Proposal for a

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

on ethical principles for the development, deployment and use of artificial intelligence, robotics and related technologies

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114 thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Having regard to the opinion of the European Economic and Social Committee,

Acting in accordance with the ordinary legislative procedure,

Whereas:

(1) The development, deployment and use of artificial intelligence, robotics and related technologies, including the software, algorithms and data used or produced by such technologies, should be based on a desire to serve society. Such technologies can entail opportunities and risks, which should be addressed and regulated by a comprehensive regulatory framework at Union level, reflecting ethical principles, to be complied with from the moment of the development and deployment of such technologies to their use.

(2) Compliance with such a regulatory framework regarding the development, deployment and use of artificial intelligence, robotics and related technologies, including the software, algorithms and data used or produced by such technologies, in the Union should of a level that is equivalent in all Member States, in order to efficiently seize the opportunities and consistently address the risks of such technologies, as well as avoid regulatory fragmentation. It should be ensured that the application of the rules set out in this Regulation throughout the Union is homogenous.

(3) In this context, the current diversity of the rules and practices to be followed across the Union poses a significant risk of fragmentation of the Single Market and to the protection of the well-being and prosperity of individuals and society alike, as well as to the coherent exploration of the full potential that artificial intelligence, robotics and related technologies have for promoting innovation and preserving that well-being and prosperity. Differences in the degree of consideration on the part of developers, deployers and users of the ethical dimension inherent to these technologies can prevent them from being freely developed, deployed or used within the Union and such differences can constitute an obstacle to a level playing field and to the pursuit of technological progress and economic activities at Union level, distort competition and impede authorities in the fulfilment of their obligations under Union law. In addition, the absence of a common regulatory framework, reflecting ethical principles, for the development, deployment and use of artificial intelligence, robotics and related technologies results in legal uncertainty for all those involved, namely developers, deployers and users.

(4) Nevertheless, while contributing to a coherent approach at Union level and within the limits set by it, this Regulation should provide a margin for implementation by Member States, including with regard to how the mandate of their respective national supervisory authority is to be carried out, in view of the objective it is to achieve as set out herein.

(5) This Regulation is without prejudice to existing or future sectorial legislation. It should be proportionate with regard to its objective so as not to unduly hamper innovation in the Union and be in accordance with a risk-based approach.

(6) The geographical scope of application of such a framework should cover all the components of artificial intelligence, robotics and related technologies throughout their development, deployment and use in the Union, including in cases where part of the technologies might be located outside the Union or not have a specific or single location, such as in the case of cloud computing services.

(7) A common understanding in the Union of notions such as artificial intelligence, robotics, related technologies and biometric recognition is required in order to allow for a unified regulatory approach and thus legal certainty for citizens and companies alike. They should be technologically neutral and subject to review whenever necessary.

(8) In addition, the fact that there are technologies related to artificial intelligence and robotics that enable software to control physical or virtual processes, at a varying degree of autonomy (1), needs to be considered. For example, for automated driving of vehicles, six levels of driving automation have been propose by SAE international standard J3016.

(9) The development, deployment and use of artificial intelligence, robotics and related technologies, including the software, algorithms and data used or produced by such technologies, should complement human capabilities, not substitute them and ensure that their execution does not run against the best interests of citizens and that it complies with Union law, fundamental rights as set out in the Charter of Fundamental Rights of the European Union (the ‘Charter’), settled case-law of the Court of Justice of the European Union, and other European and international instruments which apply in the Union.

(10) Decisions made or informed by artificial intelligence, robotics and related technologies should remain subject to meaningful human review, judgment, intervention and control. The technical and operational complexity of such technologies should never prevent their deployer or user from being able to, at the very least, trigger a fail-safe shutdown, alter or halt their operation, or revert to a previous state restoring safe functionalities in cases where the compliance with Union law and the ethical principles and legal obligations laid down in this Regulation is at risk.

(11) Artificial intelligence, robotics and related technologies whose development, deployment and use entail a significant risk of causing injury or harm to individuals or society in breach of fundamental rights and safety rules as laid down in Union law, should be considered as high-risk technologies. For the purposes of assessing them as such, the sector where they are developed, deployed or used, their specific use or purpose and the severity of the injury or harm that can be expected to occur should be considered. The degree of severity should be determined based on the extent of the potential injury or harm, the number of affected persons, the total value of damage caused and the harm to society as a whole. Severe types of injury and harm are, for instance, violations of children’s, consumers’ or workers’ rights that, due to their extent, the number of children, consumers or workers affected or their impact on society as a whole entail a significant risk to breach fundamental rights and safety rules as laid down in Union law. This Regulation should provide an exhaustive and cumulative list of high-risk sectors, and high-risk uses and purposes.

(12) The obligations laid down in this Regulation, specifically those regarding high-risk technologies, should only apply to artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, developed, deployed or used in the Union, which, following the risk assessment provided for in this Regulation, are considered as high-risk. Such obligations are to be complied with without prejudice to the general obligation that any artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, should be developed, deployed and used in the Union in a human-centric manner and based on the principles of human autonomy and human safety in accordance with Union law and in full respect of fundamental rights such as human dignity, right to liberty and security and right to the integrity of the person.

