laredoyin/eu-ai-act huggingface dataset:
To support the implementation and enforcement of this Regulation, in particular the monitoring activities of the AI  Office as regards general-purpose AI models, a scientific panel of independent experts should be established. The  independent experts constituting the scientific panel should be selected on the basis of up-to-date scientific or  technical expertise in the field of AI and should perform their tasks with impartiality, objectivity and ensure the  confidentiality of information and data obtained in carrying out their tasks and activities. To allow the reinforcement  of national capacities necessary for the effective enforcement of this Regulation, Member States should be able to  request support from the pool of experts constituting the scientific panel for their enforcement activities.
Member States hold a key role in the application and enforcement of this Regulation. In that respect, each Member  State should designate at least one notifying authority and at least one market surveillance authority as national  competent authorities for the purpose of supervising the application and implementation of this Regulation.  Member States may decide to appoint any kind of public entity to perform the tasks of the national competent  authorities within the meaning of this Regulation, in accordance with their specific national organisational  characteristics and needs. In order to increase organisation efficiency on the side of Member States and to set a single  point of contact vis-à-vis the public and other counterparts at Member State and Union levels, each Member State  should designate a market surveillance authority to act as a single point of contact.
In order to ensure that providers of high-risk AI systems can take into account the experience on the use of high-risk  AI systems for improving their systems and the design and development process or can take any possible corrective  action in a timely manner, all providers should have a post-market monitoring system in place. Where relevant,  post-market monitoring should include an analysis of the interaction with other AI systems including other devices  and software. Post-market monitoring should not cover sensitive operational data of deployers which are law  enforcement authorities. This system is also key to ensure that the possible risks emerging from AI systems which  continue to ‘learn’ after being placed on the market or put into service can be more efficiently and timely addressed.  In this context, providers should also be required to have a system in place to report to the relevant authorities any  serious incidents resulting from the use of their AI systems, meaning incident or malfunctioning leading to death or  serious damage to health, serious and irreversible disruption of the management and operation of critical  infrastructure, infringements of obligations under Union law intended to protect fundamental rights or serious  damage to property or the environment.
In order to ensure an appropriate and effective enforcement of the requirements and obligations set out by this  Regulation, which is Union harmonisation legislation, the system of market surveillance and compliance of products  established by Regulation (EU) 2019/1020 should apply in its entirety. Market surveillance authorities designated  pursuant to this Regulation should have all enforcement powers laid down in this Regulation and in Regulation (EU)  2019/1020 and should exercise their powers and carry out their duties independently, impartially and without bias.  Although the majority of AI systems are not subject to specific requirements and obligations under this Regulation,  market surveillance authorities may take measures in relation to all AI systems when they present a risk in  accordance with this Regulation. Due to the specific nature of Union institutions, agencies and bodies falling within  the scope of this Regulation, it is appropriate to designate the European Data Protection Supervisor as a competent  market surveillance authority for them. This should be without prejudice to the designation of national competent  authorities by the Member States. Market surveillance activities should not affect the ability of the supervised entities  to carry out their tasks independently, when such independence is required by Union law.
This Regulation is without prejudice to the competences, tasks, powers and independence of relevant national public  authorities or bodies which supervise the application of Union law protecting fundamental rights, including equality  bodies and data protection authorities. Where necessary for their mandate, those national public authorities or  bodies should also have access to any documentation created under this Regulation. A specific safeguard procedure  should be set for ensuring adequate and timely enforcement against AI systems presenting a risk to health, safety and  fundamental rights. The procedure for such AI systems presenting a risk should be applied to high-risk AI systems  presenting a risk, prohibited systems which have been placed on the market, put into service or used in violation of  the prohibited practices laid down in this Regulation and AI systems which have been made available in violation of  the transparency requirements laid down in this Regulation and present a risk.
Each market surveillance authority for high-risk AI systems in the area of biometrics, as listed in an annex to this  Regulation insofar as those systems are used for the purposes of law enforcement, migration, asylum and border  control management, or the administration of justice and democratic processes, should have effective investigative  and corrective powers, including at least the power to obtain access to all personal data that are being processed and  to all information necessary for the performance of its tasks. The market surveillance authorities should be able to  exercise their powers by acting with complete independence. Any limitations of their access to sensitive operational  data under this Regulation should be without prejudice to the powers conferred to them by Directive (EU) 2016/680. No exclusion on disclosing data to national data protection authorities under this Regulation should  affect the current or future powers of those authorities beyond the scope of this Regulation.
