laredoyin/eu-ai-act huggingface dataset:
To mitigate the risks from high-risk AI systems placed on the market or put into service and to ensure a high level of  trustworthiness, certain mandatory requirements should apply to high-risk AI systems, taking into account the  intended purpose and the context of use of the AI system and according to the risk-management system to be  established by the provider. The measures adopted by the providers to comply with the mandatory requirements of  this Regulation should take into account the generally acknowledged state of the art on AI, be proportionate and  effective to meet the objectives of this Regulation. Based on the New Legislative Framework, as clarified in  Commission notice ‘The “Blue Guide” on the implementation of EU product rules 2022’, the general rule is that  more than one legal act of Union harmonisation legislation may be applicable to one product, since the making  available or putting into service can take place only when the product complies with all applicable Union  harmonisation legislation. The hazards of AI systems covered by the requirements of this Regulation concern  different aspects than the existing Union harmonisation legislation and therefore the requirements of this Regulation  would complement the existing body of the Union harmonisation legislation. For example, machinery or medical  devices products incorporating an AI system might present risks not addressed by the essential health and safety  requirements set out in the relevant Union harmonised legislation, as that sectoral law does not deal with risks specific to AI systems. This calls for a simultaneous and complementary application of the various legislative acts. To ensure consistency and to avoid an unnecessary administrative burden and unnecessary costs, providers of a product that contains one or more high-risk AI system, to which the requirements of this Regulation and of the Union harmonisation legislation based on the New Legislative Framework and listed in an annex to this Regulation apply, should have flexibility with regard to operational decisions on how to ensure compliance of a product that contains one or more AI systems with all the applicable requirements of that Union harmonised legislation in an optimal manner. That flexibility could mean, for example a decision by the provider to integrate a part of the necessary testing and reporting processes, information and documentation required under this Regulation into already existing documentation and procedures required under existing Union harmonisation legislation based on the New Legislative Framework and listed in an annex to this Regulation. This should not, in any way, undermine the obligation of the provider to comply with all the applicable requirements.
The risk-management system should consist of a continuous, iterative process that is planned and run throughout  the entire lifecycle of a high-risk AI system. That process should be aimed at identifying and mitigating the relevant  risks of AI systems on health, safety and fundamental rights. The risk-management system should be regularly  reviewed and updated to ensure its continuing effectiveness, as well as justification and documentation of any  significant decisions and actions taken subject to this Regulation. This process should ensure that the provider  identifies risks or adverse impacts and implements mitigation measures for the known and reasonably foreseeable  risks of AI systems to the health, safety and fundamental rights in light of their intended purpose and reasonably  foreseeable misuse, including the possible risks arising from the interaction between the AI system and the  environment within which it operates. The risk-management system should adopt the most appropriate  risk-management measures in light of the state of the art in AI. When identifying the most appropriate  risk-management measures, the provider should document and explain the choices made and, when relevant,  involve experts and external stakeholders. In identifying the reasonably foreseeable misuse of high-risk AI systems,  the provider should cover uses of AI systems which, while not directly covered by the intended purpose and  provided for in the instruction for use may nevertheless be reasonably expected to result from readily predictable  human behaviour in the context of the specific characteristics and use of a particular AI system. Any known or  foreseeable circumstances related to the use of the high-risk AI system in accordance with its intended purpose or  under conditions of reasonably foreseeable misuse, which may lead to risks to the health and safety or fundamental  rights should be included in the instructions for use that are provided by the provider. This is to ensure that the  deployer is aware and takes them into account when using the high-risk AI system. Identifying and implementing  risk mitigation measures for foreseeable misuse under this Regulation should not require specific additional training  for the high-risk AI system by the provider to address foreseeable misuse. The providers however are encouraged to  consider such additional training measures to mitigate reasonable foreseeable misuses as necessary and appropriate.
Requirements should apply to high-risk AI systems as regards risk management, the quality and relevance of data  sets used, technical documentation and record-keeping, transparency and the provision of information to deployers,  human oversight, and robustness, accuracy and cybersecurity. Those requirements are necessary to effectively  mitigate the risks for health, safety and fundamental rights. As no other less trade restrictive measures are reasonably  available those requirements are not unjustified restrictions to trade.