(13) High-risk technologies should respect the principles of safety, transparency, accountability, non-bias or non-discrimination, social responsibility and gender equality, right to redress, environmental sustainability, privacy and good governance, following an impartial, objective and external risk assessment by the national supervisory authority in accordance with the criteria provided for in this Regulation and in the list set out in its annex. This assessment should take into account the views and any self-assessment made by the developer or deployer.

(14) The Commission and/or any relevant institutions, bodies, offices and agencies of the Union that may be designated for this purpose should prepare non-binding implementation guidelines for developers, deployers and users on the methodology for compliance with this Regulation. In doing so, they should consult relevant stakeholders.

(15) There should be coherence within the Union when it comes to the risk assessment of these technologies, especially in the event they are assessed both in light of this Regulation and in accordance with any applicable sector-specific legislation. Accordingly, national supervisory authorities should inform other authorities carrying out risk assessments in accordance with any sector-specific legislation when these technologies are assessed as high-risk following the risk assessment provided for in this Regulation.

(16) To be trustworthy high-risk artificial intelligence, robotics and related technologies, including the software, algorithms and data used or produced by such technologies should be developed, deployed and used in a safe, transparent and accountable manner in accordance with the safety features of robustness, resilience, security, accuracy and error identification, explainability, interpretability, auditability, transparency and identifiability, and in a manner that makes it possible to disable the functionalities concerned or to revert to a previous state restoring safe functionalities, in cases of non-compliance with those features. Transparency should be ensured by allowing access to public authorities, when strictly necessary, to technology, data and computing systems underlying such technologies.

(17) Developers, deployers and users of artificial intelligence, robotics and related technologies, especially high-risk technologies, are responsible to varying degrees for the compliance with safety, transparency and accountability principles to the extent of their involvement with the technologies concerned, including the software, algorithms and data used or produced by such technologies. Developers should ensure that the technologies concerned are designed and built in line with the safety features set out in this Regulation, whereas deployers and users should deploy and use the concerned technologies in full observance of those features. To this end, developers of high-risk technologies should evaluate and anticipate the risks of misuse that can reasonably be expected regarding of the technologies they develop. They must also ensure that the systems they develop indicate to the extent possible and through appropriate means, such as disclaimer messages, the likelihood of errors or inaccuracies.

(18) Developers and deployers should make available to users any subsequent updates of the technologies concerned, namely in terms of software as stipulated by contract or laid down in Union or national law. In addition where a risk assessment so indicates, developers and deployers should provide public authorities with the relevant documentation on the use of the technologies concerned and safety instructions in that regard, including, when strictly necessary and in full respect of Union law on data protection, privacy and intellectual property rights and trade secrets, the source code, development tools and data used by the system.

(19) Individuals have a right to expect the technology they use to perform in a reasonable manner and to respect their trust. The trust placed by citizens in artificial intelligence, robotics and related technologies, including the software, algorithms and data used or produced by such technologies, depends on the understanding and comprehension of the technical processes. The degree of explainability of such processes should depend on the context of those technical processes, and on the severity of the consequences of an erroneous or inaccurate output, and needs to be sufficient for challenging them and for seeking redress. Auditability, traceability, and transparency should address any possible unintelligibility of such technologies.

(20) Society’s trust in artificial intelligence, robotics and related technologies, including the software, algorithms and data used or produced by such technologies, depends on the degree to which their assessment, auditability and traceability are enabled in the technologies concerned. Where the extent of their involvement so requires, developers should ensure that such technologies are designed and built in a manner that enables such an assessment, auditing and traceability. Within the limits of what is technically possible, developers, deployers and users should ensure that artificial intelligence, robotics and related technologies are deployed and used in full respect of transparency requirements, and allowing auditing and traceability.

(21) In order to ensure transparency and accountability, citizens should be informed when a system uses artificial intelligence, when artificial intelligence systems personalise a product or service for its users, whether they can switch off or limit the personalisation and when they are faced with an automated decision making technology. Furthermore, transparency measures should be accompanied, as far as this is technically possible, by clear and understandable explanations of the data used and of the algorithm, its purpose, its outcomes and its potential dangers.

(22) Bias in and discrimination by software, algorithms and data is unlawful and should be addressed by regulating the processes through which they are designed and deployed. Bias can originate both from decisions informed or made by an automated system as well as from data sets on which such decision making is based or with which the system is trained.

(23) Software, algorithms and data used or produced by artificial intelligence, robotics and related technologies should be considered biased where, for example, they display suboptimal results in relation to any person or group of persons, on the basis of a prejudiced personal or social perception and subsequent processing of data relating to their traits.

(24) In line with Union law, software, algorithms and data used or produced by artificial intelligence, robotics and related technologies should be considered discriminatory where they produce outcomes that have disproportionate negative effects and result in different treatment of a person or group of persons, including by putting them at a disadvantage when compared to others, based on grounds such as their personal traits, without objective or reasonable justification and regardless of any claims of neutrality of the technologies.

(25) In line with Union law, legitimate aims that could under this Regulation be considered to objectively justify any differential treatment between persons or group of persons are the protection of public safety, security and health, the prevention of criminal offences, the protection of fundamental rights and freedoms, fair representation and objective requirements for holding a professional occupation.

