laredoyin/eu-ai-act huggingface dataset:
General-purpose AI models, in particular large generative AI models, capable of generating text, images, and other  content, present unique innovation opportunities but also challenges to artists, authors, and other creators and the  way their creative content is created, distributed, used and consumed. The development and training of such models  require access to vast amounts of text, images, videos and other data. Text and data mining techniques may be used  extensively in this context for the retrieval and analysis of such content, which may be protected by copyright and  related rights. Any use of copyright protected content requires the authorisation of the rightsholder concerned  unless relevant copyright exceptions and limitations apply. Directive (EU) 2019/790 introduced exceptions and  limitations allowing reproductions and extractions of works or other subject matter, for the purpose of text and data mining, under certain conditions. Under these rules, rightsholders may choose to reserve their rights over their  works or other subject matter to prevent text and data mining, unless this is done for the purposes of scientific  research. Where the rights to opt out has been expressly reserved in an appropriate manner, providers of  general-purpose AI models need to obtain an authorisation from rightsholders if they want to carry out text and  data mining over such works.
Providers that place general-purpose AI models on the Union market should ensure compliance with the relevant  obligations in this Regulation. To that end, providers of general-purpose AI models should put in place a policy to  comply with Union law on copyright and related rights, in particular to identify and comply with the reservation of  rights expressed by rightsholders pursuant to Article 4(3) of Directive (EU) 2019/790. Any provider placing  a general-purpose AI model on the Union market should comply with this obligation, regardless of the jurisdiction  in which the copyright-relevant acts underpinning the training of those general-purpose AI models take place. This  is necessary to ensure a level playing field among providers of general-purpose AI models where no provider should  be able to gain a competitive advantage in the Union market by applying lower copyright standards than those  provided in the Union.
In order to increase transparency on the data that is used in the pre-training and training of general-purpose AI  models, including text and data protected by copyright law, it is adequate that providers of such models draw up and  make publicly available a sufficiently detailed summary of the content used for training the general-purpose AI  model. While taking into due account the need to protect trade secrets and confidential business information, this  summary should be generally comprehensive in its scope instead of technically detailed to facilitate parties with  legitimate interests, including copyright holders, to exercise and enforce their rights under Union law, for example by  listing the main data collections or sets that went into training the model, such as large private or public databases or  data archives, and by providing a narrative explanation about other data sources used. It is appropriate for the AI  Office to provide a template for the summary, which should be simple, effective, and allow the provider to provide  the required summary in narrative form.
Compliance with the obligations applicable to the providers of general-purpose AI models should be commensurate  and proportionate to the type of model provider, excluding the need for compliance for persons who develop or use  models for non-professional or scientific research purposes, who should nevertheless be encouraged to voluntarily  comply with these requirements. Without prejudice to Union copyright law, compliance with those obligations  should take due account of the size of the provider and allow simplified ways of compliance for SMEs, including  start-ups, that should not represent an excessive cost and not discourage the use of such models. In the case of  a modification or fine-tuning of a model, the obligations for providers of general-purpose AI models should be  limited to that modification or fine-tuning, for example by complementing the already existing technical  documentation with information on the modifications, including new training data sources, as a means to comply  with the value chain obligations provided in this Regulation.
General-purpose AI models could pose systemic risks which include, but are not limited to, any actual or reasonably  foreseeable negative effects in relation to major accidents, disruptions of critical sectors and serious consequences to  public health and safety; any actual or reasonably foreseeable negative effects on democratic processes, public and  economic security; the dissemination of illegal, false, or discriminatory content. Systemic risks should be understood  to increase with model capabilities and model reach, can arise along the entire lifecycle of the model, and are  influenced by conditions of misuse, model reliability, model fairness and model security, the level of autonomy of  the model, its access to tools, novel or combined modalities, release and distribution strategies, the potential to  remove guardrails and other factors. In particular, international approaches have so far identified the need to pay  attention to risks from potential intentional misuse or unintended issues of control relating to alignment with  human intent; chemical, biological, radiological, and nuclear risks, such as the ways in which barriers to entry can be  lowered, including for weapons development, design acquisition, or use; offensive cyber capabilities, such as the  ways in vulnerability discovery, exploitation, or operational use can be enabled; the effects of interaction and tool  use, including for example the capacity to control physical systems and interfere with critical infrastructure; risks  from models of making copies of themselves or ‘self-replicating’ or training other models; the ways in which models  can give rise to harmful bias and discrimination with risks to individuals, communities or societies; the facilitation of  disinformation or harming privacy with threats to democratic values and human rights; risk that a particular event  could lead to a chain reaction with considerable negative effects that could affect up to an entire city, an entire  domain activity or an entire community.
