of directive 2016/680.


### (72) the objectives of the regulatory sandboxes should be to foster ai innovation by establishing a controlled experimentation and testing environment in the development and pre-marketing phase with a view to ensuring compliance of the innovative ai systems with this regulation and other relevant union and member states legislation; to enhance legal certainty for innovators and the competent authorities’ oversight and understanding of the opportunities , emerging risks and the impacts of ai use , and to accelerate access to markets , including by removing barriers for small and medium enterprises (smes) and start-ups. to ensure uniform implementation across the union and economies of scale , it is appropriate to establish common rules for the regulatory sandboxes’ implementation and a framework for cooperation between the relevant authorities involved in the supervision of the sandboxes. this regulation should provide the legal basis for the use of personal data collected for other purposes for developing certain ai systems in the public interest within the ai regulatory sandbox , in line with article 6(4) of regulation (eu) 2016/679 , and article 6 of regulation (eu) 2018/1725 , and without prejudice to article 4(2) of directive (eu) 2016/680. participants in the sandbox should ensure appropriate safeguards and cooperate with the competent authorities , including by following their guidance and acting expeditiously and in good faith to mitigate any high-risks to safety and fundamental rights that may arise during the development and experimentation in the sandbox. the conduct of the participants in the sandbox should be taken into account when competent authorities decide whether to impose an administrative fine under article 83(2) of regulation 2016/679 and article 57 of directive 2016/680. ### (72) the objectives of the regulatory sandboxes should be to foster ai innovation by establishing a controlled experimentation and testing environment in the development and pre-marketing phase with a view to ensuring compliance of the innovative ai systems with this regulation and other relevant union and member states legislation; to enhance legal certainty for innovators and the competent authorities’ oversight and understanding of the opportunities , emerging risks and the impacts of ai use , and to accelerate access to markets , including by removing barriers for small and medium enterprises (smes) and start-ups as well as to contribute to achieving the targets on ai as set in the policy programme “path to the digital decade". to ensure uniform implementation across the union and economies of scale , it is appropriate to establish common rules for the regulatory sandboxes’ implementation and a framework for cooperation between the relevant authorities involved in the supervision of the sandboxes. this regulation should provide the legal basis for the use of personal data collected for other purposes for developing certain ai systems in the public interest within the ai regulatory sandbox , in line with article 6(4) of regulation (eu) 2016/679 , and article 6 of regulation (eu) 2018/1725 , and without prejudice to article 4(2) of directive (eu) 2016/680. participants in the sandbox should ensure appropriate safeguards and cooperate with the competent authorities , including by following their guidance and acting expeditiously and in good faith to mitigate any high-risks to safety and fundamental rights that may arise during the development and experimentation in the sandbox. the conduct of the participants in the sandbox should be taken into account when competent authorities decide whether to impose an administrative fine under article 83(2) of regulation 2016/679 and article 57 of directive 2016/680.


### (84) member states should take all necessary measures to ensure that the provisions of this regulation are implemented , including by laying down effective , proportionate and dissuasive penalties for their infringement. for certain specific infringements , member states should take into account the margins and criteria set out in this regulation. the european data protection supervisor should have the power to impose fines on union institutions , agencies and bodies falling within the scope of this regulation. ### (84) member states should take all necessary measures to ensure that the provisions of this regulation are implemented , including by laying down effective , proportionate and dissuasive penalties for their infringement. for certain specific infringements , member states should take into account the margins and criteria set out in this regulation. the european agency for data and artificial intelligence should have the power to impose fines on union institutions , agencies and bodies falling within the scope of this regulation.


### (42) ‘national supervisory authority’ means the authority to which a member state assigns the responsibility for the implementation and application of this regulation , for coordinating the activities entrusted to that member state , for acting as the single contact point for the commission , and for representing the member state at the european artificial intelligence board; ### (42) ‘national supervisory authority’ means the authority to which a member state assigns the responsibility for the implementation and application of this regulation , for coordinating the activities entrusted to that member state , for acting as the single contact point for the commission , and for representing the member state at the european agency for data and ai (eada);


### 3. in particular , logging capabilities shall enable the monitoring of the operation of the high-risk ai system with respect to the occurrence of situations that may result in the ai system presenting a risk within the meaning of article 65(1) or lead to a substantial modification , and facilitate the post-market monitoring referred to in article 61. ### 3. in particular , logging capabilities shall enable the monitoring of the operation of the high-risk ai system with respect to the occurrence of situations that may result in the ai system presenting a risk within the meaning of article 65(1) or lead to a substantial modification , and facilitate the post-market monitoring referred to in article 61 and the monitoring of the operation of high-risk ai systems referred to in article 29 (4).