(26) Artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, should contribute to sustainable progress. Such technologies should not run counter to the cause of preservation of the environment or the green transition. They could play an important role in achieving the Sustainable Development Goals outlined by the United Nations with a view to enabling future generations to flourish. Such technologies can support the monitoring of adequate progress on the basis of sustainability and social cohesion indicators, and by using responsible research and innovation tools requiring the mobilisation of resources by the Union and its Member States to support and invest in projects addressing those goals.

(27) The development, deployment and use of artificial intelligence, robotics and related technologies, including the software, algorithms and data used or produced by such technologies, should in no way purposefully cause or accept by design injury or harm of any kind to individuals or society. Accordingly, high-risk technologies in particular should be developed, deployed and used in a socially responsible manner.

(28) Therefore, developers, deployers and users should be held responsible, to the extent of their involvement in the artificial intelligence, robotics and related technologies concerned, and in accordance with Union and national liability rules, for any injury or harm inflicted upon individuals and society.

(29) In particular, the developers who take decisions that determine and control the course or manner of the development of artificial intelligence, robotics and related technologies, as well as the deployers who are involved in their deployment by taking decisions regarding such deployment and by exercising control over the associated risks or benefiting from such deployment, with a controlling or managing function, should be generally considered responsible for avoiding the occurrence of any such injury or harm, by putting adequate measures in place during the development process and thoroughly respecting such measures during the deployment phase, respectively.

(30) Socially responsible artificial intelligence, robotics and related technologies, including the software, algorithms and data used or produced by such technologies, can be defined as technologies which contribute to find solutions that safeguard and promote different aims regarding society, most notably democracy, health and economic prosperity, equality of opportunity, workers’ and social rights, diverse and independent media and objective and freely available information, allowing for public debate, quality education, cultural and linguistic diversity, gender balance, digital literacy, innovation and creativity. They are also those that are developed, deployed and used having due regard for their ultimate impact on the physical and mental well-being of citizens and that do not promote hate speech or violence. Such aims should be achieved in particular by means of high-risk technologies.

(31) Artificial intelligence, robotics and related technologies should also be developed, deployed and used with a view to supporting social inclusion, democracy, plurality, solidarity, fairness, equality and cooperation and their potential in that context should be maximised and explored through research and innovation projects. The Union and its Member States should therefore mobilise their communication, administrative and financial resources for the purpose of supporting and investing in such projects.

(32) Projects relating to the potential of artificial intelligence, robotics and related technologies to deal with the question of social well-being should be carried out on the basis of responsible research and innovation tools so as to guarantee the compliance with ethical principles of those projects from the outset.

(33) The development, deployment and use of artificial intelligence, robotics and related technologies, including the software, algorithms and data used or produced by such technologies, should take into consideration their environmental footprint. In line with obligations laid down in applicable Union law, such technologies should not cause harm to the environment during their lifecycle and across their entire supply chain and should be developed, deployed and used in a manner that preserves the environment, mitigates and remedies their environmental footprint, contributes to the green transition and supports the achievement of climate neutrality and circular economy goals.

(34) For the purposes of this Regulation, developers, deployers and users should be held responsible, to the extent of their respective involvement in the development, deployment or use of any artificial intelligence, robotics and related technologies considered as high-risk, for any harm caused to the environment in accordance with the applicable environmental liability rules.

(35) These technologies should also be developed, deployed and used with a view to supporting the achievement of environmental goals in line with the obligations laid down in applicable Union law, such as reducing waste production, diminishing the carbon footprint, combating climate change and preserving the environment, and their potential in that context should be maximised and explored through research and innovation projects. The Union and the Member States should therefore mobilise their communication, administrative and financial resources for the purpose of supporting and investing in such projects.

(36) Projects relating to the potential of artificial intelligence, robotics and related technologies in addressing environmental concerns should be carried out on the basis of responsible research and innovation tools so as to guarantee from the outset the compliance of those projects with ethical principles.

(37) Any artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, developed, deployed and used in the Union should fully respect Union citizens’ rights to privacy and protection of personal data. In particular, their development, deployment and use should be in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (2) and Directive 2002/58/EC of the European Parliament and of the Council (3).

(38) In particular, the ethical boundaries of the use of artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, should be duly considered when using remote recognition technologies, such as recognition of biometric features, notably facial recognition, to automatically identify individuals. When these technologies are used by public authorities for reasons of substantial public interest, namely to guarantee the security of individuals and to address national emergencies, and not to guarantee the security of properties, the use should always be disclosed, proportionate, targeted and limited to specific objectives and restricted in time in accordance with Union law and having due regard to human dignity and autonomy and the fundamental rights set out in the Charter. Criteria for and limits to that use should be subject to judicial review and submitted to democratic scrutiny and debate involving civil society.

(39) Governance that is based on relevant standards enhances safety and promotes the increase of citizens’ trust in the development, deployment and use of artificial intelligence, robotics and related technologies including software, algorithms and data used or produced by such technologies.

(40) Public authorities should conduct impact assessments regarding fundamental rights before deploying high-risk technologies which provide support for decisions that are taken in the public sector and that have a direct and significant impact on citizens’ rights and obligations.