The market surveillance authorities and the Commission should be able to propose joint activities, including joint  investigations, to be conducted by market surveillance authorities or market surveillance authorities jointly with the  Commission, that have the aim of promoting compliance, identifying non-compliance, raising awareness and  providing guidance in relation to this Regulation with respect to specific categories of high-risk AI systems that are  found to present a serious risk across two or more Member States. Joint activities to promote compliance should be  carried out in accordance with Article 9 of Regulation (EU) 2019/1020. The AI Office should provide coordination  support for joint investigations.
It is necessary to clarify the responsibilities and competences at Union and national level as regards AI systems that  are built on general-purpose AI models. To avoid overlapping competences, where an AI system is based on  a general-purpose AI model and the model and system are provided by the same provider, the supervision should take place at Union level through the AI Office, which should have the powers of a market surveillance authority within the meaning of Regulation (EU) 2019/1020 for this purpose. In all other cases, national market surveillance authorities remain responsible for the supervision of AI systems. However, for general-purpose AI systems that can be used directly by deployers for at least one purpose that is classified as high-risk, market surveillance authorities should cooperate with the AI Office to carry out evaluations of compliance and inform the Board and other market surveillance authorities accordingly. Furthermore, market surveillance authorities should be able to request assistance from the AI Office where the market surveillance authority is unable to conclude an investigation on a high-risk AI system because of its inability to access certain information related to the general-purpose AI model on which the high-risk AI system is built. In such cases, the procedure regarding mutual assistance in cross-border cases in Chapter VI of Regulation (EU) 2019/1020 should apply mutatis mutandis.
To make best use of the centralised Union expertise and synergies at Union level, the powers of supervision and  enforcement of the obligations on providers of general-purpose AI models should be a competence of the  Commission. The AI Office should be able to carry out all necessary actions to monitor the effective implementation  of this Regulation as regards general-purpose AI models. It should be able to investigate possible infringements of  the rules on providers of general-purpose AI models both on its own initiative, following the results of its  monitoring activities, or upon request from market surveillance authorities in line with the conditions set out in this  Regulation. To support effective monitoring of the AI Office, it should provide for the possibility that downstream  providers lodge complaints about possible infringements of the rules on providers of general-purpose AI models and  systems.
With a view to complementing the governance systems for general-purpose AI models, the scientific panel should  support the monitoring activities of the AI Office and may, in certain cases, provide qualified alerts to the AI Office  which trigger follow-ups, such as investigations. This should be the case where the scientific panel has reason to  suspect that a general-purpose AI model poses a concrete and identifiable risk at Union level. Furthermore, this  should be the case where the scientific panel has reason to suspect that a general-purpose AI model meets the criteria  that would lead to a classification as general-purpose AI model with systemic risk. To equip the scientific panel with  the information necessary for the performance of those tasks, there should be a mechanism whereby the scientific  panel can request the Commission to require documentation or information from a provider.
The AI Office should be able to take the necessary actions to monitor the effective implementation of and  compliance with the obligations for providers of general-purpose AI models laid down in this Regulation. The AI  Office should be able to investigate possible infringements in accordance with the powers provided for in this  Regulation, including by requesting documentation and information, by conducting evaluations, as well as by  requesting measures from providers of general-purpose AI models. When conducting evaluations, in order to make  use of independent expertise, the AI Office should be able to involve independent experts to carry out the  evaluations on its behalf. Compliance with the obligations should be enforceable, inter alia, through requests to take  appropriate measures, including risk mitigation measures in the case of identified systemic risks as well as restricting  the making available on the market, withdrawing or recalling the model. As a safeguard, where needed beyond the  procedural rights provided for in this Regulation, providers of general-purpose AI models should have the  procedural rights provided for in Article 18 of Regulation (EU) 2019/1020, which should apply mutatis mutandis,  without prejudice to more specific procedural rights provided for by this Regulation.