### its intended purpose; ### any known or reasonably foreseeable use;


### its intended purpose; ### its purpose;


### (iv) its performance as regards the persons or groups of persons on which the system is intended to be used; ### (iv) its performance as regards the persons or groups of persons on which the system is intended or reasonably foreseeable to be used;


### (iv) its performance as regards the persons or groups of persons on which the system is intended to be used; ### (iv) its performance as regards the persons or groups of persons on which the system is to be used;


### when appropriate , specifications for the input data , or any other relevant information in terms of the training , validation and testing data sets used , taking into account the intended purpose of the ai system. ### when appropriate , specifications for the input data , or any other relevant information in terms of the training , validation and testing data sets used , taking into account the intended purpose or reasonably foreseeable use of the ai system.


### when appropriate , specifications for the input data , or any other relevant information in terms of the training , validation and testing data sets used , taking into account the intended purpose of the ai system. ### when appropriate , specifications for the input data , or any other relevant information in terms of the training , validation and testing data sets used , taking into account the purpose of the ai system.


### the changes to the high-risk ai system and its performance which have been pre-determined by the provider at the moment of the initial conformity assessment , if any; ### the changes to the high-risk ai system and its performance , including its algorithms , which have been pre-determined by the provider at the moment of the initial conformity assessment , if any;


### 14 human oversight ### 14 human agency and oversight


### 1. high-risk ai systems shall be designed and developed in such a way , including with appropriate human-machine interface tools , that they can be effectively overseen by natural persons during the period in which the ai system is in use. ### 1. high-risk ai systems shall be designed and developed in such a way , including with appropriate human-machine interface tools , that they can be effectively overseen by natural persons with the necessary competence , training and authority to exercise that function , during the period in which the ai system is in use.


### 1. high-risk ai systems shall be designed and developed in such a way , including with appropriate human-machine interface tools , that they can be effectively overseen by natural persons during the period in which the ai system is in use. ### 1. high-risk ai systems shall be designed and developed in such a way , including with appropriate human-machine interface tools , that they can at all times be effectively overseen with agency by natural persons during the period in which the ai system is in use and irrespectively of their specific characteristics.


### 1. high-risk ai systems shall be designed and developed in such a way , including with appropriate human-machine interface tools , that they can be effectively overseen by natural persons during the period in which the ai system is in use. ### 1. high-risk ai systems shall be designed and developed in such a way , including with appropriate human-machine interface tools , that they can be effectively overseen by natural persons during the whole lifecycle of the ai system. ai systems shall not be used to substitute , but rather to complement human decision-making. all ai systems shall be explainable by design.


### the technical solutions to address ai specific vulnerabilities shall include , where appropriate , measures to prevent and control for attacks trying to manipulate the training dataset (‘data poisoning’) , inputs designed to cause the model to make a mistake (‘adversarial examples’) , or model flaws. ### the technical solutions to address ai specific vulnerabilities shall include , where appropriate , measures to prevent , detect , respond to , resolve and control for attacks trying to manipulate the training dataset (‘data poisoning’) , or pretrained components used in training (‘model poisoning’) , inputs designed to cause the model to make a mistake(‘adversarial examples’ or ‘model evasion’) , confidentiality attacks or model flaws.


### the technical solutions to address ai specific vulnerabilities shall include , where appropriate , measures to prevent and control for attacks trying to manipulate the training dataset (‘data poisoning’) , inputs designed to cause the model to make a mistake (‘adversarial examples’) , or model flaws. ### the technical solutions to address ai specific vulnerabilities shall include , where appropriate , measures to prevent and control for attacks trying to manipulate the training dataset (‘data poisoning’) , inputs designed to cause the model to make a mistake (‘adversarial examples’) , or model flaws which could lead to harmful decision-making.