(41) Among the existing relevant governance standards are, for example, the ‘Ethics Guidelines for Trustworthy AI’ drafted by the High-Level Expert Group on Artificial Intelligence set up by the European Commission, and any other technical standards such as those adopted by the European Committee for Standardization (CEN), the European Committee for Electrotechnical Standardization (CENELEC), and the European Telecommunications Standards Institute (ETSI), at European level, the International Organization for Standardization (ISO) and the Institute of Electrical and Electronics Engineers (IEEE), at international level.

(42) Sharing and use of data by multiple participants is sensitive and therefore the development, deployment and use of artificial intelligence, robotics and related technologies should be governed by relevant rules, standards and protocols reflecting the requirements of quality, integrity, security, reliability, privacy and control. The data governance strategy should focus on the processing, sharing of and access to such data, including its proper management, auditability and traceability, and guarantee the adequate protection of data belonging to vulnerable groups, including people with disabilities, patients, children, minorities and migrants or other groups at risk of exclusion. In addition, developers, deployers and users should be able, where relevant, to rely on key performance indicators in the assessment of the datasets they use for the purposes of enhancing the trustworthiness of the technologies they develop, deploy and use.

(43) Member States should appoint an independent administrative authority to act as a supervisory authority. In particular, each national supervisory authority should be responsible for identifying artificial intelligence, robotics and related technologies considered as high-risk in the light of the risk assessment criteria provided for in this Regulation and for assessing and monitoring the compliance of these technologies with the obligations laid down in this Regulation.

(44) Each national supervisory authority should also carry the responsibility of the good governance of these technologies under the coordination of the Commission and/or any relevant institutions, bodies, offices or agencies of the Union that may be designated for this purpose. They therefore have an important role to play in promoting the trust and safety of Union citizens, as well as in enabling a democratic, pluralistic and equitable society.

(45) For the purposes of assessing technologies which are high-risk in accordance with this Regulation and monitoring their compliance with it, national supervisory authorities should, where applicable, cooperate with the authorities responsible for assessing and monitoring these technologies and enforcing their compliance with sectorial legislation.

(46) National supervisory authorities should engage in substantial and regular cooperation with each other, as well as with the European Commission and other relevant institutions, bodies, offices and agencies of the Union, in order to guarantee a coherent cross-border action, and allow for consistent development, deployment and use of these technologies within the Union in compliance with the ethical principles and legal obligations laid down in this Regulation.

(47) In the context of such cooperation and in view of achieving full harmonisation at Union level, national supervisory authorities should assist the Commission regarding drawing up a common and exhaustive list of high-risk artificial intelligence, robotics and related technologies in line with the criteria provided for in this Regulation and its Annex. Furthermore a granting process should be developed for the issuing of a European certificate of ethical compliance, including a voluntary application process for any developer, deployer or user of technologies not considered as high-risk seeking to certify their compliance with this Regulation.

(48) National supervisory authorities should ensure the gathering of a maximum number of stakeholders such as industry, businesses, social partners, researchers, consumers and civil society organisations, and provide a pluralistic forum for reflection and exchange of views so as to achieve comprehensible and accurate conclusions for the purpose of guiding how governance is regulated.

(49) National supervisory authorities should ensure the gathering of a maximum number of stakeholders such as industry, businesses, social partners, researchers, consumers and civil society organisations, and provide a pluralistic forum for reflection and exchange of views, to facilitate cooperation with and collaboration between stakeholders, in particular from academia, research, industry, civil society and individual experts, so as to achieve comprehensible and accurate conclusions for the purpose of guiding how governance is regulated.

(50) Additionally, these national supervisory authorities should provide professional administrative guidance and support to developers, deployers and users, particularly small and medium-sized enterprises or start-ups, encountering challenges as regards complying with the ethical principles and legal obligations laid down in this Regulation.

(51) The Commission and/or any relevant institutions, bodies, offices and agencies of the Union that may be designated for this purpose should establish binding guidelines on the methodology to be used by the national supervisory authorities when conducting their compliance assessment.

(52) Whistle-blowing brings potential and actual breaches of Union law to the attention of authorities with a view to preventing injury, harm or damage that would otherwise occur. In addition, reporting procedures ameliorate the information flow within companies and organisations, thus mitigating the risk of flawed or erroneous products or services being developed. Companies and organisations developing, deploying or using artificial intelligence, robotics and related technologies, including data used or produced by those technologies, should set up reporting channels and persons reporting breaches should be protected from retaliation.

(53) The rapid development of artificial intelligence, robotics and related technologies, including the software, algorithms and data used or produced by such technologies, as well as of the technical machine learning, reasoning processes and other technologies underlying that development are unpredictable. As such, it is both appropriate and necessary to establish a review mechanism in accordance with which, in addition to its reporting on the application of the Regulation, the Commission is to regularly submit a report concerning the possible modification of the scope of application of this Regulation.

(54) Since the objective of this Regulation, namely to establish a common regulatory framework of ethical principles and legal obligations for the development, deployment and use of artificial intelligence, robotics and related technologies in the Union, cannot be sufficiently achieved by the Member States, but can rather, by reason of its scale and effects, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve that objective.