The development of AI systems other than high-risk AI systems in accordance with the requirements of this  Regulation may lead to a larger uptake of ethical and trustworthy AI in the Union. Providers of AI systems that are  not high-risk should be encouraged to create codes of conduct, including related governance mechanisms, intended  to foster the voluntary application of some or all of the mandatory requirements applicable to high-risk AI systems,  adapted in light of the intended purpose of the systems and the lower risk involved and taking into account the  available technical solutions and industry best practices such as model and data cards. Providers and, as appropriate,  deployers of all AI systems, high-risk or not, and AI models should also be encouraged to apply on a voluntary basis  additional requirements related, for example, to the elements of the Union’s Ethics Guidelines for Trustworthy AI,  environmental sustainability, AI literacy measures, inclusive and diverse design and development of AI systems,  including attention to vulnerable persons and accessibility to persons with disability, stakeholders’ participation with  the involvement, as appropriate, of relevant stakeholders such as business and civil society organisations, academia,  research organisations, trade unions and consumer protection organisations in the design and development of AI  systems, and diversity of the development teams, including gender balance. To ensure that the voluntary codes of  conduct are effective, they should be based on clear objectives and key performance indicators to measure the  achievement of those objectives. They should also be developed in an inclusive way, as appropriate, with the  involvement of relevant stakeholders such as business and civil society organisations, academia, research  organisations, trade unions and consumer protection organisation. The Commission may develop initiatives,  including of a sectoral nature, to facilitate the lowering of technical barriers hindering cross-border exchange of data  for AI development, including on data access infrastructure, semantic and technical interoperability of different types  of data.
In order to ensure trustful and constructive cooperation of competent authorities on Union and national level, all  parties involved in the application of this Regulation should respect the confidentiality of information and data  obtained in carrying out their tasks, in accordance with Union or national law. They should carry out their tasks and  activities in such a manner as to protect, in particular, intellectual property rights, confidential business information  and trade secrets, the effective implementation of this Regulation, public and national security interests, the integrity  of criminal and administrative proceedings, and the integrity of classified information.
Compliance with this Regulation should be enforceable by means of the imposition of penalties and other  enforcement measures. Member States should take all necessary measures to ensure that the provisions of this  Regulation are implemented, including by laying down effective, proportionate and dissuasive penalties for their  infringement, and to respect the ne bis in idem principle. In order to strengthen and harmonise administrative  penalties for infringement of this Regulation, the upper limits for setting the administrative fines for certain specific  infringements should be laid down. When assessing the amount of the fines, Member States should, in each  individual case, take into account all relevant circumstances of the specific situation, with due regard in particular to  the nature, gravity and duration of the infringement and of its consequences and to the size of the provider, in  particular if the provider is an SME, including a start-up. The European Data Protection Supervisor should have the  power to impose fines on Union institutions, agencies and bodies falling within the scope of this Regulation.
Compliance with the obligations on providers of general-purpose AI models imposed under this Regulation should  be enforceable, inter alia, by means of fines. To that end, appropriate levels of fines should also be laid down for  infringement of those obligations, including the failure to comply with measures requested by the Commission in  accordance with this Regulation, subject to appropriate limitation periods in accordance with the principle of  proportionality. All decisions taken by the Commission under this Regulation are subject to review by the Court of  Justice of the European Union in accordance with the TFEU, including the unlimited jurisdiction of the Court of  Justice with regard to penalties pursuant to Article 261 TFEU.
Affected persons should have the right to obtain an explanation where a deployer’s decision is based mainly upon  the output from certain high-risk AI systems that fall within the scope of this Regulation and where that decision produces legal effects or similarly significantly affects those persons in a way that they consider to have an adverse impact on their health, safety or fundamental rights. That explanation should be clear and meaningful and should provide a basis on which the affected persons are able to exercise their rights. The right to obtain an explanation should not apply to the use of AI systems for which exceptions or restrictions follow from Union or national law and should apply only to the extent this right is not already provided for under Union law.