### transparency obligations for certain ai systems ### transparency obligations


### (60) in the light of the complexity of the artificial intelligence value chain , relevant third parties , notably the ones involved in the sale and the supply of software , software tools and components , pre-trained models and data , or providers of network services , should cooperate , as appropriate , with providers and users to enable their compliance with the obligations under this regulation and with competent authorities established under this regulation. ### (60) in the light of the complexity of the artificial intelligence value chain , relevant third parties , notably the ones involved in the sale and the supply of software , software tools and components , pre-trained models and data , or providers of network services , should ensure , through technical means , the transparency and auditability for providers and users to enable their compliance with the obligations under this regulation and cooperate and assist competent authorities established under this regulation in its enforcement.


### (61) standardisation should play a key role to provide technical solutions to providers to ensure compliance with this regulation. compliance with harmonised standards as defined in regulation (eu) no 1025/2012 of the european parliament and of the council54 should be a means for providers to demonstrate conformity with the requirements of this regulation. however , the commission could adopt common technical specifications in areas where no harmonised standards exist or where they are insufficient. ### (61) standardisation should play a key role to provide technical solutions to providers to ensure compliance with this regulation. compliance with harmonised standards as defined in regulation (eu) no 1025/2012 of the european parliament and of the council54 should be a means for providers to demonstrate conformity with the requirements of this regulation. in addition to technical details , the standardisation process should also include an assessment of risks to fundamental rights , the environment , societal risks and other sociotechnical considerations , such as how a given technology might interact with other technologies. the standardisation process should be transparent in terms of legal and natural persons participating the standardisation activities. however , the commission could adopt common technical specifications in areas where no harmonised standards exist or where they are insufficient. in developing these common specifications commission should involve views of relevant stakeholders , in particular when the common specifications address specific fundamental rights concerns. in particular , the commission should adopt common specifications setting out how risk management systems give specific consideration to impact on children.


### (66) in line with the commonly established notion of substantial modification for products regulated by union harmonisation legislation , it is appropriate that an ai system undergoes a new conformity assessment whenever a change occurs which may affect the compliance of the system with this regulation or when the intended purpose of the system changes. in addition , as regards ai systems which continue to ‘learn’ after being placed on the market or put into service (i.e. they automatically adapt how functions are carried out) , it is necessary to provide rules establishing that changes to the algorithm and its performance that have been pre-determined by the provider and assessed at the moment of the conformity assessment should not constitute a substantial modification. ### (66) in line with the commonly established notion of substantial modification for products regulated by union harmonisation legislation , it is appropriate that an ai system undergoes a new conformity assessment whenever a change occurs which may affect the compliance of the system with this regulation or when the intended purpose of the system changes. in addition , as regards ai systems which continue to ‘learn’ after being placed on the market or put into service (i.e. they automatically adapt how functions are carried out) , it is necessary to provide rules establishing that changes to the algorithm and its performance that have been pre-determined by the provider and assessed at the moment of the conformity assessment should not constitute a substantial modification. the conformity assessment requirements as defined by this regulation shall not apply for firmware and software updates developed by the product manufacturer.


### the nature of the situation giving rise to the possible use , in particular the seriousness , probability and scale of the harm caused in the absence of the use of the system; ### deleted


### the consequences of the use of the system for the rights and freedoms of all persons concerned , in particular the seriousness , probability and scale of those consequences. ### deleted


### the relevant design choices; ### the relevant design choices; all appliances should be designed with the option to forbid the constantly open microphone/camera of apps and offer consumers a clear option for all recording features to be shut down when the corresponding app is not in use;


### data collection; ### data collection processes;


### high-risk ai systems that continue to learn after being placed on the market or put into service shall be developed in such a way to ensure that possibly biased outputs due to outputs used as an input for future operations (‘feedback loops’) are duly addressed with appropriate mitigation measures. ### high-risk ai systems that continue to learn after being placed on the market or put into service shall be developed in such a way to ensure that possibly biased outputs due to outputs used as an input for future operations (‘feedback loops’) and malicious manipulation of inputs used in learning during operation are duly addressed with appropriate mitigation measures.