It is also necessary to clarify a procedure for the classification of a general-purpose AI model with systemic risks.  A general-purpose AI model that meets the applicable threshold for high-impact capabilities should be presumed to  be a general-purpose AI models with systemic risk. The provider should notify the AI Office at the latest two weeks  after the requirements are met or it becomes known that a general-purpose AI model will meet the requirements  that lead to the presumption. This is especially relevant in relation to the threshold of floating point operations  because training of general-purpose AI models takes considerable planning which includes the upfront allocation of  compute resources and, therefore, providers of general-purpose AI models are able to know if their model would  meet the threshold before the training is completed. In the context of that notification, the provider should be able to  demonstrate that, because of its specific characteristics, a general-purpose AI model exceptionally does not present  systemic risks, and that it thus should not be classified as a general-purpose AI model with systemic risks. That  information is valuable for the AI Office to anticipate the placing on the market of general-purpose AI models with  systemic risks and the providers can start to engage with the AI Office early on. That information is especially important with regard to general-purpose AI models that are planned to be released as open-source, given that, after  the open-source model release, necessary measures to ensure compliance with the obligations under this Regulation  may be more difficult to implement.
If the Commission becomes aware of the fact that a general-purpose AI model meets the requirements to classify as  a general-purpose AI model with systemic risk, which previously had either not been known or of which the  relevant provider has failed to notify the Commission, the Commission should be empowered to designate it so.  A system of qualified alerts should ensure that the AI Office is made aware by the scientific panel of general-purpose  AI models that should possibly be classified as general-purpose AI models with systemic risk, in addition to the  monitoring activities of the AI Office.
The providers of general-purpose AI models presenting systemic risks should be subject, in addition to the  obligations provided for providers of general-purpose AI models, to obligations aimed at identifying and mitigating  those risks and ensuring an adequate level of cybersecurity protection, regardless of whether it is provided as  a standalone model or embedded in an AI system or a product. To achieve those objectives, this Regulation should  require providers to perform the necessary model evaluations, in particular prior to its first placing on the market,  including conducting and documenting adversarial testing of models, also, as appropriate, through internal or  independent external testing. In addition, providers of general-purpose AI models with systemic risks should  continuously assess and mitigate systemic risks, including for example by putting in place risk-management policies,  such as accountability and governance processes, implementing post-market monitoring, taking appropriate  measures along the entire model’s lifecycle and cooperating with relevant actors along the AI value chain.
Providers of general-purpose AI models with systemic risks should assess and mitigate possible systemic risks. If,  despite efforts to identify and prevent risks related to a general-purpose AI model that may present systemic risks,  the development or use of the model causes a serious incident, the general-purpose AI model provider should  without undue delay keep track of the incident and report any relevant information and possible corrective measures  to the Commission and national competent authorities. Furthermore, providers should ensure an adequate level of  cybersecurity protection for the model and its physical infrastructure, if appropriate, along the entire model lifecycle.  Cybersecurity protection related to systemic risks associated with malicious use or attacks should duly consider  accidental model leakage, unauthorised releases, circumvention of safety measures, and defence against cyberattacks,  unauthorised access or model theft. That protection could be facilitated by securing model weights, algorithms,  servers, and data sets, such as through operational security measures for information security, specific cybersecurity  policies, adequate technical and established solutions, and cyber and physical access controls, appropriate to the  relevant circumstances and the risks involved.
The AI Office should encourage and facilitate the drawing up, review and adaptation of codes of practice, taking into  account international approaches. All providers of general-purpose AI models could be invited to participate. To  ensure that the codes of practice reflect the state of the art and duly take into account a diverse set of perspectives,  the AI Office should collaborate with relevant national competent authorities, and could, where appropriate, consult  with civil society organisations and other relevant stakeholders and experts, including the Scientific Panel, for the  drawing up of such codes. Codes of practice should cover obligations for providers of general-purpose AI models  and of general-purpose AI models presenting systemic risks. In addition, as regards systemic risks, codes of practice  should help to establish a risk taxonomy of the type and nature of the systemic risks at Union level, including their  sources. Codes of practice should also be focused on specific risk assessment and mitigation measures.