High-quality data and access to high-quality data plays a vital role in providing structure and in ensuring the  performance of many AI systems, especially when techniques involving the training of models are used, with a view  to ensure that the high-risk AI system performs as intended and safely and it does not become a source of  discrimination prohibited by Union law. High-quality data sets for training, validation and testing require the  implementation of appropriate data governance and management practices. Data sets for training, validation and  testing, including the labels, should be relevant, sufficiently representative, and to the best extent possible free of  errors and complete in view of the intended purpose of the system. In order to facilitate compliance with Union data  protection law, such as Regulation (EU) 2016/679, data governance and management practices should include, in  the case of personal data, transparency about the original purpose of the data collection. The data sets should also  have the appropriate statistical properties, including as regards the persons or groups of persons in relation to whom  the high-risk AI system is intended to be used, with specific attention to the mitigation of possible biases in the data  sets, that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to  discrimination prohibited under Union law, especially where data outputs influence inputs for future operations (feedback loops). Biases can for example be inherent in underlying data sets, especially when historical data is being  used, or generated when the systems are implemented in real world settings. Results provided by AI systems could be  influenced by such inherent biases that are inclined to gradually increase and thereby perpetuate and amplify existing  discrimination, in particular for persons belonging to certain vulnerable groups, including racial or ethnic groups.  The requirement for the data sets to be to the best extent possible complete and free of errors should not affect the  use of privacy-preserving techniques in the context of the development and testing of AI systems. In particular, data  sets should take into account, to the extent required by their intended purpose, the features, characteristics or  elements that are particular to the specific geographical, contextual, behavioural or functional setting which the AI  system is intended to be used. The requirements related to data governance can be complied with by having recourse  to third parties that offer certified compliance services including verification of data governance, data set integrity,  and data training, validation and testing practices, as far as compliance with the data requirements of this Regulation  are ensured.
For the development and assessment of high-risk AI systems, certain actors, such as providers, notified bodies and  other relevant entities, such as European Digital Innovation Hubs, testing experimentation facilities and researchers,  should be able to access and use high-quality data sets within the fields of activities of those actors which are related  to this Regulation. European common data spaces established by the Commission and the facilitation of data sharing  between businesses and with government in the public interest will be instrumental to provide trustful, accountable  and non-discriminatory access to high-quality data for the training, validation and testing of AI systems. For  example, in health, the European health data space will facilitate non-discriminatory access to health data and the  training of AI algorithms on those data sets, in a privacy-preserving, secure, timely, transparent and trustworthy  manner, and with an appropriate institutional governance. Relevant competent authorities, including sectoral ones,  providing or supporting the access to data may also support the provision of high-quality data for the training,  validation and testing of AI systems.
The right to privacy and to protection of personal data must be guaranteed throughout the entire lifecycle of the AI  system. In this regard, the principles of data minimisation and data protection by design and by default, as set out in  Union data protection law, are applicable when personal data are processed. Measures taken by providers to ensure  compliance with those principles may include not only anonymisation and encryption, but also the use of  technology that permits algorithms to be brought to the data and allows training of AI systems without the  transmission between parties or copying of the raw or structured data themselves, without prejudice to the  requirements on data governance provided for in this Regulation.
In order to protect the right of others from the discrimination that might result from the bias in AI systems, the  providers should, exceptionally, to the extent that it is strictly necessary for the purpose of ensuring bias detection  and correction in relation to the high-risk AI systems, subject to appropriate safeguards for the fundamental rights  and freedoms of natural persons and following the application of all applicable conditions laid down under this  Regulation in addition to the conditions laid down in Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, be able to process also special categories of personal data, as a matter of substantial public interest  within the meaning of Article 9(2), point (g) of Regulation (EU) 2016/679 and Article 10(2), point (g) of Regulation (EU) 2018/1725.
Having comprehensible information on how high-risk AI systems have been developed and how they perform  throughout their lifetime is essential to enable traceability of those systems, verify compliance with the requirements  under this Regulation, as well as monitoring of their operations and post market monitoring. This requires keeping  records and the availability of technical documentation, containing information which is necessary to assess the  compliance of the AI system with the relevant requirements and facilitate post market monitoring. Such information  should include the general characteristics, capabilities and limitations of the system, algorithms, data, training,  testing and validation processes used as well as documentation on the relevant risk-management system and drawn  in a clear and comprehensive form. The technical documentation should be kept up to date, appropriately  throughout the lifetime of the AI system. Furthermore, high-risk AI systems should technically allow for the  automatic recording of events, by means of logs, over the duration of the lifetime of the system.
