rticle 79(1), they shall, without undue delay, inform the provider or distributor and the relevant market surveillance
authority, and shall suspend the use of that system. Where deployers have identified a serious incident, they shall also
immediately inform first the provider, and then the importer or distributor and the relevant market surveillance authorities
of that incident. If the deployer is not able to reach the provider, Article 73 shall apply mutatis mutandis. This obligation
shall not cover sensitive operational data of deployers of AI systems which are law enforcement authorities.
For deployers that are financial institutions subject to requirements regarding their internal governance, arrangements or
processes under Union financial services law, the monitoring obligation set out in the first subparagraph shall be deemed to
be fulfilled by complying with the rules on internal governance arrangements, processes and mechanisms pursuant to the
relevant financial service law.
6. Deployers of high-risk AI systems shall keep the logs automatically generated by that high-risk AI system to the extent
such logs are under their control, for a period appropriate to the intended purpose of the high-risk AI system, of at least six
months, unless provided otherwise in applicable Union or national law, in particular in Union law on the protection of
personal data.
Deployers that are financial institutions subject to requirements regarding their internal governance, arrangements


ion or national law, in particular in Union law on the protection of
personal data.
Deployers that are financial institutions subject to requirements regarding their internal governance, arrangements or
processes under Union financial services law shall maintain the logs as part of the documentation kept pursuant to the
relevant Union financial service law.
7. Before putting into service or using a high-risk AI system at the workplace, deployers who are employers shall inform
workers’ representatives and the affected workers that they will be subject to the use of the high-risk AI system. This
information shall be provided, where applicable, in accordance with the rules and procedures laid down in Union and
national law and practice on information of workers and their representatives.
8. Deployers of high-risk AI systems that are public authorities, or Union institutions, bodies, offices or agencies shall
comply with the registration obligations referred to in Article 49. When such deployers find that the high-risk AI system
that they envisage using has not been registered in the EU database referred to in Article 71, they shall not use that system
and shall inform the provider or the distributor.
9. Where applicable, deployers of high-risk AI systems shall use the information provided under Article 13 of this
Regulation to comply with their obligation to carry out a data protection impact assessment under Article 35 of Regulation
(EU) 2016/679 or Article 27 of Directive (EU)

Article 26 - Obligations of deployers of high-risk AI systems


ovided under Article 13 of this
Regulation to comply with their obligation to carry out a data protection impact assessment under Article 35 of Regulation
(EU) 2016/679 or Article 27 of Directive (EU) 2016/680.
10. Without prejudice to Directive (EU) 2016/680, in the framework of an investigation for the targeted search of
a person suspected or convicted of having committed a criminal offence, the deployer of a high-risk AI system for
post-remote biometric identification shall request an authorisation, ex ante, or without undue delay and no later than 48
hours, by a judicial authority or an administrative authority whose decision is binding and subject to judicial review, for the
use of that system, except when it is used for the initial identification of a potential suspect based on objective and verifiable
facts directly linked to the offence. Each use shall be limited to what is strictly necessary for the investigation of a specific
criminal offence.
If the authorisation requested pursuant to the first subparagraph is rejected, the use of the post-remote biometric
identification system linked to that requested authorisation shall be stopped with immediate effect and the personal data
linked to the use of the high-risk AI system for which the authorisation was requested shall be deleted.
In no case shall such high-risk AI system for post-remote biometric identification be used for law enforcement purposes in
an untargeted way, without any link to a criminal offence, a crimi


e deleted.
In no case shall such high-risk AI system for post-remote biometric identification be used for law enforcement purposes in
an untargeted way, without any link to a criminal offence, a criminal proceeding, a genuine and present or genuine and
foreseeable threat of a criminal offence, or the search for a specific missing person. It shall be ensured that no decision that
produces an adverse legal effect on a person may be taken by the law enforcement authorities based solely on the output of
such post-remote biometric identification systems.
This paragraph is without prejudice to Article 9 of Regulation (EU) 2016/679 and Article 10 of Directive (EU) 2016/680
for the processing of biometric data.
Regardless of the purpose or deployer, each use of such high-risk AI systems shall be documented in the relevant police file
and shall be made available to the relevant market surveillance authority and the national data protection authority upon
request, excluding the disclosure of sensitive operational data related to law enforcement. This subparagraph shall be
without prejudice to the powers conferred by Directive (EU) 2016/680 on supervisory authorities.
Deployers shall submit annual reports to the relevant market surveillance and national data protection authorities on their
use of post-remote biometric identification systems, excluding the disclosure of sensitive operational data related to law
enforcement. The reports may be aggregated to cover more than one deployment.


use of post-remote biometric identification systems, excluding the disclosure of sensitive operational data related to law
enforcement. The reports may be aggregated to cover more than one deployment.
Member States may introduce, in accordance with Union law, more restrictive laws on the use of post-remote biometric
identification systems.
11. Without prejudice to Article 50 of this Regulation, deployers of high-risk AI systems referred to in Annex III that
make decisions or assist in making decisions related to natural persons shall inform the natural persons that they are subject
to the use of the high-risk AI system. For high-risk AI systems used for law enforcement purposes Article 13 of Directive
(EU) 2016/680 shall apply.
12. Deployers shall cooperate with the relevant competent authorities in any action those authorities take in relation to
the high-risk AI system in order to implement this Regulation.


Article 27 - Fundamental rights impact assessment for high-risk AI systems

1. Prior to deploying a high-risk AI system referred to in Article 6(2), with the exception of high-risk AI systems
intended to be used in the area listed in point 2 of Annex III, deployers that are bodies governed by public law, or are private
entities providing public services, and deployers of high-risk AI systems referred to in points 5 (b) and (c) of Annex III, shall
perform an assessment of the impact on fundamental rights that the use of such system may produce. For that purpose,
deployers shall perform an assessment consisting of:
(a) a description of the deployer’s processes in which the high-risk AI system will be used in line with its intended purpose;
(b) a description of the period of time within which, and the frequency with which, each high-risk AI system is intended to
be used;
(c) the categories of natural persons and groups likely to be affected by its use in the specific context;
(d) the specific risks of harm likely to have an impact on the categories of natural persons or groups of persons identified
pursuant to point (c) of this paragraph, taking into account the information given by the provider pursuant to
Article 13;
(e) a description of the implementation of human oversight measures, according to the instructions for use;
(f) the measures to be taken in the case of the materialisation of those risks, including the arrangements for internal
governance and complaint mechanisms.
2. The obligation laid down in paragraph 1 applies to the first use of the


the case of the materialisation of those risks, including the arrangements for internal
governance and complaint mechanisms.
2. The obligation laid down in paragraph 1 applies to the first use of the high-risk AI system. The deployer may, in
similar cases, rely on previously conducted fundamental rights impact assessments or existing impact assessments carried
out by provider. If, during the use of the high-risk AI system, the deployer considers that any of the elements listed in
paragraph 1 has changed or is no longer up to date, the deployer shall take the necessary steps to update the information.
3. Once the assessment referred to in paragraph 1 of this Article has been performed, the deployer shall notify the
market surveillance authority of its results, submitting the filled-out template referred to in paragraph 5 of this Article as
part of the notification. In the case referred to in Article 46(1), deployers may be exempt from that obligation to notify.
4. If any of the obligations laid down in this Article is already met through the data protection impact assessment
conducted pursuant to Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680, the fundamental
rights impact assessment referred to in paragraph 1 of this Article shall complement that data protection impact
assessment.
5. The AI Office shall develop a template for a questionnaire, including through an automated tool, to facilitate deployers
in complying with their obligations under


data protection impact
assessment.
5. The AI Office shall develop a template for a questionnaire, including through an automated tool, to facilitate deployers
in complying with their obligations under this Article in a simplified manner.


Article 28 - Notifying authorities

1. Each Member State shall designate or establish at least one notifying authority responsible for setting up and carrying
out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and for their
monitoring. Those procedures shall be developed in cooperation between the notifying authorities of all Member States.
2. Member States may decide that the assessment and monitoring referred to in paragraph 1 is to be carried out by
a national accreditation body within the meaning of, and in accordance with, Regulation (EC) No 765/2008.
3. Notifying authorities shall be established, organised and operated in such a way that no conflict of interest arises with
conformity assessment bodies, and that the objectivity and impartiality of their activities are safeguarded.
4. Notifying authorities shall be organised in such a way that decisions relating to the notification of conformity
assessment bodies are taken by competent persons different from those who carried out the assessment of those bodies.
5. Notifying authorities shall offer or provide neither any activities that conformity assessment bodies perform, nor any
consultancy services on a commercial or competitive basis.
6. Notifying authorities shall safeguard the confidentiality of the information that they obtain, in accordance with
Article 78.
7. Notifying authorities shall have an adequate number of competent personnel at their disposal for the proper
performance of their task

Article 28 - Notifying authorities


he information that they obtain, in accordance with
Article 78.
7. Notifying authorities shall have an adequate number of competent personnel at their disposal for the proper
performance of their tasks. Competent personnel shall have the necessary expertise, where applicable, for their function, in
fields such as information technologies, AI and law, including the supervision of fundamental rights.