(55) Coordination at Union level as set out in this Regulation would be best achieved by the Commission and/or any relevant institutions, bodies, offices and agencies of the Union that may be designated in this context in order to avoid fragmentation and ensure the consistent application of this Regulation. The Commission should therefore be tasked with finding an appropriate solution to structure such coordination at Union level in view of coordinating the mandates and actions of the national supervisory authorities in each Member State, namely regarding the risk assessment of artificial intelligence, robotics and related technologies, the establishment of a common framework for the governance of the development, deployment and use of these technologies, the developing and issuing of a certification of compliance with the ethical principles and legal obligations laid down in this Regulation, supporting regular exchanges with concerned stakeholders and civil society and creating a centre of expertise, bringing together academia, research, industry, and individual experts at Union level to foster exchange of knowledge and technical expertise, and promoting the Union’s approach through international cooperation and ensuring a consistent reply worldwide to the opportunities and risks inherent in these technologies.

HAVE ADOPTED THIS REGULATION:

Chapter I

General provisions

Article 1 Purpose The purpose of this Regulation is to establish a comprehensive and future-proof Union regulatory framework of ethical principles and legal obligations for the development, deployment and use of artificial intelligence, robotics and related technologies in the Union.

Article 2 Scope This Regulation applies to artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, developed, deployed or used in the Union.

Article 3 Geographical scope This Regulation applies to artificial intelligence, robotics and related technologies where any part thereof is developed, deployed or used in the Union, regardless of whether the software, algorithms or data used or produced by such technologies are located outside of the Union or do not have a specific geographical location.

Article 4 Definitions For the purposes of this Regulation, the following definitions apply: (a) ‘artificial intelligence’ means a system that is either software-based or embedded in hardware devices, and that displays intelligent behaviour by, inter alia, collecting, processing, analysing, and interpreting its environment, and by taking action, with some degree of autonomy, to achieve specific goals (4); (b) ‘autonomy’ means an AI-system that operates by interpreting certain input and using a set of pre-determined instructions, without being limited to such instructions, despite the system’s behaviour being constrained by and targeted at fulfilling the goal it was given and other relevant design choices made by its developer; (c) ‘robotics’ means technologies that enable automatically controlled, reprogrammable, multi-purpose machines (5) to perform actions in the physical world traditionally performed or initiated by human beings, including by way of artificial intelligence or related technologies; (d) ‘related technologies’ means technologies that enable software to control with a partial or full degree of autonomy a physical or virtual process, technologies capable of detecting biometric, genetic or other data, and technologies that copy or otherwise make use of human traits; (e) ‘high risk’ means a significant risk entailed by the development, deployment and use of artificial intelligence, robotics and related technologies to cause injury or harm to individuals or society in breach of fundamental rights and safety rules as laid down in Union law, considering their specific use or purpose, the sector where they are developed, deployed or used and the severity of injury or harm that can be expected to occur; (f) ‘development’ means the construction and design of algorithms, the writing and design of software or the collection, storing and management of data for the purpose of creating or training artificial intelligence, robotics and related technologies or for the purpose of creating a new application for existing artificial intelligence, robotics and related technologies; (g) ‘developer’ means any natural or legal person who takes decisions that determine and control the course or manner of the development of artificial intelligence, robotics and related technologies; (h) ‘deployment’ means the operation and management of artificial intelligence, robotics and related technologies, as well as their placement on the market or otherwise making them available to users; (i) ‘deployer’ means any natural or legal person who is involved in the specific deployment of artificial intelligence, robotics and related technologies with a controlling or managing function by taking decisions, exercising control over the risk and benefiting from such deployment; (j) ‘use’ means any action relating to artificial intelligence, robotics and related technologies other than development or deployment; (k) ‘user’ means any natural or legal person who uses artificial intelligence, robotics and related technologies other than for the purposes of development or deployment; (l) ‘bias’ means any prejudiced personal or social perception of a person or group of persons on the basis of their personal traits; (m) ‘discrimination’ means any differential treatment of a person or group of persons based on a ground which has no objective or reasonable justification and is therefore prohibited by Union law; (n) ‘injury or harm’ means, including where caused by hate speech, bias, discrimination or stigmatisation, physical or mental injury, material or immaterial harm such as financial or economic loss, loss of employment or educational opportunity, undue restriction of freedom of choice or expression or loss of privacy, and any infringement of Union law that is detrimental to a person; (o) ‘good governance’ means the manner of ensuring that the appropriate and reasonable standards and protocols of behaviour are adopted and observed by developers, deployers and users, based on a formal set of rules, procedures and values, and which allows them to deal appropriately with ethical matters as or before they arise.

Article 5 Ethical principles of artificial intelligence, robotics and related technologies 1. Any artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, shall be developed, deployed and used in the Union in accordance with Union law and in full respect of human dignity, autonomy and safety and other fundamental rights set out in the Charter. 2. Any processing of personal data carried out in the development, deployment and use of artificial intelligence, robotics and related technologies, including personal data derived from non-personal data and biometric data, shall be carried out in accordance with Regulation (EU) 2016/679 and Directive 2002/58/EC. 3. The Union and its Member States shall encourage research projects intended to provide solutions, based on artificial intelligence, robotics and related technologies, that seek to promote social inclusion, democracy, plurality, solidarity, fairness, equality and cooperation.

Chapter II

Obligations for high-risk technologies

Article 6 Obligations for high-risk technologies 1. The provisions in this Chapter shall only apply to artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, developed, deployed or used in the Union which are considered high-risk. 2. Any high-risk artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, shall be developed, deployed and used in a manner that ensures that they do not breach the ethical principles set out in this Regulation.