To address concerns related to opacity and complexity of certain AI systems and help deployers to fulfil their  obligations under this Regulation, transparency should be required for high-risk AI systems before they are placed  on the market or put it into service. High-risk AI systems should be designed in a manner to enable deployers to  understand how the AI system works, evaluate its functionality, and comprehend its strengths and limitations.  High-risk AI systems should be accompanied by appropriate information in the form of instructions of use. Such  information should include the characteristics, capabilities and limitations of performance of the AI system. Those  would cover information on possible known and foreseeable circumstances related to the use of the high-risk AI  system, including deployer action that may influence system behaviour and performance, under which the AI system  can lead to risks to health, safety, and fundamental rights, on the changes that have been pre-determined and  assessed for conformity by the provider and on the relevant human oversight measures, including the measures to  facilitate the interpretation of the outputs of the AI system by the deployers. Transparency, including the  accompanying instructions for use, should assist deployers in the use of the system and support informed decision  making by them. Deployers should, inter alia, be in a better position to make the correct choice of the system that  they intend to use in light of the obligations applicable to them, be educated about the intended and precluded uses,  and use the AI system correctly and as appropriate. In order to enhance legibility and accessibility of the information  included in the instructions of use, where appropriate, illustrative examples, for instance on the limitations and on  the intended and precluded uses of the AI system, should be included. Providers should ensure that all  documentation, including the instructions for use, contains meaningful, comprehensive, accessible and  understandable information, taking into account the needs and foreseeable knowledge of the target deployers.  Instructions for use should be made available in a language which can be easily understood by target deployers, as  determined by the Member State concerned.
High-risk AI systems should be designed and developed in such a way that natural persons can oversee their  functioning, ensure that they are used as intended and that their impacts are addressed over the system’s lifecycle. To  that end, appropriate human oversight measures should be identified by the provider of the system before its placing  on the market or putting into service. In particular, where appropriate, such measures should guarantee that the  system is subject to in-built operational constraints that cannot be overridden by the system itself and is responsive  to the human operator, and that the natural persons to whom human oversight has been assigned have the necessary  competence, training and authority to carry out that role. It is also essential, as appropriate, to ensure that high-risk  AI systems include mechanisms to guide and inform a natural person to whom human oversight has been assigned  to make informed decisions if, when and how to intervene in order to avoid negative consequences or risks, or stop  the system if it does not perform as intended. Considering the significant consequences for persons in the case of an  incorrect match by certain biometric identification systems, it is appropriate to provide for an enhanced human  oversight requirement for those systems so that no action or decision may be taken by the deployer on the basis of  the identification resulting from the system unless this has been separately verified and confirmed by at least two  natural persons. Those persons could be from one or more entities and include the person operating or using the  system. This requirement should not pose unnecessary burden or delays and it could be sufficient that the separate  verifications by the different persons are automatically recorded in the logs generated by the system. Given the  specificities of the areas of law enforcement, migration, border control and asylum, this requirement should not  apply where Union or national law considers the application of that requirement to be disproportionate.
High-risk AI systems should perform consistently throughout their lifecycle and meet an appropriate level of  accuracy, robustness and cybersecurity, in light of their intended purpose and in accordance with the generally  acknowledged state of the art. The Commission and relevant organisations and stakeholders are encouraged to take  due consideration of the mitigation of risks and the negative impacts of the AI system. The expected level of  performance metrics should be declared in the accompanying instructions of use. Providers are urged to  communicate that information to deployers in a clear and easily understandable way, free of misunderstandings or  misleading statements. Union law on legal metrology, including Directives 2014/31/EU (35) and 2014/32/EU (36) of  the European Parliament and of the Council, aims to ensure the accuracy of measurements and to help the  transparency and fairness of commercial transactions. In that context, in cooperation with relevant stakeholders and  organisation, such as metrology and benchmarking authorities, the Commission should encourage, as appropriate,  the development of benchmarks and measurement methodologies for AI systems. In doing so, the Commission  should take note and collaborate with international partners working on metrology and relevant measurement  indicators relating to AI.