Article 28 - Notifying authorities


Article 29 - Application of a conformity assessment body for notification

1. Conformity assessment bodies shall submit an application for notification to the notifying authority of the Member
State in which they are established.
2. The application for notification shall be accompanied by a description of the conformity assessment activities, the
conformity assessment module or modules and the types of AI systems for which the conformity assessment body claims
to be competent, as well as by an accreditation certificate, where one exists, issued by a national accreditation body attesting
that the conformity assessment body fulfils the requirements laid down in Article 31.
Any valid document related to existing designations of the applicant notified body under any other Union harmonisation
legislation shall be added.
3. Where the conformity assessment body concerned cannot provide an accreditation certificate, it shall provide the
notifying authority with all the documentary evidence necessary for the verification, recognition and regular monitoring of
its compliance with the requirements laid down in Article 31.
4. For notified bodies which are designated under any other Union harmonisation legislation, all documents and
certificates linked to those designations may be used to support their designation procedure under this Regulation, as
appropriate. The notified body shall update the documentation referred to in paragraphs 2 and 3 of this Article whenever
relevant changes occur, in order to enable the authority responsible for notified bodies to mon


notified body shall update the documentation referred to in paragraphs 2 and 3 of this Article whenever
relevant changes occur, in order to enable the authority responsible for notified bodies to monitor and verify continuous
compliance with all the requirements laid down in Article 31.


Article 30 - Notification procedure

1. Notifying authorities may notify only conformity assessment bodies which have satisfied the requirements laid down
in Article 31.
2. Notifying authorities shall notify the Commission and the other Member States, using the electronic notification tool
developed and managed by the Commission, of each conformity assessment body referred to in paragraph 1.
3. The notification referred to in paragraph 2 of this Article shall include full details of the conformity assessment
activities, the conformity assessment module or modules, the types of AI systems concerned, and the relevant attestation of
competence. Where a notification is not based on an accreditation certificate as referred to in Article 29(2), the notifying
authority shall provide the Commission and the other Member States with documentary evidence which attests to the
competence of the conformity assessment body and to the arrangements in place to ensure that that body will be
monitored regularly and will continue to satisfy the requirements laid down in Article 31.
4. The conformity assessment body concerned may perform the activities of a notified body only where no objections
are raised by the Commission or the other Member States within two weeks of a notification by a notifying authority where
it includes an accreditation certificate referred to in Article 29(2), or within two months of a notification by the notifying
authority where it includes documentary evidence referred to in Article 29(3).
5. Where object

Article 30 - Notification procedure


itation certificate referred to in Article 29(2), or within two months of a notification by the notifying
authority where it includes documentary evidence referred to in Article 29(3).
5. Where objections are raised, the Commission shall, without delay, enter into consultations with the relevant Member
States and the conformity assessment body. In view thereof, the Commission shall decide whether the authorisation is
justified. The Commission shall address its decision to the Member State concerned and to the relevant conformity
assessment body.

Article 30 - Notification procedure


Article 31 - Requirements relating to notified bodies

1. A notified body shall be established under the national law of a Member State and shall have legal personality.
2. Notified bodies shall satisfy the organisational, quality management, resources and process requirements that are
necessary to fulfil their tasks, as well as suitable cybersecurity requirements.
3. The organisational structure, allocation of responsibilities, reporting lines and operation of notified bodies shall
ensure confidence in their performance, and in the results of the conformity assessment activities that the notified bodies
conduct.
4. Notified bodies shall be independent of the provider of a high-risk AI system in relation to which they perform
conformity assessment activities. Notified bodies shall also be independent of any other operator having an economic
interest in high-risk AI systems assessed, as well as of any competitors of the provider. This shall not preclude the use of
assessed high-risk AI systems that are necessary for the operations of the conformity assessment body, or the use of such
high-risk AI systems for personal purposes.
5. Neither a conformity assessment body, its top-level management nor the personnel responsible for carrying out its
conformity assessment tasks shall be directly involved in the design, development, marketing or use of high-risk AI systems,
nor shall they represent the parties engaged in those activities. They shall not engage in any activity that might conflict with
their independence of judgement or integ


r use of high-risk AI systems,
nor shall they represent the parties engaged in those activities. They shall not engage in any activity that might conflict with
their independence of judgement or integrity in relation to conformity assessment activities for which they are notified.
This shall, in particular, apply to consultancy services.
6. Notified bodies shall be organised and operated so as to safeguard the independence, objectivity and impartiality of
their activities. Notified bodies shall document and implement a structure and procedures to safeguard impartiality and to
promote and apply the principles of impartiality throughout their organisation, personnel and assessment activities.
7. Notified bodies shall have documented procedures in place ensuring that their personnel, committees, subsidiaries,
subcontractors and any associated body or personnel of external bodies maintain, in accordance with Article 78, the
confidentiality of the information which comes into their possession during the performance of conformity assessment
activities, except when its disclosure is required by law. The staff of notified bodies shall be bound to observe professional
secrecy with regard to all information obtained in carrying out their tasks under this Regulation, except in relation to the
notifying authorities of the Member State in which their activities are carried out.
8. Notified bodies shall have procedures for the performance of activities which take due account of the size of


he
notifying authorities of the Member State in which their activities are carried out.
8. Notified bodies shall have procedures for the performance of activities which take due account of the size of
a provider, the sector in which it operates, its structure, and the degree of complexity of the AI system concerned.
9. Notified bodies shall take out appropriate liability insurance for their conformity assessment activities, unless liability
is assumed by the Member State in which they are established in accordance with national law or that Member State is itself
directly responsible for the conformity assessment.
10. Notified bodies shall be capable of carrying out all their tasks under this Regulation with the highest degree of
professional integrity and the requisite competence in the specific field, whether those tasks are carried out by notified
bodies themselves or on their behalf and under their responsibility.
11. Notified bodies shall have sufficient internal competences to be able effectively to evaluate the tasks conducted by
external parties on their behalf. The notified body shall have permanent availability of sufficient administrative, technical,
legal and scientific personnel who possess experience and knowledge relating to the relevant types of AI systems, data and
data computing, and relating to the requirements set out in Section 2.
12. Notified bodies shall participate in coordination activities as referred to in Article 38. They shall also take part
direct


d
data computing, and relating to the requirements set out in Section 2.
12. Notified bodies shall participate in coordination activities as referred to in Article 38. They shall also take part
directly, or be represented in, European standardisation organisations, or ensure that they are aware and up to date in
respect of relevant standards.


Article 32 - Presumption of conformity with requirements relating to notified bodies

Where a conformity assessment body demonstrates its conformity with the criteria laid down in the relevant harmonised
standards or parts thereof, the references of which have been published in the Official Journal of the European Union, it shall
be presumed to comply with the requirements set out in Article 31 in so far as the applicable harmonised standards cover
those requirements.


Article 33 - Subsidiaries of notified bodies and subcontracting

1. Where a notified body subcontracts specific tasks connected with the conformity assessment or has recourse to
a subsidiary, it shall ensure that the subcontractor or the subsidiary meets the requirements laid down in Article 31, and
shall inform the notifying authority accordingly.
2. Notified bodies shall take full responsibility for the tasks performed by any subcontractors or subsidiaries.
3. Activities may be subcontracted or carried out by a subsidiary only with the agreement of the provider. Notified
bodies shall make a list of their subsidiaries publicly available.
4. The relevant documents concerning the assessment of the qualifications of the subcontractor or the subsidiary and
the work carried out by them under this Regulation shall be kept at the disposal of the notifying authority for a period of
five years from the termination date of the subcontracting.


Article 34 - Operational obligations of notified bodies

1. Notified bodies shall verify the conformity of high-risk AI systems in accordance with the conformity assessment
procedures set out in Article 43.
2. Notified bodies shall avoid unnecessary burdens for providers when performing their activities, and take due account
of the size of the provider, the sector in which it operates, its structure and the degree of complexity of the high-risk AI
system concerned, in particular in view of minimising administrative burdens and compliance costs for micro- and small
enterprises within the meaning of Recommendation 2003/361/EC. The notified body shall, nevertheless, respect the degree
of rigour and the level of protection required for the compliance of the high-risk AI system with the requirements of this
Regulation.
3. Notified bodies shall make available and submit upon request all relevant documentation, including the providers’
documentation, to the notifying authority referred to in Article 28 to allow that authority to conduct its assessment,
designation, notification and monitoring activities, and to facilitate the assessment outlined in this Section.


Article 35 - Identification numbers and lists of notified bodies

1. The Commission shall assign a single identification number to each notified body, even where a body is notified under
more than one Union act.
2. The Commission shall make publicly available the list of the bodies notified under this Regulation, including their
identification numbers and the activities for which they have been notified. The Commission shall ensure that the list is kept
up to date.