Article 7 Human-centric and human-mad e artificial intelligence 1. Any artificial high-risk technologies, including software, algorithms and data used or produced by such technologies, shall be developed, deployed and used in a manner that guarantees full human oversight at any time. 2. The technologies referred to paragraph 1 shall be developed, deployed and used in a manner that allows full human control to be regained when needed, including through the altering or halting of those technologies.

Article 8 Safety, transparency and accountability 1. Any high-risk artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, shall be developed, deployed and used in a manner that ensures that they are: (a) developed, deployed and used in a resilient manner so that they ensure an adequate level of security by adhering to minimum cybersecurity baselines proportionate to identified risk, and one that prevents any technical vulnerabilities from being exploited for malicious or unlawful purposes; (b) developed, deployed and used in a secure manner that ensures there are safeguards that include a fall-back plan and action in case of a safety or security risk; (c) developed, deployed and used in a manner that ensures a reliable performance as reasonably expected by the user regarding reaching the aims and carrying out the activities they have been conceived for, including by ensuring that all operations are reproducible; (d) developed, deployed and used in a manner that ensures that the performance of the aims and activities of the particular technologies is accurate; if occasional inaccuracies cannot be avoided, the system shall indicate, to the extent possible, the likeliness of errors and inaccuracies to deployers and users through appropriate means; (e) developed, deployed and used in an easily explainable manner so as to ensure that there can be a review of the technical processes of the technologies; (f) developed, deployed and used in a manner such that they inform users that they are interacting with artificial intelligence systems, duly and comprehensively disclosing their capabilities, accuracy and limitations to artificial intelligence developers, deployers and users; (g) in accordance with Article 6, developed, deployed and used in a manner that makes it possible, in the event of non-compliance with the safety features set out in subparagraphs (a) to (g), for the functionalities concerned to be temporarily disabled and to revert to a previous state restoring safe functionalities. 2. In accordance with Article 6(1), the technologies mentioned in paragraph 1 of this Article, including software, algorithms and data used or produced by such technologies, shall be developed, deployed and used in transparent and traceable manner so that their elements, processes and phases are documented to the highest possible and applicable standards, and that it is possible for the national supervisory authorities referred to in Article 18 to assess the compliance of such technologies with the obligations laid down in this Regulation. In particular, the developer, deployer or user of those technologies shall be responsible for, and be able to demonstrate, compliance with the safety features set out in paragraph 1. 3. The developer, deployer or user of the technologies mentioned in paragraph 1 shall ensure that the measures taken to ensure compliance with the safety features set out in paragraph 1 can be audited by the national supervisory authorities referred to in Article 18 or, where applicable, other national or European sectorial supervisory bodies.

Article 9 Non-bias and non-discrimination 1. Any software, algorithm or data used or produced by high-risk artificial intelligence, robotics and related technologies developed, deployed or used in the Union shall be unbiased and, without prejudice to paragraph 2, shall not discriminate on grounds such as race, gender, sexual orientation, pregnancy, disability, physical or genetic features, age, national minority, ethnicity or social origin, language, religion or belief, political views or civic participation, citizenship, civil or economic status, education, or criminal record. 2. By way of derogation from paragraph 1, and without prejudice to Union law governing unlawful discrimination, any differential treatment between persons or groups of persons may be justified only where there is an objective, reasonable and legitimate aim that is both proportionate and necessary insofar as no alternative exists which would cause less interference with the principle of equal treatment.

Article 10 Social responsibility and gender equality Any high-risk artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, developed, deployed and used in the Union shall be developed, deployed and used in compliance with relevant Union law, principles and values, in a manner that does not interfere in elections or contribute to the dissemination of disinformation, respects worker’s rights, promotes quality education and digital literacy, does not increase the gender gap by preventing equal opportunities for all and does not disrespect intellectual property rights and any limitations or exceptions thereto.

Article 11 Environmental sustainability Any high-risk artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, shall be assessed as to their environmental sustainability by the national supervisory authorities referred to in Article 18 or, where applicable, other national or European sectorial supervisory bodies, ensuring that measures are put in place to mitigate and remedy their general impact as regards natural resources, energy consumption, waste production, the carbon footprint, climate change emergency and environmental degradation in order to ensure compliance with the applicable Union or national law, as well as any other international environmental commitments the Union has undertaken.

Article 12 Respect for privacy and protection of personal data The use and gathering of biometric data for remote identification purposes in public areas, as biometric or facial recognition, carries specific risks for fundamental rights and shall be deployed or used only by Member States’ public authorities for substantial public interest purposes. Those authorities shall ensure that such deployment or use is disclosed to the public, proportionate, targeted and limited to specific objectives and location and restricted in time, in accordance with Union and national law, in particular Regulation (EU) 2016/679 and Directive 2002/58/EC, and with due regard for human dignity and autonomy and the fundamental rights set out in the Charter, namely the rights to respect for privacy and protection of personal data.