Technical robustness is a key requirement for high-risk AI systems. They should be resilient in relation to harmful or  otherwise undesirable behaviour that may result from limitations within the systems or the environment in which  the systems operate (e.g. errors, faults, inconsistencies, unexpected situations). Therefore, technical and  organisational measures should be taken to ensure robustness of high-risk AI systems, for example by designing  and developing appropriate technical solutions to prevent or minimise harmful or otherwise undesirable behaviour.  Those technical solutions may include for instance mechanisms enabling the system to safely interrupt its operation (fail-safe plans) in the presence of certain anomalies or when operation takes place outside certain predetermined  boundaries. Failure to protect against these risks could lead to safety impacts or negatively affect the fundamental  rights, for example due to erroneous decisions or wrong or biased outputs generated by the AI system.
Cybersecurity plays a crucial role in ensuring that AI systems are resilient against attempts to alter their use,  behaviour, performance or compromise their security properties by malicious third parties exploiting the system’s  vulnerabilities. Cyberattacks against AI systems can leverage AI specific assets, such as training data sets (e.g. data  poisoning) or trained models (e.g. adversarial attacks or membership inference), or exploit vulnerabilities in the AI  system’s digital assets or the underlying ICT infrastructure. To ensure a level of cybersecurity appropriate to the risks,  suitable measures, such as security controls, should therefore be taken by the providers of high-risk AI systems, also  taking into account as appropriate the underlying ICT infrastructure.
Without prejudice to the requirements related to robustness and accuracy set out in this Regulation, high-risk AI  systems which fall within the scope of a regulation of the European Parliament and of the Council on horizontal  cybersecurity requirements for products with digital elements, in accordance with that regulation may demonstrate  compliance with the cybersecurity requirements of this Regulation by fulfilling the essential cybersecurity  requirements set out in that regulation. When high-risk AI systems fulfil the essential requirements of a regulation of  the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital  elements, they should be deemed compliant with the cybersecurity requirements set out in this Regulation in so far  as the achievement of those requirements is demonstrated in the EU declaration of conformity or parts thereof  issued under that regulation. To that end, the assessment of the cybersecurity risks, associated to a product with  digital elements classified as high-risk AI system according to this Regulation, carried out under a regulation of the  European Parliament and of the Council on horizontal cybersecurity requirements for products with digital  elements, should consider risks to the cyber resilience of an AI system as regards attempts by unauthorised third  parties to alter its use, behaviour or performance, including AI specific vulnerabilities such as data poisoning or  adversarial attacks, as well as, as relevant, risks to fundamental rights as required by this Regulation.
The conformity assessment procedure provided by this Regulation should apply in relation to the essential  cybersecurity requirements of a product with digital elements covered by a regulation of the European Parliament  and of the Council on horizontal cybersecurity requirements for products with digital elements and classified as  a high-risk AI system under this Regulation. However, this rule should not result in reducing the necessary level of  assurance for critical products with digital elements covered by a regulation of the European Parliament and of the  Council on horizontal cybersecurity requirements for products with digital elements. Therefore, by way of  derogation from this rule, high-risk AI systems that fall within the scope of this Regulation and are also qualified as  important and critical products with digital elements pursuant to a regulation of the European Parliament and of the  Council on horizontal cybersecurity requirements for products with digital elements and to which the conformity  assessment procedure based on internal control set out in an annex to this Regulation applies, are subject to the  conformity assessment provisions of a regulation of the European Parliament and of the Council on horizontal  cybersecurity requirements for products with digital elements insofar as the essential cybersecurity requirements of  that regulation are concerned. In this case, for all the other aspects covered by this Regulation the respective  provisions on conformity assessment based on internal control set out in an annex to this Regulation should apply.  Building on the knowledge and expertise of ENISA on the cybersecurity policy and tasks assigned to ENISA under  the Regulation (EU) 2019/881 of the European Parliament and of the Council (37), the Commission should cooperate with ENISA on issues related to cybersecurity of AI systems.