Article 36 - Changes to notifications

1. The notifying authority shall notify the Commission and the other Member States of any relevant changes to the
notification of a notified body via the electronic notification tool referred to in Article 30(2).
2. The procedures laid down in Articles 29 and 30 shall apply to extensions of the scope of the notification.
For changes to the notification other than extensions of its scope, the procedures laid down in paragraphs (3) to (9) shall
apply.
3. Where a notified body decides to cease its conformity assessment activities, it shall inform the notifying authority and
the providers concerned as soon as possible and, in the case of a planned cessation, at least one year before ceasing its
activities. The certificates of the notified body may remain valid for a period of nine months after cessation of the notified
body’s activities, on condition that another notified body has confirmed in writing that it will assume responsibilities for the
high-risk AI systems covered by those certificates. The latter notified body shall complete a full assessment of the high-risk
AI systems affected by the end of that nine-month-period before issuing new certificates for those systems. Where the
notified body has ceased its activity, the notifying authority shall withdraw the designation.
4. Where a notifying authority has sufficient reason to consider that a notified body no longer meets the requirements
laid down in Article 31, or that it is failing to fulfil its obligations, the notifyi

Article 36 - Changes to notifications


here a notifying authority has sufficient reason to consider that a notified body no longer meets the requirements
laid down in Article 31, or that it is failing to fulfil its obligations, the notifying authority shall without delay investigate the
matter with the utmost diligence. In that context, it shall inform the notified body concerned about the objections raised
and give it the possibility to make its views known. If the notifying authority comes to the conclusion that the notified body
no longer meets the requirements laid down in Article 31 or that it is failing to fulfil its obligations, it shall restrict, suspend
or withdraw the designation as appropriate, depending on the seriousness of the failure to meet those requirements or fulfil
those obligations. It shall immediately inform the Commission and the other Member States accordingly.
5. Where its designation has been suspended, restricted, or fully or partially withdrawn, the notified body shall inform
the providers concerned within 10 days.
6. In the event of the restriction, suspension or withdrawal of a designation, the notifying authority shall take
appropriate steps to ensure that the files of the notified body concerned are kept, and to make them available to notifying
authorities in other Member States and to market surveillance authorities at their request.
7. In the event of the restriction, suspension or withdrawal of a designation, the notifying authority shall:
(a) assess the impact on the certificat

Article 36 - Changes to notifications


market surveillance authorities at their request.
7. In the event of the restriction, suspension or withdrawal of a designation, the notifying authority shall:
(a) assess the impact on the certificates issued by the notified body;
(b) submit a report on its findings to the Commission and the other Member States within three months of having notified
the changes to the designation;
(c) require the notified body to suspend or withdraw, within a reasonable period of time determined by the authority, any
certificates which were unduly issued, in order to ensure the continuing conformity of high-risk AI systems on the
market;
(d) inform the Commission and the Member States about certificates the suspension or withdrawal of which it has required;
(e) provide the national competent authorities of the Member State in which the provider has its registered place of
business with all relevant information about the certificates of which it has required the suspension or withdrawal; that
authority shall take the appropriate measures, where necessary, to avoid a potential risk to health, safety or fundamental
rights.
8. With the exception of certificates unduly issued, and where a designation has been suspended or restricted, the
certificates shall remain valid in one of the following circumstances:
(a) the notifying authority has confirmed, within one month of the suspension or restriction, that there is no risk to health,
safety or fundamental rights in relation to certificates affected

Article 36 - Changes to notifications


tances:
(a) the notifying authority has confirmed, within one month of the suspension or restriction, that there is no risk to health,
safety or fundamental rights in relation to certificates affected by the suspension or restriction, and the notifying
authority has outlined a timeline for actions to remedy the suspension or restriction; or
(b) the notifying authority has confirmed that no certificates relevant to the suspension will be issued, amended or re-issued
during the course of the suspension or restriction, and states whether the notified body has the capability of continuing
to monitor and remain responsible for existing certificates issued for the period of the suspension or restriction; in the
event that the notifying authority determines that the notified body does not have the capability to support existing
certificates issued, the provider of the system covered by the certificate shall confirm in writing to the national
competent authorities of the Member State in which it has its registered place of business, within three months of the
suspension or restriction, that another qualified notified body is temporarily assuming the functions of the notified
body to monitor and remain responsible for the certificates during the period of suspension or restriction.
9. With the exception of certificates unduly issued, and where a designation has been withdrawn, the certificates shall
remain valid for a period of nine months under the following circumstances:
(a) the na

Article 36 - Changes to notifications


h the exception of certificates unduly issued, and where a designation has been withdrawn, the certificates shall
remain valid for a period of nine months under the following circumstances:
(a) the national competent authority of the Member State in which the provider of the high-risk AI system covered by the
certificate has its registered place of business has confirmed that there is no risk to health, safety or fundamental rights
associated with the high-risk AI systems concerned; and
(b) another notified body has confirmed in writing that it will assume immediate responsibility for those AI systems and
completes its assessment within 12 months of the withdrawal of the designation.
In the circumstances referred to in the first subparagraph, the national competent authority of the Member State in which
the provider of the system covered by the certificate has its place of business may extend the provisional validity of the
certificates for additional periods of three months, which shall not exceed 12 months in total.
The national competent authority or the notified body assuming the functions of the notified body affected by the change
of designation shall immediately inform the Commission, the other Member States and the other notified bodies thereof.

Article 36 - Changes to notifications


Article 37 - Challenge to the competence of notified bodies

1. The Commission shall, where necessary, investigate all cases where there are reasons to doubt the competence of
a notified body or the continued fulfilment by a notified body of the requirements laid down in Article 31 and of its
applicable responsibilities.
2. The notifying authority shall provide the Commission, on request, with all relevant information relating to the
notification or the maintenance of the competence of the notified body concerned.
3. The Commission shall ensure that all sensitive information obtained in the course of its investigations pursuant to this
Article is treated confidentially in accordance with Article 78.
4. Where the Commission ascertains that a notified body does not meet or no longer meets the requirements for its
notification, it shall inform the notifying Member State accordingly and request it to take the necessary corrective measures,
including the suspension or withdrawal of the notification if necessary. Where the Member State fails to take the necessary
corrective measures, the Commission may, by means of an implementing act, suspend, restrict or withdraw the designation.
That implementing act shall be adopted in accordance with the examination procedure referred to in Article 98(2).


Article 38 - Coordination of notified bodies

1. The Commission shall ensure that, with regard to high-risk AI systems, appropriate coordination and cooperation
between notified bodies active in the conformity assessment procedures pursuant to this Regulation are put in place and
properly operated in the form of a sectoral group of notified bodies.
2. Each notifying authority shall ensure that the bodies notified by it participate in the work of a group referred to in
paragraph 1, directly or through designated representatives.
3. The Commission shall provide for the exchange of knowledge and best practices between notifying authorities.


Article 39 - Conformity assessment bodies of third countries

Conformity assessment bodies established under the law of a third country with which the Union has concluded an
agreement may be authorised to carry out the activities of notified bodies under this Regulation, provided that they meet
the requirements laid down in Article 31 or they ensure an equivalent level of compliance.


Article 40 - Harmonised standards and standardisation deliverables

1. High-risk AI systems or general-purpose AI models which are in conformity with harmonised standards or parts
thereof the references of which have been published in the Official Journal of the European Union in accordance with
Regulation (EU) No 1025/2012 shall be presumed to be in conformity with the requirements set out in Section 2 of this
Chapter or, as applicable, with the obligations set out in of Chapter V, Sections 2 and 3, of this Regulation, to the extent that
those standards cover those requirements or obligations.
2. In accordance with Article 10 of Regulation (EU) No 1025/2012, the Commission shall issue, without undue delay,
standardisation requests covering all requirements set out in Section 2 of this Chapter and, as applicable, standardisation
requests covering obligations set out in Chapter V, Sections 2 and 3, of this Regulation. The standardisation request shall
also ask for deliverables on reporting and documentation processes to improve AI systems’ resource performance, such as
reducing the high-risk AI system’s consumption of energy and of other resources during its lifecycle, and on the
energy-efficient development of general-purpose AI models. When preparing a standardisation request, the Commission
shall consult the Board and relevant stakeholders, including the advisory forum.
When issuing a standardisation request to European standardisation organisations, the Commission shall specify that
standards have to be clear, consistent, including with th


luding the advisory forum.
When issuing a standardisation request to European standardisation organisations, the Commission shall specify that
standards have to be clear, consistent, including with the standards developed in the various sectors for products covered by
the existing Union harmonisation legislation listed in Annex I, and aiming to ensure that high-risk AI systems or
general-purpose AI models placed on the market or put into service in the Union meet the relevant requirements or
obligations laid down in this Regulation.
The Commission shall request the European standardisation organisations to provide evidence of their best efforts to fulfil
the objectives referred to in the first and the second subparagraph of this paragraph in accordance with Article 24 of
Regulation (EU) No 1025/2012.
3. The participants in the standardisation process shall seek to promote investment and innovation in AI, including
through increasing legal certainty, as well as the competitiveness and growth of the Union market, to contribute to
strengthening global cooperation on standardisation and taking into account existing international standards in the field of
AI that are consistent with Union values, fundamental rights and interests, and to enhance multi-stakeholder governance
ensuring a balanced representation of interests and the effective participation of all relevant stakeholders in accordance with
Articles 5, 6, and 7 of Regulation (EU) No 1025/2012.


balanced representation of interests and the effective participation of all relevant stakeholders in accordance with
Articles 5, 6, and 7 of Regulation (EU) No 1025/2012.