The codes of practice should represent a central tool for the proper compliance with the obligations provided for  under this Regulation for providers of general-purpose AI models. Providers should be able to rely on codes of  practice to demonstrate compliance with the obligations. By means of implementing acts, the Commission may  decide to approve a code of practice and give it a general validity within the Union, or, alternatively, to provide  common rules for the implementation of the relevant obligations, if, by the time this Regulation becomes applicable,  a code of practice cannot be finalised or is not deemed adequate by the AI Office. Once a harmonised standard is  published and assessed as suitable to cover the relevant obligations by the AI Office, compliance with a European  harmonised standard should grant providers the presumption of conformity. Providers of general-purpose AI  models should furthermore be able to demonstrate compliance using alternative adequate means, if codes of practice  or harmonised standards are not available, or they choose not to rely on those.
This Regulation regulates AI systems and AI models by imposing certain requirements and obligations for relevant  market actors that are placing them on the market, putting into service or use in the Union, thereby complementing  obligations for providers of intermediary services that embed such systems or models into their services regulated by  Regulation (EU) 2022/2065. To the extent that such systems or models are embedded into designated very large  online platforms or very large online search engines, they are subject to the risk-management framework provided  for in Regulation (EU) 2022/2065. Consequently, the corresponding obligations of this Regulation should be  presumed to be fulfilled, unless significant systemic risks not covered by Regulation (EU) 2022/2065 emerge and are  identified in such models. Within this framework, providers of very large online platforms and very large online  search engines are obliged to assess potential systemic risks stemming from the design, functioning and use of their  services, including how the design of algorithmic systems used in the service may contribute to such risks, as well as  systemic risks stemming from potential misuses. Those providers are also obliged to take appropriate mitigating  measures in observance of fundamental rights.
Considering the quick pace of innovation and the technological evolution of digital services in scope of different  instruments of Union law in particular having in mind the usage and the perception of their recipients, the AI  systems subject to this Regulation may be provided as intermediary services or parts thereof within the meaning of  Regulation (EU) 2022/2065, which should be interpreted in a technology-neutral manner. For example, AI systems  may be used to provide online search engines, in particular, to the extent that an AI system such as an online chatbot  performs searches of, in principle, all websites, then incorporates the results into its existing knowledge and uses the  updated knowledge to generate a single output that combines different sources of information.
Furthermore, obligations placed on providers and deployers of certain AI systems in this Regulation to enable the  detection and disclosure that the outputs of those systems are artificially generated or manipulated are particularly  relevant to facilitate the effective implementation of Regulation (EU) 2022/2065. This applies in particular as regards  the obligations of providers of very large online platforms or very large online search engines to identify and  mitigate systemic risks that may arise from the dissemination of content that has been artificially generated or  manipulated, in particular risk of the actual or foreseeable negative effects on democratic processes, civic discourse  and electoral processes, including through disinformation.
Standardisation should play a key role to provide technical solutions to providers to ensure compliance with this  Regulation, in line with the state of the art, to promote innovation as well as competitiveness and growth in the  single market. Compliance with harmonised standards as defined in Article 2, point (1)(c), of Regulation (EU)  No 1025/2012 of the European Parliament and of the Council (41), which are normally expected to reflect the state  of the art, should be a means for providers to demonstrate conformity with the requirements of this Regulation.  A balanced representation of interests involving all relevant stakeholders in the development of standards, in  particular SMEs, consumer organisations and environmental and social stakeholders in accordance with Articles 5  and 6 of Regulation (EU) No 1025/2012 should therefore be encouraged. In order to facilitate compliance, the  standardisation requests should be issued by the Commission without undue delay. When preparing the  standardisation request, the Commission should consult the advisory forum and the Board in order to collect  relevant expertise. However, in the absence of relevant references to harmonised standards, the Commission should  be able to establish, via implementing acts, and after consultation of the advisory forum, common specifications for  certain requirements under this Regulation. The common specifications should be an exceptional fallback solution to  facilitate the provider’s obligation to comply with the requirements of this Regulation, when the standardisation  request has not been accepted by any of the European standardisation organisations, or when the relevant  harmonised standards insufficiently address fundamental rights concerns, or when the harmonised standards do not  comply with the request, or when there are delays in the adoption of an appropriate harmonised standard. Where  such a delay in the adoption of a harmonised standard is due to the technical complexity of that standard, this should be considered by the Commission before contemplating the establishment of common specifications. When  developing common specifications, the Commission is encouraged to cooperate with international partners and  international standardisation bodies.