Article 13 Right to redress Any natural or legal person shall have the right to seek redress for injury or harm caused by the development, deployment and use of high-risk artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, in breach of Union law and the obligations set out in this Regulation

Article 14 Risk assessment 1. For the purposes of this Regulation, artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, shall be considered high-risk technologies when, following a risk assessment based on objective criteria such as their specific use or purpose, the sector where they are developed, deployed or used and the severity of the possible injury or harm caused, their development, deployment or use entail a significant risk to cause injury or harm that can be expected to occur to individuals or society in breach of fundamental rights and safety rules as laid down in Union law. 2. Without prejudice to applicable sectorial legislation, the risk assessment of artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, shall be carried out, in accordance with the objective criteria provided for in paragraph 1 of this Article and in the exhaustive and cumulative list set out in the Annex to this Regulation, by the national supervisory authorities referred to in Article 18 under the coordination of the Commission and/or any other relevant institutions, bodies, offices and agencies of the Union that may be designated for this purpose in the context of their cooperation. 3. In cooperation with the national supervisory authorities referred to in paragraph 2, the Commission shall, by means of delegated acts in accordance with Article 20, draw up and subsequently update a common list of high-risk technologies identified within the Union. 4. The Commission shall also, by means of delegated acts in accordance with Article 20, regularly update the list provided for in the Annex to this Regulation.

Article 15 Compliance assessment 1. High-risk artificial intelligence, robotics and related technologies shall be subject to an assessment of compliance with the obligations set out in Articles 6 to 12 of this Regulation, as well as to subsequent monitoring, both of which shall be carried out by the national supervisory authorities referred to in Article 18 under the coordination of the Commission and/or any other relevant institutions, bodies, offices and agencies of the Union that may be designated for this purpose. 2. The software, algorithms and data used or produced by high-risk technologies which have been assessed as compliant with the obligations set out in this Regulation pursuant to paragraph 1 shall also be considered to comply with those obligations, unless the relevant national supervisory authority decides to conduct an assessment on its own initiative or at the request of the developer, the deployer or the user. 3. Without prejudice to sectorial legislation, the Commission and/or any relevant institutions, bodies, offices and agencies of the Union that may be specifically designated for this purpose shall prepare binding guidelines on the methodology to be used by the national supervisory authorities for the compliance assessment referred to in paragraph 1 by the date of the entry into force of this Regulation.

Article 16 European certificate of ethical compliance 1. Where there has been a positive assessment of compliance of high-risk artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, carried out in line with Article 15, the respective national supervisory authority shall issue a European certificate of ethical compliance. 2. Any developer, deployer or user of artificial intelligence, robotics and related technologies, including software, algorithms and data used or produced by such technologies, that are not considered as high-risk and that are therefore not subject to the obligations laid down in Articles 6 to 12 and to the risk assessment and compliance assessment provided for in Articles 14 and 15, may also seek to certify the compliance with the obligations laid down in this Regulation, or part of them where so justified by the nature of the technology in question as decided by the national supervisory authorities. A certificate shall only be issued if an assessment of compliance has been carried out by the relevant national supervisory authority and that assessment is positive. 3. For the purposes of issuing the certificate referred to in paragraph 2, an application process shall be developed by the Commission and/or any other relevant institutions, bodies, offices and agencies of the Union that may be designated for this purpose.

Chapter III

Institutional oversight

Article 17 Governance standards and implementation guidance 1. Artificial intelligence, robotics and related technologies developed, deployed or used in the Union shall comply with relevant governance standards established in accordance with Union law, principles and values by the national supervisory authorities referred to in Article 18 in accordance with Union law, principles and values, under the coordination of the Commission and/or any relevant institutions, bodies, offices and agencies of the Union that may be designated for this purpose and in consultation with relevant stakeholders. 2. The standards referred to in paragraph 1 shall include non-binding implementation guidelines on the methodology for compliance with this Regulation by developers, deployers and users and shall be published by the date of entry into force of this Regulation. 3. Data used or produced by artificial intelligence, robotics and related technologies developed, deployed or used in the Union shall be managed by developers, deployers and users in accordance with relevant national, Union, other European organisations’ and international rules and standards, as well as with relevant industry and business protocols. In particular, developers and deployers shall carry out, where feasible, quality checks of the external sources of data used by artificial intelligence, robotics and related technologies, and shall put oversight mechanisms in place regarding their collection, storage, processing and use. 4. Without prejudice to portability rights and rights of persons whose usage of artificial intelligence, robotics and related technologies has generated data, the collection, storage, processing, sharing of and access to data used or produced by artificial intelligence, robotics and related technologies developed, deployed or used in the Union shall comply with the relevant national, Union, other European organisations’ and international rules and standards, as well as with relevant industry and business protocols. In particular, developers and deployers shall ensure those protocols are applied during the development and deployment of artificial intelligence, robotics and related technologies, by clearly defining the requirements for processing and granting access to data used or produced by these technologies, as well as the purpose, scope and addressees of the processing and the granting of access to such data, all of which shall at all times be auditable and traceable.