Article 41 - Common specifications

1. The Commission may adopt, implementing acts establishing common specifications for the requirements set out in
Section 2 of this Chapter or, as applicable, for the obligations set out in Sections 2 and 3 of Chapter V where the following
conditions have been fulfilled:
(a) the Commission has requested, pursuant to Article 10(1) of Regulation (EU) No 1025/2012, one or more European
standardisation organisations to draft a harmonised standard for the requirements set out in Section 2 of this Chapter,
or, as applicable, for the obligations set out in Sections 2 and 3 of Chapter V, and:
(i) the request has not been accepted by any of the European standardisation organisations; or
(ii) the harmonised standards addressing that request are not delivered within the deadline set in accordance with
Article 10(1) of Regulation (EU) No 1025/2012; or
(iii) the relevant harmonised standards insufficiently address fundamental rights concerns; or
(iv) the harmonised standards do not comply with the request; and
(b) no reference to harmonised standards covering the requirements referred to in Section 2 of this Chapter or, as
applicable, the obligations referred to in Sections 2 and 3 of Chapter V has been published in the Official Journal of the
European Union in accordance with Regulation (EU) No 1025/2012, and no such reference is expected to be published
within a reasonable period.
When drafting the common specifications, the Commission shall consult the advisory forum referred to in Art

Article 41 - Common specifications


No 1025/2012, and no such reference is expected to be published
within a reasonable period.
When drafting the common specifications, the Commission shall consult the advisory forum referred to in Article 67.
The implementing acts referred to in the first subparagraph of this paragraph shall be adopted in accordance with the
examination procedure referred to in Article 98(2).
2. Before preparing a draft implementing act, the Commission shall inform the committee referred to in Article 22 of
Regulation (EU) No 1025/2012 that it considers the conditions laid down in paragraph 1 of this Article to be fulfilled.
3. High-risk AI systems or general-purpose AI models which are in conformity with the common specifications referred
to in paragraph 1, or parts of those specifications, shall be presumed to be in conformity with the requirements set out in
Section 2 of this Chapter or, as applicable, to comply with the obligations referred to in Sections 2 and 3 of Chapter V, to
the extent those common specifications cover those requirements or those obligations.
4. Where a harmonised standard is adopted by a European standardisation organisation and proposed to the
Commission for the publication of its reference in the Official Journal of the European Union, the Commission shall assess the
harmonised standard in accordance with Regulation (EU) No 1025/2012. When reference to a harmonised standard is
published in the Official Journal of the European Union, the Commission shall repeal the

Article 41 - Common specifications


harmonised standard in accordance with Regulation (EU) No 1025/2012. When reference to a harmonised standard is
published in the Official Journal of the European Union, the Commission shall repeal the implementing acts referred to in
paragraph 1, or parts thereof which cover the same requirements set out in Section 2 of this Chapter or, as applicable, the
same obligations set out in Sections 2 and 3 of Chapter V.
5. Where providers of high-risk AI systems or general-purpose AI models do not comply with the common
specifications referred to in paragraph 1, they shall duly justify that they have adopted technical solutions that meet the
requirements referred to in Section 2 of this Chapter or, as applicable, comply with the obligations set out in Sections 2 and
3 of Chapter V to a level at least equivalent thereto.
6. Where a Member State considers that a common specification does not entirely meet the requirements set out in
Section 2 or, as applicable, comply with obligations set out in Sections 2 and 3 of Chapter V, it shall inform the
Commission thereof with a detailed explanation. The Commission shall assess that information and, if appropriate, amend
the implementing act establishing the common specification concerned.

Article 41 - Common specifications


Article 42 - Presumption of conformity with certain requirements

1. High-risk AI systems that have been trained and tested on data reflecting the specific geographical, behavioural,
contextual or functional setting within which they are intended to be used shall be presumed to comply with the relevant
requirements laid down in Article 10(4).
2. High-risk AI systems that have been certified or for which a statement of conformity has been issued under
a cybersecurity scheme pursuant to Regulation (EU) 2019/881 and the references of which have been published in the
Official Journal of the European Union shall be presumed to comply with the cybersecurity requirements set out in Article 15
of this Regulation in so far as the cybersecurity certificate or statement of conformity or parts thereof cover those
requirements.


Article 43 - Conformity assessment

1. For high-risk AI systems listed in point 1 of Annex III, where, in demonstrating the compliance of a high-risk AI
system with the requirements set out in Section 2, the provider has applied harmonised standards referred to in Article 40,
or, where applicable, common specifications referred to in Article 41, the provider shall opt for one of the following
conformity assessment procedures based on:
(a) the internal control referred to in Annex VI; or
(b) the assessment of the quality management system and the assessment of the technical documentation, with the
involvement of a notified body, referred to in Annex VII.
In demonstrating the compliance of a high-risk AI system with the requirements set out in Section 2, the provider shall
follow the conformity assessment procedure set out in Annex VII where:
(a) harmonised standards referred to in Article 40 do not exist, and common specifications referred to in Article 41 are not
available;
(b) the provider has not applied, or has applied only part of, the harmonised standard;
(c) the common specifications referred to in point (a) exist, but the provider has not applied them;
(d) one or more of the harmonised standards referred to in point (a) has been published with a restriction, and only on the
part of the standard that was restricted.
For the purposes of the conformity assessment procedure referred to in Annex VII, the provider may choose any of the
notified bodies. However, where the high-risk AI system is intended to be p

Article 43 - Conformity assessment


ricted.
For the purposes of the conformity assessment procedure referred to in Annex VII, the provider may choose any of the
notified bodies. However, where the high-risk AI system is intended to be put into service by law enforcement, immigration
or asylum authorities or by Union institutions, bodies, offices or agencies, the market surveillance authority referred to in
Article 74(8) or (9), as applicable, shall act as a notified body.
2. For high-risk AI systems referred to in points 2 to 8 of Annex III, providers shall follow the conformity assessment
procedure based on internal control as referred to in Annex VI, which does not provide for the involvement of a notified
body.
3. For high-risk AI systems covered by the Union harmonisation legislation listed in Section A of Annex I, the provider
shall follow the relevant conformity assessment procedure as required under those legal acts. The requirements set out in
Section 2 of this Chapter shall apply to those high-risk AI systems and shall be part of that assessment. Points 4.3., 4.4., 4.5.
and the fifth paragraph of point 4.6 of Annex VII shall also apply.
For the purposes of that assessment, notified bodies which have been notified under those legal acts shall be entitled to
control the conformity of the high-risk AI systems with the requirements set out in Section 2, provided that the compliance
of those notified bodies with requirements laid down in Article 31(4), (5), (10) and (11) has been assessed in the context of

Article 43 - Conformity assessment


with the requirements set out in Section 2, provided that the compliance
of those notified bodies with requirements laid down in Article 31(4), (5), (10) and (11) has been assessed in the context of
the notification procedure under those legal acts.
Where a legal act listed in Section A of Annex I enables the product manufacturer to opt out from a third-party conformity
assessment, provided that that manufacturer has applied all harmonised standards covering all the relevant requirements,
that manufacturer may use that option only if it has also applied harmonised standards or, where applicable, common
specifications referred to in Article 41, covering all requirements set out in Section 2 of this Chapter.
4. High-risk AI systems that have already been subject to a conformity assessment procedure shall undergo a new
conformity assessment procedure in the event of a substantial modification, regardless of whether the modified system is
intended to be further distributed or continues to be used by the current deployer.
For high-risk AI systems that continue to learn after being placed on the market or put into service, changes to the high-risk
AI system and its performance that have been pre-determined by the provider at the moment of the initial conformity
assessment and are part of the information contained in the technical documentation referred to in point 2(f) of Annex IV,
shall not constitute a substantial modification.
5. The Commission is empowered to adopt delegated a

Article 43 - Conformity assessment


of the information contained in the technical documentation referred to in point 2(f) of Annex IV,
shall not constitute a substantial modification.
5. The Commission is empowered to adopt delegated acts in accordance with Article 97 in order to amend Annexes VI
and VII by updating them in light of technical progress.
6. The Commission is empowered to adopt delegated acts in accordance with Article 97 in order to amend paragraphs 1
and 2 of this Article in order to subject high-risk AI systems referred to in points 2 to 8 of Annex III to the conformity
assessment procedure referred to in Annex VII or parts thereof. The Commission shall adopt such delegated acts taking into
account the effectiveness of the conformity assessment procedure based on internal control referred to in Annex VI in
preventing or minimising the risks to health and safety and protection of fundamental rights posed by such systems, as well
as the availability of adequate capacities and resources among notified bodies.

Article 43 - Conformity assessment


Article 44 - Certificates

1. Certificates issued by notified bodies in accordance with Annex VII shall be drawn-up in a language which can be
easily understood by the relevant authorities in the Member State in which the notified body is established.
2. Certificates shall be valid for the period they indicate, which shall not exceed five years for AI systems covered by
Annex I, and four years for AI systems covered by Annex III. At the request of the provider, the validity of a certificate may
be extended for further periods, each not exceeding five years for AI systems covered by Annex I, and four years for AI
systems covered by Annex III, based on a re-assessment in accordance with the applicable conformity assessment
procedures. Any supplement to a certificate shall remain valid, provided that the certificate which it supplements is valid.
3. Where a notified body finds that an AI system no longer meets the requirements set out in Section 2, it shall, taking
account of the principle of proportionality, suspend or withdraw the certificate issued or impose restrictions on it, unless
compliance with those requirements is ensured by appropriate corrective action taken by the provider of the system within
an appropriate deadline set by the notified body. The notified body shall give reasons for its decision.
An appeal procedure against decisions of the notified bodies, including on conformity certificates issued, shall be available.