In order to ensure that the regulatory framework can be adapted where necessary, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission to amend the conditions under which an AI system is not to be considered to be high-risk, the list of high-risk AI systems, the provisions regarding technical documentation, the content of the EU declaration of conformity the provisions regarding the conformity assessment procedures, the provisions establishing the high-risk AI systems to which the conformity assessment procedure based on assessment of the quality management system and assessment of the technical documentation should apply, the threshold, benchmarks and indicators, including by supplementing those benchmarks and indicators, in the rules for the classification of general-purpose AI models with systemic risk, the criteria for the designation of general-purpose AI models with systemic risk, the technical documentation for providers of general-purpose AI models and the transparency information for providers of general-purpose AI models. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making (55). In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts.
Given the rapid technological developments and the technical expertise required to effectively apply this Regulation, the Commission should evaluate and review this Regulation by 2 August 2029 and every four years thereafter and report to the European Parliament and the Council. In addition, taking into account the implications for the scope of this Regulation, the Commission should carry out an assessment of the need to amend the list of high-risk AI systems and the list of prohibited practices once a year. Moreover, by 2 August 2028 and every four years thereafter, the Commission should evaluate and report to the European Parliament and to the Council on the need to amend the list of high-risk areas headings in the annex to this Regulation, the AI systems within the scope of the transparency obligations, the effectiveness of the supervision and governance system and the progress on the development of standardisation deliverables on energy efficient development of general-purpose AI models, including the need for further measures or actions. Finally, by 2 August 2028 and every three years thereafter, the Commission should evaluate the impact and effectiveness of voluntary codes of conduct to foster the application of the requirements provided for high-risk AI systems in the case of AI systems other than high-risk AI systems and possibly other additional requirements for such AI systems.
Since the objective of this Regulation, namely to improve the functioning of the internal market and to promote the uptake of human-centric and trustworthy AI, while ensuring a high level of protection of health, safety, fundamental rights enshrined in the Charter, including democracy, the rule of law and environmental protection against harmful effects of AI systems in the Union and supporting innovation, cannot be sufficiently achieved by the Member States and can rather, by reason of the scale or effects of the action, be better achieved at Union level, the Union may adopt measures in accordance with the principle of subsidiarity as set out in Article 5 TEU. In accordance with the principle of proportionality as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve that objective.
In order to ensure legal certainty, ensure an appropriate adaptation period for operators and avoid disruption to the market, including by ensuring continuity of the use of AI systems, it is appropriate that this Regulation applies to the high-risk AI systems that have been placed on the market or put into service before the general date of application thereof, only if, from that date, those systems are subject to significant changes in their design or intended purpose. It is appropriate to clarify that, in this respect, the concept of significant change should be understood as equivalent in substance to the notion of substantial modification, which is used with regard only to high-risk AI systems pursuant to this Regulation. On an exceptional basis and in light of public accountability, operators of AI systems which are components of the large-scale IT systems established by the legal acts listed in an annex to this Regulation and operators of high-risk AI systems that are intended to be used by public authorities should, respectively, take the necessary steps to comply with the requirements of this Regulation by end of 2030 and by 2 August 2030.
This Regulation should apply from 2 August 2026. However, taking into account the unacceptable risk associated with the use of AI in certain ways, the prohibitions as well as the general provisions of this Regulation should already apply from 2 February 2025. While the full effect of those prohibitions follows with the establishment of the governance and enforcement of this Regulation, anticipating the application of the prohibitions is important to take account of unacceptable risks and to have an effect on other procedures, such as in civil law. Moreover, the infrastructure related to the governance and the conformity assessment system should be operational before 2 August 2026, therefore the provisions on notified bodies and governance structure should apply from 2 August 2025. Given the rapid pace of technological advancements and adoption of general-purpose AI models, obligations for providers of general-purpose AI models should apply from 2 August 2025. Codes of practice should be ready by 2 May 2025 in view of enabling providers to demonstrate compliance on time. The AI Office should ensure that classification rules and procedures are up to date in light of technological developments. In addition, Member States should lay down and notify to the Commission the rules on penalties, including administrative fines, and ensure that they are properly and effectively implemented by the date of application of this Regulation. Therefore the provisions on penalties should apply from 2 August 2025.