### 4. high-risk ai systems shall be resilient as regards attempts by unauthorised third parties to alter their use or performance by exploiting the system vulnerabilities. ### 4. high-risk ai systems shall be resilient as regards to attempts by unauthorised third parties to alter their use , behaviour , outputs or performance by exploiting the system vulnerabilities.


### 1. taking into account their intended purpose , high-risk ai systems that have been trained and tested on data concerning the specific geographical , behavioural and functional setting within which they are intended to be used shall be presumed to be in compliance with the requirement set out in article 10(4). ### 1. taking into account their intended purpose , high-risk ai systems that have been trained and tested on data concerning the specific geographical , behavioural , contextual and functional setting within which they are intended to be used shall be presumed to be in compliance with the requirement set out in article 10(4).


### 1. the provider shall draw up a written eu declaration of conformity for each ai system and keep it at the disposal of the national competent authorities for 10 years after the ai system has been placed on the market or put into service. the eu declaration of conformity shall identify the ai system for which it has been drawn up. a copy of the eu declaration of conformity shall be given to the relevant national competent authorities upon request. ### 1. the provider shall draw up a written eu declaration of conformity for each ai system and keep it at the disposal of the national competent authorities for 10 years after the ai system has been placed on the market or put into service. the eu declaration of conformity shall identify the ai system for which it has been drawn up. a copy of the eu declaration of conformity shall be given to the relevant national competent authority in the member state of main establishment of the provider , upon the competent authority’s request.


### 2. the eu declaration of conformity shall state that the high-risk ai system in question meets the requirements set out in chapter 2 of this title. the eu declaration of conformity shall contain the information set out in annex v and shall be translated into an official union language or languages required by the member state(s) in which the high-risk ai system is made available. ### 2. the eu declaration of conformity shall state that the high-risk ai system in question meets the requirements set out in chapter 2 of this title. the eu declaration of conformity shall contain the information set out in annex v and shall be presented into an official language of the member state in which the provider of the high-risk ai system has its main establishment.


### 2. member states shall ensure that to the extent the innovative ai systems involve the processing of personal data or otherwise fall under the supervisory remit of other national authorities or competent authorities providing or supporting access to data , the national data protection authorities and those other national authorities are associated to the operation of the ai regulatory sandbox. ### 2. member states shall ensure that to the extent the innovative ai systems involve the processing of personal data or otherwise fall under the supervisory remit of other national authorities or competent authorities providing or supporting access to data , the national data protection authorities and those other national authorities are associated to the operation of the ai regulatory sandbox established by one or more member states competent authorities or the european data protection supervisor. start-ups , smes , enterprises and other innovators may request access to personal data from relevant national authorities to be used in their ai sandbox while ensuring compliance with the requirements of this regulation and , where relevant , other union and member states legislation supervised within the sandbox


### 2. member states shall ensure that to the extent the innovative ai systems involve the processing of personal data or otherwise fall under the supervisory remit of other national authorities or competent authorities providing or supporting access to data , the national data protection authorities and those other national authorities are associated to the operation of the ai regulatory sandbox. ### 2. the commission in collaboration with member states shall ensure that to the extent the innovative ai systems involve the processing of personal data or otherwise fall under the supervisory remit of other national authorities or competent authorities providing or supporting access to data , the national data protection authorities and those other national authorities are associated to the operation of the ai regulatory sandbox.


### where relevant , the data requirements in terms of datasheets describing the training methodologies and techniques and the training data sets used , including information about the provenance of those data sets , their scope and main characteristics; how the data was obtained and selected; labelling procedures (e.g. for supervised learning) , data cleaning methodologies (e.g. outliers detection); ### the data requirements in terms of datasheets describing the training methodologies and techniques and the training data sets used , including information about the provenance of those data sets , their scope and main characteristics; how the data was obtained and selected; labelling procedures (e.g. for supervised learning) , data cleaning methodologies (e.g. outliers detection);


### (11) measures to improve further the energy performance of buildings should take into account climatic conditions , including adaptation to climate change , local conditions as well as indoor climate environment and cost-effectiveness. those measures should not affect other requirements concerning buildings such as accessibility , fire safety and seismic safety and the intended use of the building. ### (11) measures to improve further the energy performance of buildings should take into account climatic conditions , including adaptation to climate change , local conditions as well as indoor climate environment and cost-effectiveness. those measures should not affect other requirements concerning buildings such as accessibility , fire , heating and electrical installation safety and seismic safety and the intended use of the building.