Article 44 - Certificates


Article 45 - Information obligations of notified bodies

1. Notified bodies shall inform the notifying authority of the following:
(a) any Union technical documentation assessment certificates, any supplements to those certificates, and any quality
management system approvals issued in accordance with the requirements of Annex VII;
(b) any refusal, restriction, suspension or withdrawal of a Union technical documentation assessment certificate or a quality
management system approval issued in accordance with the requirements of Annex VII;
(c) any circumstances affecting the scope of or conditions for notification;
(d) any request for information which they have received from market surveillance authorities regarding conformity
assessment activities;
(e) on request, conformity assessment activities performed within the scope of their notification and any other activity
performed, including cross-border activities and subcontracting.
2. Each notified body shall inform the other notified bodies of:
(a) quality management system approvals which it has refused, suspended or withdrawn, and, upon request, of quality
system approvals which it has issued;
(b) Union technical documentation assessment certificates or any supplements thereto which it has refused, withdrawn,
suspended or otherwise restricted, and, upon request, of the certificates and/or supplements thereto which it has issued.
3. Each notified body shall provide the other notified bodies carrying out similar conformity assessment activities
covering the same types of AI systems


nd/or supplements thereto which it has issued.
3. Each notified body shall provide the other notified bodies carrying out similar conformity assessment activities
covering the same types of AI systems with relevant information on issues relating to negative and, on request, positive
conformity assessment results.
4. Notified bodies shall safeguard the confidentiality of the information that they obtain, in accordance with Article 78.


Article 46 - Derogation from conformity assessment procedure

1. By way of derogation from Article 43 and upon a duly justified request, any market surveillance authority may
authorise the placing on the market or the putting into service of specific high-risk AI systems within the territory of the
Member State concerned, for exceptional reasons of public security or the protection of life and health of persons,
environmental protection or the protection of key industrial and infrastructural assets. That authorisation shall be for
a limited period while the necessary conformity assessment procedures are being carried out, taking into account the
exceptional reasons justifying the derogation. The completion of those procedures shall be undertaken without undue delay.
2. In a duly justified situation of urgency for exceptional reasons of public security or in the case of specific, substantial
and imminent threat to the life or physical safety of natural persons, law-enforcement authorities or civil protection
authorities may put a specific high-risk AI system into service without the authorisation referred to in paragraph 1,
provided that such authorisation is requested during or after the use without undue delay. If the authorisation referred to in
paragraph 1 is refused, the use of the high-risk AI system shall be stopped with immediate effect and all the results and
outputs of such use shall be immediately discarded.
3. The authorisation referred to in paragraph 1 shall be issued only if the market surveillance authority concludes that


ect and all the results and
outputs of such use shall be immediately discarded.
3. The authorisation referred to in paragraph 1 shall be issued only if the market surveillance authority concludes that
the high-risk AI system complies with the requirements of Section 2. The market surveillance authority shall inform the
Commission and the other Member States of any authorisation issued pursuant to paragraphs 1 and 2. This obligation shall
not cover sensitive operational data in relation to the activities of law-enforcement authorities.
4. Where, within 15 calendar days of receipt of the information referred to in paragraph 3, no objection has been raised
by either a Member State or the Commission in respect of an authorisation issued by a market surveillance authority of
a Member State in accordance with paragraph 1, that authorisation shall be deemed justified.
5. Where, within 15 calendar days of receipt of the notification referred to in paragraph 3, objections are raised by
a Member State against an authorisation issued by a market surveillance authority of another Member State, or where the
Commission considers the authorisation to be contrary to Union law, or the conclusion of the Member States regarding the
compliance of the system as referred to in paragraph 3 to be unfounded, the Commission shall, without delay, enter into
consultations with the relevant Member State. The operators concerned shall be consulted and have the possibility to
present their views. Having re


ded, the Commission shall, without delay, enter into
consultations with the relevant Member State. The operators concerned shall be consulted and have the possibility to
present their views. Having regard thereto, the Commission shall decide whether the authorisation is justified. The
Commission shall address its decision to the Member State concerned and to the relevant operators.
6. Where the Commission considers the authorisation unjustified, it shall be withdrawn by the market surveillance
authority of the Member State concerned.
7. For high-risk AI systems related to products covered by Union harmonisation legislation listed in Section A of
Annex I, only the derogations from the conformity assessment established in that Union harmonisation legislation shall
apply.


Article 47 - EU declaration of conformity

1. The provider shall draw up a written machine readable, physical or electronically signed EU declaration of conformity
for each high-risk AI system, and keep it at the disposal of the national competent authorities for 10 years after the
high-risk AI system has been placed on the market or put into service. The EU declaration of conformity shall identify the
high-risk AI system for which it has been drawn up. A copy of the EU declaration of conformity shall be submitted to the
relevant national competent authorities upon request.
2. The EU declaration of conformity shall state that the high-risk AI system concerned meets the requirements set out in
Section 2. The EU declaration of conformity shall contain the information set out in Annex V, and shall be translated into
a language that can be easily understood by the national competent authorities of the Member States in which the high-risk
AI system is placed on the market or made available.
3. Where high-risk AI systems are subject to other Union harmonisation legislation which also requires an EU
declaration of conformity, a single EU declaration of conformity shall be drawn up in respect of all Union law applicable to
the high-risk AI system. The declaration shall contain all the information required to identify the Union harmonisation
legislation to which the declaration relates.
4. By drawing up the EU declaration of conformity, the provider shall assume responsibility for compliance with the
requirements set out in Se


rmonisation
legislation to which the declaration relates.
4. By drawing up the EU declaration of conformity, the provider shall assume responsibility for compliance with the
requirements set out in Section 2. The provider shall keep the EU declaration of conformity up-to-date as appropriate.
5. The Commission is empowered to adopt delegated acts in accordance with Article 97 in order to amend Annex V by
updating the content of the EU declaration of conformity set out in that Annex, in order to introduce elements that become
necessary in light of technical progress.


Article 48 - CE marking

1. The CE marking shall be subject to the general principles set out in Article 30 of Regulation (EC) No 765/2008.
2. For high-risk AI systems provided digitally, a digital CE marking shall be used, only if it can easily be accessed via the
interface from which that system is accessed or via an easily accessible machine-readable code or other electronic means.
3. The CE marking shall be affixed visibly, legibly and indelibly for high-risk AI systems. Where that is not possible or
not warranted on account of the nature of the high-risk AI system, it shall be affixed to the packaging or to the
accompanying documentation, as appropriate.
4. Where applicable, the CE marking shall be followed by the identification number of the notified body responsible for
the conformity assessment procedures set out in Article 43. The identification number of the notified body shall be affixed
by the body itself or, under its instructions, by the provider or by the provider’s authorised representative. The identification
number shall also be indicated in any promotional material which mentions that the high-risk AI system fulfils the
requirements for CE marking.
5. Where high-risk AI systems are subject to other Union law which also provides for the affixing of the CE marking, the
CE marking shall indicate that the high-risk AI system also fulfil the requirements of that other law.

Article 48 - CE marking


Article 49 - Registration

1. Before placing on the market or putting into service a high-risk AI system listed in Annex III, with the exception of
high-risk AI systems referred to in point 2 of Annex III, the provider or, where applicable, the authorised representative
shall register themselves and their system in the EU database referred to in Article 71.
2. Before placing on the market or putting into service an AI system for which the provider has concluded that it is not
high-risk according to Article 6(3), that provider or, where applicable, the authorised representative shall register
themselves and that system in the EU database referred to in Article 71.
3. Before putting into service or using a high-risk AI system listed in Annex III, with the exception of high-risk AI
systems listed in point 2 of Annex III, deployers that are public authorities, Union institutions, bodies, offices or agencies or
persons acting on their behalf shall register themselves, select the system and register its use in the EU database referred to
in Article 71.
4. For high-risk AI systems referred to in points 1, 6 and 7 of Annex III, in the areas of law enforcement, migration,
asylum and border control management, the registration referred to in paragraphs 1, 2 and 3 of this Article shall be in
a secure non-public section of the EU database referred to in Article 71 and shall include only the following information, as
applicable, referred to in:
(a) Section A, points 1 to 10, of Annex VIII, with the exception of poi

Article 49 - Registration


on of the EU database referred to in Article 71 and shall include only the following information, as
applicable, referred to in:
(a) Section A, points 1 to 10, of Annex VIII, with the exception of points 6, 8 and 9;
(b) Section B, points 1 to 5, and points 8 and 9 of Annex VIII;
(c) Section C, points 1 to 3, of Annex VIII;
(d) points 1, 2, 3 and 5, of Annex IX.
Only the Commission and national authorities referred to in Article 74(8) shall have access to the respective restricted
sections of the EU database listed in the first subparagraph of this paragraph.
5. High-risk AI systems referred to in point 2 of Annex III shall be registered at national level.