Article 18 Supervisory authorities 1. Each Member State shall designate an independent public authority to be responsible for monitoring the application of this Regulation (‘supervisory authority’), and for carrying out the risk and compliance assessments and the certification provided for in Articles 14, 15 and 16, without prejudice to sectorial legislation. 2. Each national supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities in each Member State shall cooperate with each other, the Commission and/or other relevant institutions, bodies, offices and agencies of the Union that may be designated for this purpose. 3. Each national supervisory authority shall serve as a first point of contact in cases of suspected breach of the ethical principles and legal obligations laid down in this Regulation, including discriminatory treatment or violation of other rights, as a result of the development, deployment or use of artificial intelligence, robotics and related technologies. In such cases, the respective national supervisory authority shall carry out a compliance assessment in view of supporting the right of citizens to contest and redress. 4. Each national supervisory authority shall be responsible for supervising the application of the relevant national, European and international governance rules and standards referred to in Article 17 to artificial intelligence, robotics and related technologies, including by liaising with the maximum possible number of relevant stakeholders. For that purpose, the supervisory authorities in each Member State shall provide a forum for regular exchange with and among stakeholders from academia, research, industry and civil society. 5. Each national supervisory authority shall provide professional and administrative guidance and support concerning the general implementation of Union law applicable to artificial intelligence, robotics and related technologies and the ethical principles set out in this Regulation, especially to relevant research and development organisations and small and medium-sized enterprises or start-ups. 6. Each Member State shall notify to the European Commission the legal provisions which it adopts pursuant to this Article by … [OJ: please enter the date one year after entry into force] and, without delay, any subsequent amendment affecting them. 7. Member States shall take all measures necessary to ensure the implementation of the ethical principles and legal obligations laid down in this Regulation. Member States shall support relevant stakeholders and civil society, at both Union and national level, in their efforts to ensure a timely, ethical and well-informed response to the new opportunities and challenges, in particular those of a cross-border nature, arising from technological developments relating to artificial intelligence, robotics and related technologies.

Article 19 Reporting of breaches and protection of reporting persons Directive (EU) 2019/1937 of the European Parliament and of the Council (6) shall apply to the reporting of breaches of this Regulation and the protection of persons reporting such breaches.

Article 20 Coordination at Union level 1. The Commission and/or any relevant institutions, bodies, offices and agencies of the Union that may be designated in this context shall have the following tasks: — ensuring a consistent risk assessment of artificial intelligence, robotics and related technologies referred to in Article 14 to be carried out by the national supervisory authorities referred to in Article 18 on the basis of the common objective criteria provided for in Article 8(1) and in the list of high-risk sectors and of high-risk uses or purposes set out in the Annex to this Regulation; — taking note of the compliance assessment and subsequent monitoring of high-risk artificial intelligence, robotics and related technologies referred to in Article 15 to be carried out by the national supervisory authorities referred to in Article 18; — developing the application process for the certificate referred to in Article 16 to be issued by the national supervisory authorities referred to in Article 18; — without prejudice to sectorial legislation, preparing the binding guidelines referred to in Article 17(4) on the methodology to be used by the national supervisory authorities referred to in Article 18; — coordinating the establishment of the relevant governance standards referred to in Article 17 by the national supervisory authorities referred to in Article 18, including non-binding implementation guidelines for developers, deployers and users on the methodology for compliance with this Regulation; — cooperating with the national supervisory authorities referred to in Article 18 regarding their contribution to the consistent application of this Regulation throughout the Union pursuant to Article 18(2); — serving as a centre for expertise by promoting the exchange of information related to artificial intelligence, robotics and related technologies and supporting the development of a common understanding in the Single Market, issuing additional guidance, opinions and expertise to the national supervisory authorities referred to in Article 18, monitoring the implementation of relevant Union law, identifying standards for best practice and, where appropriate, making recommendations for regulatory measures; in doing so, it should liaise with the maximum possible number of relevant stakeholders and ensure that the composition of its decision levels is diverse and ensures gender equality; — hosting a Working Group on Security and Defence aimed at looking into policy and investment questions specifically related to the ethical use of artificial intelligence, robotics and related technologies in the field of security and defence.

Article 21 Exercise of delegation 1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. 2. The power to adopt delegated acts referred to in Article 14(3) and (4) shall be conferred on the Commission for a period of 5 years from (date of entry into force of this Regulation). 3. The delegation of power referred to in Article 14(3) and (4) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or a later date specified therein. It shall not affect the validity of any delegated act already in force. 4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law Making. 5. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council. 6. A delegated act adopted pursuant to Article 14(3) and (4) shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of three months of notification of that act to the European Parliament and the Council or, if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by three months at the initiative of the European Parliament or of the Council.

Article 22 Amendment to Directive (EU) 2019/1937 Directive (EU) 2019/1937 is amended as follows: (1) In Article 2(1), the following point is added: ‘(xi) development, deployment and use of artificial intelligence, robotics and related technologies.’ (2) In Part I of the Annex, the following point is added: ‘K. Point (a)(xi) of Article 2(1) — development, deployment and use of artificial intelligence, robotics and related technologies. “(xxi) Regulation [XXX] of the European Parliament and of the Council on ethical principles for the development, deployment and use artificial intelligence, robotics and related technologies”.’

Article 23 Review The Commission shall keep under regular review the development of artificial intelligence, robotics and related technologies, including the software, algorithms and data used or produced by such technologies, and shall by … [OJ: please enter the date three years after entry into force], and every three years thereafter, submit to the European Parliament, the Council and the European Economic and Social Committee a report on the application of this Regulation, including an assessment of the possible modification of the scope of application of this Regulation.

Article 24 Entry into force This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from XX.