It is appropriate that, without prejudice to the use of harmonised standards and common specifications, providers of  a high-risk AI system that has been trained and tested on data reflecting the specific geographical, behavioural,  contextual or functional setting within which the AI system is intended to be used, should be presumed to comply  with the relevant measure provided for under the requirement on data governance set out in this Regulation.  Without prejudice to the requirements related to robustness and accuracy set out in this Regulation, in accordance  with Article 54(3) of Regulation (EU) 2019/881, high-risk AI systems that have been certified or for which  a statement of conformity has been issued under a cybersecurity scheme pursuant to that Regulation and the  references of which have been published in the Official Journal of the European Union should be presumed to comply  with the cybersecurity requirement of this Regulation in so far as the cybersecurity certificate or statement of  conformity or parts thereof cover the cybersecurity requirement of this Regulation. This remains without prejudice  to the voluntary nature of that cybersecurity scheme.
It is appropriate that, in order to minimise the burden on operators and avoid any possible duplication, for high-risk  AI systems related to products which are covered by existing Union harmonisation legislation based on the New  Legislative Framework, the compliance of those AI systems with the requirements of this Regulation should be  assessed as part of the conformity assessment already provided for in that law. The applicability of the requirements  of this Regulation should thus not affect the specific logic, methodology or general structure of conformity  assessment under the relevant Union harmonisation legislation.
Given the complexity of high-risk AI systems and the risks that are associated with them, it is important to develop  an adequate conformity assessment procedure for high-risk AI systems involving notified bodies, so-called third  party conformity assessment. However, given the current experience of professional pre-market certifiers in the field  of product safety and the different nature of risks involved, it is appropriate to limit, at least in an initial phase of  application of this Regulation, the scope of application of third-party conformity assessment for high-risk AI  systems other than those related to products. Therefore, the conformity assessment of such systems should be  carried out as a general rule by the provider under its own responsibility, with the only exception of AI systems  intended to be used for biometrics.
In order to carry out third-party conformity assessments when so required, notified bodies should be notified under  this Regulation by the national competent authorities, provided that they comply with a set of requirements, in  particular on independence, competence, absence of conflicts of interests and suitable cybersecurity requirements.  Notification of those bodies should be sent by national competent authorities to the Commission and the other  Member States by means of the electronic notification tool developed and managed by the Commission pursuant to  Article R23 of Annex I to Decision No 768/2008/EC.
In line with Union commitments under the World Trade Organization Agreement on Technical Barriers to Trade, it is  adequate to facilitate the mutual recognition of conformity assessment results produced by competent conformity  assessment bodies, independent of the territory in which they are established, provided that those conformity  assessment bodies established under the law of a third country meet the applicable requirements of this Regulation  and the Union has concluded an agreement to that extent. In this context, the Commission should actively explore  possible international instruments for that purpose and in particular pursue the conclusion of mutual recognition  agreements with third countries.
In line with the commonly established notion of substantial modification for products regulated by Union  harmonisation legislation, it is appropriate that whenever a change occurs which may affect the compliance of  a high-risk AI system with this Regulation (e.g. change of operating system or software architecture), or when the  intended purpose of the system changes, that AI system should be considered to be a new AI system which should  undergo a new conformity assessment. However, changes occurring to the algorithm and the performance of AI  systems which continue to ‘learn’ after being placed on the market or put into service, namely automatically  adapting how functions are carried out, should not constitute a substantial modification, provided that those  changes have been pre-determined by the provider and assessed at the moment of the conformity assessment.
High-risk AI systems should bear the CE marking to indicate their conformity with this Regulation so that they can  move freely within the internal market. For high-risk AI systems embedded in a product, a physical CE marking  should be affixed, and may be complemented by a digital CE marking. For high-risk AI systems only provided  digitally, a digital CE marking should be used. Member States should not create unjustified obstacles to the placing  on the market or the putting into service of high-risk AI systems that comply with the requirements laid down in  this Regulation and bear the CE marking.