Article 49 - Registration


Article 50 - Transparency obligations for providers and deployers of certain AI systems

1. Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in
such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is
obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking
into account the circumstances and the context of use. This obligation shall not apply to AI systems authorised by law to
detect, prevent, investigate or prosecute criminal offences, subject to appropriate safeguards for the rights and freedoms of
third parties, unless those systems are available for the public to report a criminal offence.
2. Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text
content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as
artificially generated or manipulated. Providers shall ensure their technical solutions are effective, interoperable, robust and
reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content,
the costs of implementation and the generally acknowledged state of the art, as may be reflected in relevant technical
standards. This obligation shall not apply to the extent the AI systems perform an assistive function for standard editing or
do not substantially alter the input data provided by the depl

TRANSPARENCY OBLIGATIONS FOR PROVIDERS AND DEPLOYERS OF CERTAIN AI SYSTEMS


t technical
standards. This obligation shall not apply to the extent the AI systems perform an assistive function for standard editing or
do not substantially alter the input data provided by the deployer or the semantics thereof, or where authorised by law to
detect, prevent, investigate or prosecute criminal offences.
3. Deployers of an emotion recognition system or a biometric categorisation system shall inform the natural persons
exposed thereto of the operation of the system, and shall process the personal data in accordance with Regulations (EU)
2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable. This obligation shall not apply to AI systems
used for biometric categorisation and emotion recognition, which are permitted by law to detect, prevent or investigate
criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, and in accordance with
Union law.
4. Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall
disclose that the content has been artificially generated or manipulated. This obligation shall not apply where the use is
authorised by law to detect, prevent, investigate or prosecute criminal offence. Where the content forms part of an evidently
artistic, creative, satirical, fictional or analogous work or programme, the transparency obligations set out in this paragraph
are limited to disclosure of the existence of such generated or manipulat


rtistic, creative, satirical, fictional or analogous work or programme, the transparency obligations set out in this paragraph
are limited to disclosure of the existence of such generated or manipulated content in an appropriate manner that does not
hamper the display or enjoyment of the work.
Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public
on matters of public interest shall disclose that the text has been artificially generated or manipulated. This obligation shall
not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences or where the
AI-generated content has undergone a process of human review or editorial control and where a natural or legal person
holds editorial responsibility for the publication of the content.
5. The information referred to in paragraphs 1 to 4 shall be provided to the natural persons concerned in a clear and
distinguishable manner at the latest at the time of the first interaction or exposure. The information shall conform to the
applicable accessibility requirements.
6. Paragraphs 1 to 4 shall not affect the requirements and obligations set out in Chapter III, and shall be without
prejudice to other transparency obligations laid down in Union or national law for deployers of AI systems.
7. The AI Office shall encourage and facilitate the drawing up of codes of practice at Union level to facilitate the effective
implementation of


n in Union or national law for deployers of AI systems.
7. The AI Office shall encourage and facilitate the drawing up of codes of practice at Union level to facilitate the effective
implementation of the obligations regarding the detection and labelling of artificially generated or manipulated content.
The Commission may adopt implementing acts to approve those codes of practice in accordance with the procedure laid
down in Article 56 (6). If it deems the code is not adequate, the Commission may adopt an implementing act specifying
common rules for the implementation of those obligations in accordance with the examination procedure laid down in
Article 98(2).


Article 51 - Classification of general-purpose AI models as general-purpose AI models with systemic risk

1. A general-purpose AI model shall be classified as a general-purpose AI model with systemic risk if it meets any of the
following conditions:
(a) it has high impact capabilities evaluated on the basis of appropriate technical tools and methodologies, including
indicators and benchmarks;
(b) based on a decision of the Commission, ex officio or following a qualified alert from the scientific panel, it has
capabilities or an impact equivalent to those set out in point (a) having regard to the criteria set out in Annex XIII.
2. A general-purpose AI model shall be presumed to have high impact capabilities pursuant to paragraph 1, point (a),
when the cumulative amount of computation used for its training measured in floating point operations is greater than
1025.
3. The Commission shall adopt delegated acts in accordance with Article 97 to amend the thresholds listed in
paragraphs 1 and 2 of this Article, as well as to supplement benchmarks and indicators in light of evolving technological
developments, such as algorithmic improvements or increased hardware efficiency, when necessary, for these thresholds to
reflect the state of the art.


Article 52 - Procedure

1. Where a general-purpose AI model meets the condition referred to in Article 51(1), point (a), the relevant provider
shall notify the Commission without delay and in any event within two weeks after that requirement is met or it becomes
known that it will be met. That notification shall include the information necessary to demonstrate that the relevant
requirement has been met. If the Commission becomes aware of a general-purpose AI model presenting systemic risks of
which it has not been notified, it may decide to designate it as a model with systemic risk.
2. The provider of a general-purpose AI model that meets the condition referred to in Article 51(1), point (a), may
present, with its notification, sufficiently substantiated arguments to demonstrate that, exceptionally, although it meets that
requirement, the general-purpose AI model does not present, due to its specific characteristics, systemic risks and therefore
should not be classified as a general-purpose AI model with systemic risk.
3. Where the Commission concludes that the arguments submitted pursuant to paragraph 2 are not sufficiently
substantiated and the relevant provider was not able to demonstrate that the general-purpose AI model does not present,
due to its specific characteristics, systemic risks, it shall reject those arguments, and the general-purpose AI model shall be
considered to be a general-purpose AI model with systemic risk.
4. The Commission may designate a general-purpose AI model as presen

Article 52 - Procedure


l reject those arguments, and the general-purpose AI model shall be
considered to be a general-purpose AI model with systemic risk.
4. The Commission may designate a general-purpose AI model as presenting systemic risks, ex officio or following
a qualified alert from the scientific panel pursuant to Article 90(1), point (a), on the basis of criteria set out in Annex XIII.
The Commission is empowered to adopt delegated acts in accordance with Article 97 in order to amend Annex XIII by
specifying and updating the criteria set out in that Annex.
5. Upon a reasoned request of a provider whose model has been designated as a general-purpose AI model with systemic
risk pursuant to paragraph 4, the Commission shall take the request into account and may decide to reassess whether the
general-purpose AI model can still be considered to present systemic risks on the basis of the criteria set out in Annex XIII.
Such a request shall contain objective, detailed and new reasons that have arisen since the designation decision. Providers
may request reassessment at the earliest six months after the designation decision. Where the Commission, following its
reassessment, decides to maintain the designation as a general-purpose AI model with systemic risk, providers may request
reassessment at the earliest six months after that decision.
6. The Commission shall ensure that a list of general-purpose AI models with systemic risk is published and shall keep
that list up to date, without prejudice t

Article 52 - Procedure


arliest six months after that decision.
6. The Commission shall ensure that a list of general-purpose AI models with systemic risk is published and shall keep
that list up to date, without prejudice to the need to observe and protect intellectual property rights and confidential
business information or trade secrets in accordance with Union and national law.

Article 52 - Procedure


Article 53 - Obligations for providers of general-purpose AI models

1. Providers of general-purpose AI models shall:
(a) draw up and keep up-to-date the technical documentation of the model, including its training and testing process and
the results of its evaluation, which shall contain, at a minimum, the information set out in Annex XI for the purpose of
providing it, upon request, to the AI Office and the national competent authorities;
(b) draw up, keep up-to-date and make available information and documentation to providers of AI systems who intend to
integrate the general-purpose AI model into their AI systems. Without prejudice to the need to observe and protect
intellectual property rights and confidential business information or trade secrets in accordance with Union and
national law, the information and documentation shall:
(i) enable providers of AI systems to have a good understanding of the capabilities and limitations of the
general-purpose AI model and to comply with their obligations pursuant to this Regulation; and
(ii) contain, at a minimum, the elements set out in Annex XII;
(c) put in place a policy to comply with Union law on copyright and related rights, and in particular to identify and comply
with, including through state-of-the-art technologies, a reservation of rights expressed pursuant to Article 4(3) of
Directive (EU) 2019/790;
(d) draw up and make publicly available a sufficiently detailed summary about the content used for training of the
general-purpose AI model, according to a template provided by the AI Office


2019/790;
(d) draw up and make publicly available a sufficiently detailed summary about the content used for training of the
general-purpose AI model, according to a template provided by the AI Office.
2. The obligations set out in paragraph 1, points (a) and (b), shall not apply to providers of AI models that are released
under a free and open-source licence that allows for the access, usage, modification, and distribution of the model, and
whose parameters, including the weights, the information on the model architecture, and the information on model usage,
are made publicly available. This exception shall not apply to general-purpose AI models with systemic risks.
3. Providers of general-purpose AI models shall cooperate as necessary with the Commission and the national
competent authorities in the exercise of their competences and powers pursuant to this Regulation.
4. Providers of general-purpose AI models may rely on codes of practice within the meaning of Article 56 to
demonstrate compliance with the obligations set out in paragraph 1 of this Article, until a harmonised standard is
published. Compliance with European harmonised standards grants providers the presumption of conformity to the extent
that those standards cover those obligations. Providers of general-purpose AI models who do not adhere to an approved
code of practice or do not comply with a European harmonised standard shall demonstrate alternative adequate means of
compliance for assessment by the Commiss


I models who do not adhere to an approved
code of practice or do not comply with a European harmonised standard shall demonstrate alternative adequate means of
compliance for assessment by the Commission.
5. For the purpose of facilitating compliance with Annex XI, in particular points 2 (d) and (e) thereof, the Commission is
empowered to adopt delegated acts in accordance with Article 97 to detail measurement and calculation methodologies
with a view to allowing for comparable and verifiable documentation.
6. The Commission is empowered to adopt delegated acts in accordance with Article 97(2) to amend Annexes XI and XII
in light of evolving technological developments.
7. Any information or documentation obtained pursuant to this Article, including trade secrets, shall be treated in
accordance with the confidentiality obligations set out in Article 78.