### (11) measures to improve further the energy performance of buildings should take into account climatic conditions , including adaptation to climate change , local conditions as well as indoor climate environment and cost-effectiveness. those measures should not affect other requirements concerning buildings such as accessibility , fire safety and seismic safety and the intended use of the building. ### (11) measures to improve further the energy performance of buildings should take into account climatic conditions , including adaptation to climate change , local conditions as well as indoor climate environment and cost-effectiveness. those measures should not affect other requirements concerning buildings such as accessibility , fire , electrical and seismic safety and the intended use of the building.


### (12) the energy performance of buildings should be calculated on the basis of a methodology , which may be differentiated at national and regional level. that includes , in addition to thermal characteristics , other factors that play an increasingly important role such as heating and air-conditioning installations , application of energy from renewable sources , building automation and control systems , smart solutions , passive heating and cooling elements , shading , indoor air-quality , adequate natural light and design of the building. the methodology for calculating energy performance should be based not only on the season in which heating or air-conditioning is required , but should cover the annual energy performance of a building. that methodology should take into account existing european standards. the methodology should ensure the representation of actual operating conditions and enable the use of metered energy to verify correctness and for comparability , and the methodology should be based on hourly or sub-hourly time-steps. in order to encourage the use of renewable energy on-site , and in addition to the common general framework , member states should take the necessary measures so that the benefits of maximising the use of renewable energy on-site , including for other-uses (such as electric vehicle charging points) , are recognised and accounted for in the calculation methodology. ### (12) the energy performance of buildings should be calculated on the basis of a methodology , which may be differentiated at national and regional level. that includes , in addition to thermal characteristics , other factors that play an increasingly important role such as heating and air-conditioning installations , application of energy from renewable sources , building automation and control systems , smart solutions , passive heating and cooling elements , shading , indoor air-quality , adequate natural light and design of the building. the methodology for calculating energy performance should be based not only on the season in which heating or air-conditioning is required , but should cover the annual energy performance of a building. that methodology should take into account existing european standards. the methodology should ensure the representation of actual operating conditions and enable the use of metered energy to verify correctness and for comparability , and the methodology should be based on hourly or sub-hourly time-steps. in order to encourage the use of renewable energy on-site , and in addition to the common general framework , member states should take the necessary measures so that the benefits of maximising the use of renewable energy on-site , including for other-uses (such as electric vehicle charging points) , are recognised and accounted for in the calculation methodology. the energy efficiency of buildings should respect their architectural quality , including their contribution to people’s quality of life. for these reasons , european citizens should be able to access the solution or product compatible with the urban regulations applicable to the protection of the aesthetic of buildings or quality architecture , provided that they are included in the ecodesign schemes provided for in regulation (ec) no 206/2012 and directive 2009/125/ec , with the possibility of assessing the energy efficiency of the different solutions capable of meeting the requirements set out in those regulations.


### (12) the energy performance of buildings should be calculated on the basis of a methodology , which may be differentiated at national and regional level. that includes , in addition to thermal characteristics , other factors that play an increasingly important role such as heating and air-conditioning installations , application of energy from renewable sources , building automation and control systems , smart solutions , passive heating and cooling elements , shading , indoor air-quality , adequate natural light and design of the building. the methodology for calculating energy performance should be based not only on the season in which heating or air-conditioning is required , but should cover the annual energy performance of a building. that methodology should take into account existing european standards. the methodology should ensure the representation of actual operating conditions and enable the use of metered energy to verify correctness and for comparability , and the methodology should be based on hourly or sub-hourly time-steps. in order to encourage the use of renewable energy on-site , and in addition to the common general framework , member states should take the necessary measures so that the benefits of maximising the use of renewable energy on-site , including for other-uses (such as electric vehicle charging points) , are recognised and accounted for in the calculation methodology. ### (12) the energy performance of buildings should be calculated on the basis of a methodology , which may be differentiated at national and regional level. that includes , in addition to thermal characteristics as well as useful floor area , other factors that play an increasingly important role such as heating and air-conditioning installations , application of energy from renewable sources , building automation and control systems , smart solutions , passive heating and cooling elements , shading , indoor air-quality , adequate natural light and design of the building. the methodology for calculating energy performance should be based not only on the season in which heating or air-conditioning is required , but should cover the annual energy performance of a building. that methodology should take into account existing european standards and where applicable internationally recognised standards , such as the international property measurement standards (ipms). the methodology should ensure the representation of actual operating conditions and enable the use of metered energy to verify correctness and for comparability , and the methodology should be based on hourly or sub-hourly time-steps. in order to encourage the use of renewable energy on-site , and in addition to the common general framework , member states should take the necessary measures so that the benefits of maximising the use of renewable energy on-site , including for other-uses (such as electric vehicle charging points) , are recognised and accounted for in the calculation methodology.