Article 54 - Authorised representatives of providers of general-purpose AI models

1. Prior to placing a general-purpose AI model on the Union market, providers established in third countries shall, by
written mandate, appoint an authorised representative which is established in the Union.
2. The provider shall enable its authorised representative to perform the tasks specified in the mandate received from the
provider.
3. The authorised representative shall perform the tasks specified in the mandate received from the provider. It shall
provide a copy of the mandate to the AI Office upon request, in one of the official languages of the institutions of the
Union. For the purposes of this Regulation, the mandate shall empower the authorised representative to carry out the
following tasks:
(a) verify that the technical documentation specified in Annex XI has been drawn up and all obligations referred to in
Article 53 and, where applicable, Article 55 have been fulfilled by the provider;
(b) keep a copy of the technical documentation specified in Annex XI at the disposal of the AI Office and national
competent authorities, for a period of 10 years after the general-purpose AI model has been placed on the market, and
the contact details of the provider that appointed the authorised representative;
(c) provide the AI Office, upon a reasoned request, with all the information and documentation, including that referred to
in point (b), necessary to demonstrate compliance with the obligations in this Chapter;
(d) cooperate with the AI Office and competent authorities


rmation and documentation, including that referred to
in point (b), necessary to demonstrate compliance with the obligations in this Chapter;
(d) cooperate with the AI Office and competent authorities, upon a reasoned request, in any action they take in relation to
the general-purpose AI model, including when the model is integrated into AI systems placed on the market or put into
service in the Union.
4. The mandate shall empower the authorised representative to be addressed, in addition to or instead of the provider,
by the AI Office or the competent authorities, on all issues related to ensuring compliance with this Regulation.
5. The authorised representative shall terminate the mandate if it considers or has reason to consider the provider to be
acting contrary to its obligations pursuant to this Regulation. In such a case, it shall also immediately inform the AI Office
about the termination of the mandate and the reasons therefor.
6. The obligation set out in this Article shall not apply to providers of general-purpose AI models that are released under
a free and open-source licence that allows for the access, usage, modification, and distribution of the model, and whose
parameters, including the weights, the information on the model architecture, and the information on model usage, are
made publicly available, unless the general-purpose AI models present systemic risks.


el usage, are
made publicly available, unless the general-purpose AI models present systemic risks.


Article 55 - Obligations of providers of general-purpose AI models with systemic risk

1. In addition to the obligations listed in Articles 53 and 54, providers of general-purpose AI models with systemic risk
shall:
(a) perform model evaluation in accordance with standardised protocols and tools reflecting the state of the art, including
conducting and documenting adversarial testing of the model with a view to identifying and mitigating systemic risks;
(b) assess and mitigate possible systemic risks at Union level, including their sources, that may stem from the development,
the placing on the market, or the use of general-purpose AI models with systemic risk;
(c) keep track of, document, and report, without undue delay, to the AI Office and, as appropriate, to national competent
authorities, relevant information about serious incidents and possible corrective measures to address them;
(d) ensure an adequate level of cybersecurity protection for the general-purpose AI model with systemic risk and the
physical infrastructure of the model.
2. Providers of general-purpose AI models with systemic risk may rely on codes of practice within the meaning of
Article 56 to demonstrate compliance with the obligations set out in paragraph 1 of this Article, until a harmonised
standard is published. Compliance with European harmonised standards grants providers the presumption of conformity to
the extent that those standards cover those obligations. Providers of general-purpose AI models with systemic risks who do
not adhere to an approved code of practice or do not comply


of conformity to
the extent that those standards cover those obligations. Providers of general-purpose AI models with systemic risks who do
not adhere to an approved code of practice or do not comply with a European harmonised standard shall demonstrate
alternative adequate means of compliance for assessment by the Commission.
3. Any information or documentation obtained pursuant to this Article, including trade secrets, shall be treated in
accordance with the confidentiality obligations set out in Article 78.


Article 56 - Codes of practice

1. The AI Office shall encourage and facilitate the drawing up of codes of practice at Union level in order to contribute
to the proper application of this Regulation, taking into account international approaches.
2. The AI Office and the Board shall aim to ensure that the codes of practice cover at least the obligations provided for in
Articles 53 and 55, including the following issues:
(a) the means to ensure that the information referred to in Article 53(1), points (a) and (b), is kept up to date in light of
market and technological developments;
(b) the adequate level of detail for the summary about the content used for training;
(c) the identification of the type and nature of the systemic risks at Union level, including their sources, where appropriate;
(d) the measures, procedures and modalities for the assessment and management of the systemic risks at Union level,
including the documentation thereof, which shall be proportionate to the risks, take into consideration their severity
and probability and take into account the specific challenges of tackling those risks in light of the possible ways in
which such risks may emerge and materialise along the AI value chain.
3. The AI Office may invite all providers of general-purpose AI models, as well as relevant national competent
authorities, to participate in the drawing-up of codes of practice. Civil society organisations, industry, academia and other
relevant stakeholders, such as downstream providers and independent e

Article 56 - Codes of practice


tent
authorities, to participate in the drawing-up of codes of practice. Civil society organisations, industry, academia and other
relevant stakeholders, such as downstream providers and independent experts, may support the process.
4. The AI Office and the Board shall aim to ensure that the codes of practice clearly set out their specific objectives and
contain commitments or measures, including key performance indicators as appropriate, to ensure the achievement of
those objectives, and that they take due account of the needs and interests of all interested parties, including affected
persons, at Union level.
5. The AI Office shall aim to ensure that participants to the codes of practice report regularly to the AI Office on the
implementation of the commitments and the measures taken and their outcomes, including as measured against the key
performance indicators as appropriate. Key performance indicators and reporting commitments shall reflect differences in
size and capacity between various participants.
6. The AI Office and the Board shall regularly monitor and evaluate the achievement of the objectives of the codes of
practice by the participants and their contribution to the proper application of this Regulation. The AI Office and the Board
shall assess whether the codes of practice cover the obligations provided for in Articles 53 and 55, and shall regularly
monitor and evaluate the achievement of their objectives. They shall publish their assessment of the adequacy o

Article 56 - Codes of practice


f practice cover the obligations provided for in Articles 53 and 55, and shall regularly
monitor and evaluate the achievement of their objectives. They shall publish their assessment of the adequacy of the codes
of practice.
The Commission may, by way of an implementing act, approve a code of practice and give it a general validity within the
Union. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 98(2).
7. The AI Office may invite all providers of general-purpose AI models to adhere to the codes of practice. For providers
of general-purpose AI models not presenting systemic risks this adherence may be limited to the obligations provided for in
Article 53, unless they declare explicitly their interest to join the full code.
8. The AI Office shall, as appropriate, also encourage and facilitate the review and adaptation of the codes of practice, in
particular in light of emerging standards. The AI Office shall assist in the assessment of available standards.
9. Codes of practice shall be ready at the latest by 2 May 2025. The AI Office shall take the necessary steps, including
inviting providers pursuant to paragraph 7.
If, by 2 August 2025, a code of practice cannot be finalised, or if the AI Office deems it is not adequate following its
assessment under paragraph 6 of this Article, the Commission may provide, by means of implementing acts, common rules
for the implementation of the obligations provided for in Articles

Article 56 - Codes of practice


following its
assessment under paragraph 6 of this Article, the Commission may provide, by means of implementing acts, common rules
for the implementation of the obligations provided for in Articles 53 and 55, including the issues set out in paragraph 2 of
this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article
98(2).

Article 56 - Codes of practice


Article 57 - AI regulatory sandboxes

1. Member States shall ensure that their competent authorities establish at least one AI regulatory sandbox at national
level, which shall be operational by 2 August 2026. That sandbox may also be established jointly with the competent
authorities of other Member States. The Commission may provide technical support, advice and tools for the establishment
and operation of AI regulatory sandboxes.
The obligation under the first subparagraph may also be fulfilled by participating in an existing sandbox in so far as that
participation provides an equivalent level of national coverage for the participating Member States.
2. Additional AI regulatory sandboxes at regional or local level, or established jointly with the competent authorities of
other Member States may also be established.
3. The European Data Protection Supervisor may also establish an AI regulatory sandbox for Union institutions, bodies,
offices and agencies, and may exercise the roles and the tasks of national competent authorities in accordance with this
Chapter.
4. Member States shall ensure that the competent authorities referred to in paragraphs 1 and 2 allocate sufficient
resources to comply with this Article effectively and in a timely manner. Where appropriate, national competent authorities
shall cooperate with other relevant authorities, and may allow for the involvement of other actors within the AI ecosystem.
This Article shall not affect other regulatory sandboxes established under Union or national law

Article 57 - AI regulatory sandboxes


other relevant authorities, and may allow for the involvement of other actors within the AI ecosystem.
This Article shall not affect other regulatory sandboxes established under Union or national law. Member States shall ensure
an appropriate level of cooperation between the authorities supervising those other sandboxes and the national competent
authorities.
5. AI regulatory sandboxes established under paragraph 1 shall provide for a controlled environment that fosters
innovation and facilitates the development, training, testing and validation of innovative AI systems for a limited time
before their being placed on the market or put into service pursuant to a specific sandbox plan agreed between the
providers or prospective providers and the competent authority. Such sandboxes may include testing in real world
conditions supervised therein.
6. Competent authorities shall provide, as appropriate, guidance, supervision and support within the AI regulatory
sandbox with a view to identifying risks, in particular to fundamental rights, health and safety, testing, mitigation measures,
and their effectiveness in relation to the obligations and requirements of this Regulation and, where relevant, other Union
and national law supervised within the sandbox.
7. Competent authorities shall provide providers and prospective providers participating in the AI regulatory sandbox
with guidance on regulatory expectations and how to fulfil the requirements and obligations set out in this Reg

Article 57 - AI regulatory sandboxes


l provide providers and prospective providers participating in the AI regulatory sandbox
with guidance on regulatory expectations and how to fulfil the requirements and obligations set out in this Regulation.
Upon request of the provider or prospective provider of the AI system, the competent authority shall provide a written
proof of the activities successfully carried out in the sandbox. The competent authority shall also provide an exit report
detailing the activities carried out in the sandbox and the related results and learning outcomes. Providers may use such
documentation to demonstrate their compliance with this Regulation through the conformity assessment process or
relevant market surveillance activities. In this regard, the exit reports and the written proof provided by the national
competent authority shall be taken positively into account by market surveillance authorities and notified bodies, with
a view to accelerating conformity assessment procedures to a reasonable extent.
8. Subject to the confidentiality provisions in Article 78, and with the agreement of the provider or prospective provider,
the Commission and the Board shall be authorised to access the exit reports and shall take them into account, as
appropriate, when exercising their tasks under this Regulation. If both the provider or prospective provider and the national
competent authority explicitly agree, the exit report may be made publicly available through the single information
platform referr

Article 57 - AI regulatory sandboxes


ation. If both the provider or prospective provider and the national
competent authority explicitly agree, the exit report may be made publicly available through the single information
platform referred to in this Article.
9. The establishment of AI regulatory sandboxes shall aim to contribute to the following objectives:
(a) improving legal certainty to achieve regulatory compliance with this Regulation or, where relevant, other applicable
Union and national law;
(b) supporting the sharing of best practices through cooperation with the authorities involved in the AI regulatory
sandbox;
(c) fostering innovation and competitiveness and facilitating the development of an AI ecosystem;
(d) contributing to evidence-based regulatory learning;
(e) facilitating and accelerating access to the Union market for AI systems, in particular when provided by SMEs, including
start-ups.
10. National competent authorities shall ensure that, to the extent the innovative AI systems involve the processing of
personal data or otherwise fall under the supervisory remit of other national authorities or competent authorities providing
or supporting access to data, the national data protection authorities and those other national or competent authorities are
associated with the operation of the AI regulatory sandbox and involved in the supervision of those aspects to the extent of
their respective tasks and powers.
11. The AI regulatory sandboxes shall not affect the supervisory or corrective powers o

Article 57 - AI regulatory sandboxes


ory sandbox and involved in the supervision of those aspects to the extent of
their respective tasks and powers.
11. The AI regulatory sandboxes shall not affect the supervisory or corrective powers of the competent authorities
supervising the sandboxes, including at regional or local level. Any significant risks to health and safety and fundamental
rights identified during the development and testing of such AI systems shall result in an adequate mitigation. National
competent authorities shall have the power to temporarily or permanently suspend the testing process, or the participation
in the sandbox if no effective mitigation is possible, and shall inform the AI Office of such decision. National competent
authorities shall exercise their supervisory powers within the limits of the relevant law, using their discretionary powers
when implementing legal provisions in respect of a specific AI regulatory sandbox project, with the objective of supporting
innovation in AI in the Union.
12. Providers and prospective providers participating in the AI regulatory sandbox shall remain liable under applicable
Union and national liability law for any damage inflicted on third parties as a result of the experimentation taking place in
the sandbox. However, provided that the prospective providers observe the specific plan and the terms and conditions for
their participation and follow in good faith the guidance given by the national competent authority, no administrative fines
shall be i

Article 57 - AI regulatory sandboxes


iders observe the specific plan and the terms and conditions for
their participation and follow in good faith the guidance given by the national competent authority, no administrative fines
shall be imposed by the authorities for infringements of this Regulation. Where other competent authorities responsible for
other Union and national law were actively involved in the supervision of the AI system in the sandbox and provided
guidance for compliance, no administrative fines shall be imposed regarding that law.
13. The AI regulatory sandboxes shall be designed and implemented in such a way that, where relevant, they facilitate
cross-border cooperation between national competent authorities.
14. National competent authorities shall coordinate their activities and cooperate within the framework of the Board.
15. National competent authorities shall inform the AI Office and the Board of the establishment of a sandbox, and may
ask them for support and guidance. The AI Office shall make publicly available a list of planned and existing sandboxes and
keep it up to date in order to encourage more interaction in the AI regulatory sandboxes and cross-border cooperation.
16. National competent authorities shall submit annual reports to the AI Office and to the Board, from one year after
the establishment of the AI regulatory sandbox and every year thereafter until its termination, and a final report. Those
reports shall provide information on the progress and results of the implementati

Article 57 - AI regulatory sandboxes


establishment of the AI regulatory sandbox and every year thereafter until its termination, and a final report. Those
reports shall provide information on the progress and results of the implementation of those sandboxes, including best
practices, incidents, lessons learnt and recommendations on their setup and, where relevant, on the application and possible
revision of this Regulation, including its delegated and implementing acts, and on the application of other Union law
supervised by the competent authorities within the sandbox. The national competent authorities shall make those annual
reports or abstracts thereof available to the public, online. The Commission shall, where appropriate, take the annual
reports into account when exercising its tasks under this Regulation.
17. The Commission shall develop a single and dedicated interface containing all relevant information related to AI
regulatory sandboxes to allow stakeholders to interact with AI regulatory sandboxes and to raise enquiries with competent
authorities, and to seek non-binding guidance on the conformity of innovative products, services, business models
embedding AI technologies, in accordance with Article 62(1), point (c). The Commission shall proactively coordinate with
national competent authorities, where relevant.

Article 57 - AI regulatory sandboxes


relevant.

Article 57 - AI regulatory sandboxes


Article 58 - Detailed arrangements for, and functioning of, AI regulatory sandboxes

1. In order to avoid fragmentation across the Union, the Commission shall adopt implementing acts specifying the
detailed arrangements for the establishment, development, implementation, operation and supervision of the AI regulatory
sandboxes. The implementing acts shall include common principles on the following issues:
(a) eligibility and selection criteria for participation in the AI regulatory sandbox;
(b) procedures for the application, participation, monitoring, exiting from and termination of the AI regulatory sandbox,
including the sandbox plan and the exit report;
(c) the terms and conditions applicable to the participants.
Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 98(2).
2. The implementing acts referred to in paragraph 1 shall ensure:
(a) that AI regulatory sandboxes are open to any applying provider or prospective provider of an AI system who fulfils
eligibility and selection criteria, which shall be transparent and fair, and that national competent authorities inform
applicants of their decision within three months of the application;
(b) that AI regulatory sandboxes allow broad and equal access and keep up with demand for participation; providers and
prospective providers may also submit applications in partnerships with deployers and other relevant third parties;
(c) that the detailed arrangements for, and conditions concerning AI regulatory sandboxes support, to the best extent
possible, flexi


s in partnerships with deployers and other relevant third parties;
(c) that the detailed arrangements for, and conditions concerning AI regulatory sandboxes support, to the best extent
possible, flexibility for national competent authorities to establish and operate their AI regulatory sandboxes;
(d) that access to the AI regulatory sandboxes is free of charge for SMEs, including start-ups, without prejudice to
exceptional costs that national competent authorities may recover in a fair and proportionate manner;
(e) that they facilitate providers and prospective providers, by means of the learning outcomes of the AI regulatory
sandboxes, in complying with conformity assessment obligations under this Regulation and the voluntary application
of the codes of conduct referred to in Article 95;
(f) that AI regulatory sandboxes facilitate the involvement of other relevant actors within the AI ecosystem, such as notified
bodies and standardisation organisations, SMEs, including start-ups, enterprises, innovators, testing and experimenta-
tion facilities, research and experimentation labs and European Digital Innovation Hubs, centres of excellence,
individual researchers, in order to allow and facilitate cooperation with the public and private sectors;
(g) that procedures, processes and administrative requirements for application, selection, participation and exiting the AI
regulatory sandbox are simple, easily intelligible, and clearly communicated in order to facilitate the particip