### (12) the energy performance of buildings should be calculated on the basis of a methodology , which may be differentiated at national and regional level. that includes , in addition to thermal characteristics , other factors that play an increasingly important role such as heating and air-conditioning installations , application of energy from renewable sources , building automation and control systems , smart solutions , passive heating and cooling elements , shading , indoor air-quality , adequate natural light and design of the building. the methodology for calculating energy performance should be based not only on the season in which heating or air-conditioning is required , but should cover the annual energy performance of a building. that methodology should take into account existing european standards. the methodology should ensure the representation of actual operating conditions and enable the use of metered energy to verify correctness and for comparability , and the methodology should be based on hourly or sub-hourly time-steps. in order to encourage the use of renewable energy on-site , and in addition to the common general framework , member states should take the necessary measures so that the benefits of maximising the use of renewable energy on-site , including for other-uses (such as electric vehicle charging points) , are recognised and accounted for in the calculation methodology. ### (12) the energy performance of buildings should be calculated on the basis of a methodology , which may be differentiated at national and regional level. that includes , in addition to thermal characteristics , other factors that play an increasingly important role such as heating and air-conditioning installations , application of energy from renewable sources , building automation and control systems , heat recovery from wastewater , ventilation and cooling , smart solutions , passive heating and cooling elements , shading , indoor air-quality , adequate natural light and design of the building. the methodology for calculating energy performance should be based not only on the season in which heating or air-conditioning is required , but should cover the annual energy performance of a building. that methodology should take into account existing european standards. the methodology should ensure the representation of actual operating conditions and enable the use of metered energy to verify correctness and for comparability , and the methodology should be based on hourly or sub-hourly time-steps. in order to encourage the use of renewable energy on-site , including roof solar panels in line with the european solar rooftops initiative , and in addition to the common general framework , member states should take the necessary measures so that the benefits of maximising the use of renewable energy on-site , including for other-uses (such as electric vehicle charging points) , are recognised and accounted for in the calculation methodology.


### residential buildings and building units achieve at the latest ### worst performing residential buildings and building units achieve at the latest


### after 1 january 2030 , at least energy performance class f; and ### after 1 january 2030 , at least energy performance class e; and


### 1. with regard to new non-residential buildings and non-residential buildings undergoing major renovation , with more than five parking spaces , member states shall ensure: ### 1. with regard to new non-residential buildings and non-residential buildings undergoing renovation , with more than five parking spaces , member states shall ensure:


### the installation of at least one recharging point; ### the installation of at least one recharging point for every five parking spaces;


### where the car park is physically adjacent to the building , and , for major renovations , renovation measures include the car park or the electrical infrastructure of the car park. ### where the car park is physically adjacent to the building , and , for renovations , renovation measures include the car park or the electrical infrastructure of the car park.


### 2. with regard to all non-residential buildings with more than twenty parking spaces , member states shall ensure the installation of at least one recharging point for every ten parking spaces , and at least one bicycle parking space for every car parking space , by 1 january 2027. in case of buildings owned or occupied by public authorities , member states shall ensure pre-cabling for at least one in two parking spaces by 1 january 2033. ### 2. with regard to all non-residential buildings with more five parking spaces , member states shall ensure the installation of at least one recharging point for every five parking spaces , and at least one bicycle parking space for every car parking space , by 1 january 2027. in case of buildings owned or occupied by public authorities , member states shall ensure pre-cabling for at least one in two parking spaces by 1 january 2033.