Processes biometric data, in the European Union

Regulation (EU) 2016/679, Art. 9 · Read the law's page

• Obtain explicit consent, or establish another Article 9(2) basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.
• Treat any biometric identifier your system derives through its own technical processing for the purpose of uniquely identifying a person as special category data, even where the underlying image or audio was lawfully public.

Regulation (EU) 2024/1689, Article 4 · Read the law's page

• Take measures to support the development of AI literacy among your staff and other people who operate or use AI systems on your behalf, if you are a provider or deployer of an AI system, taking into account their technical knowledge, experience, education and training, the context the AI systems are to be used in, and the persons or groups of persons the AI systems are to be used on.Makes itRuns itproviderdeployer
• This duty does not require you to guarantee any specific level of AI literacy for any individual.Makes itRuns itproviderdeployer

Regulation (EU) 2024/1689, Article 5 · Read the law's page

• Do not place on the market, put into service, or use an AI system that deploys subliminal, manipulative or deceptive techniques to materially distort a person's behaviour in a way that causes or is reasonably likely to cause significant harm.
• Do not place on the market, put into service, or use an AI system that exploits a person's or group's vulnerabilities due to age, disability, or social or economic situation, to materially distort their behaviour in a way that causes or is reasonably likely to cause significant harm.
• Do not place on the market, put into service, or use an AI system to evaluate or classify people by social behaviour or personal characteristics in a way that leads to unjustified or unrelated detrimental treatment (social scoring).
• Do not place on the market, put into service for this specific purpose, or use an AI system to assess or predict a person's risk of committing a crime based solely on profiling or personality traits, unless it supports a human assessment already based on objective, verifiable facts directly linked to criminal activity.
• Do not place on the market, put into service for this specific purpose, or use an AI system to build or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage.
• Do not place on the market, put into service for this specific purpose, or use an AI system to infer emotions in the workplace or in education, except for medical or safety reasons.
• Do not place on the market, put into service for this specific purpose, or use a biometric categorisation system that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation from biometric data, other than any labelling or filtering of lawfully acquired biometric datasets based on biometric data, or categorising of biometric data in the area of law enforcement.
• Do not use 'real-time' remote biometric identification in publicly accessible spaces for law enforcement unless a Member State has provided for it in national law and the use is strictly necessary for a targeted search for specific victims of abduction, trafficking or sexual exploitation or for missing persons, for preventing a specific, substantial and imminent threat to life or physical safety or a genuine terrorist threat, or for localising or identifying a person suspected of an offence listed in Annex II that is punishable in the Member State concerned by a custodial sentence or detention order of at least four years' maximum; and, in the ordinary case, only after prior authorisation from a judicial or independent administrative authority, a completed fundamental rights impact assessment, and EU database registration. In a duly justified urgent case, use may begin before the authorisation is granted, if it is requested without undue delay and at the latest within 24 hours, and before the EU database registration, if it is completed without undue delay.when it serves a public body

Regulation (EU) 2024/1689, Articles 60 and 61 · Read the law's page

• Conduct the testing without prejudice to the prohibitions under Article 5 and to any ethical review that Union or national law requires.Makes itprovider
• Draw up a real-world testing plan and submit it to the market surveillance authority in the Member State where you will test, and test only after that authority has approved the testing and the plan (Article 60(4), points (a) and (b)).Makes itprovider
• Register the testing in accordance with Article 71(4) with a Union-wide unique single identification number and the information specified in Annex IX; if the system is an Annex III point 1, 6 or 7 system in law enforcement, migration, asylum or border control management, register it in the secure non-public section of the EU database under Article 49(4), point (d), and if it is a point 2 system, register it under Article 49(5) (Article 60(4), point (c)).Makes itprovider
• Be established in the Union or appoint a legal representative who is established in the Union (Article 60(4), point (d)).Makes itprovider
• Transfer data collected and processed for the testing to third countries only with appropriate and applicable safeguards under Union law (Article 60(4), point (e)).Makes itprovider
• Do not test for longer than necessary to achieve the testing's objectives and in any case not longer than six months; you may extend it by six months on prior notification to the market surveillance authority with an explanation of the need (Article 60(4), point (f)).Makes itprovider
• Appropriately protect subjects of the testing who belong to vulnerable groups due to their age or disability (Article 60(4), point (g)).Makes itprovider
• If you test with deployers or prospective deployers, inform them of all aspects of the testing relevant to their decision to participate, give them the instructions for use of the system referred to in Article 13, and conclude an agreement specifying your roles and responsibilities to ensure compliance with the provisions for testing in real world conditions and with other applicable Union and national law (Article 60(4), point (h)).Makes itprovider
• Obtain the subjects' freely-given informed consent in accordance with Article 61 before they participate, after informing them in concise, clear, relevant and understandable terms of the nature and objectives of the testing and the possible inconvenience; its conditions, including the expected duration of their participation; their rights and guarantees, in particular the right to refuse and to withdraw at any time without detriment and without justification; the arrangements for requesting the reversal or disregarding of the system's predictions, recommendations or decisions; and the testing's Union-wide unique single identification number and your contact details or those of your legal representative (Article 61(1)).Makes itprovider
• Date and document the informed consent and give a copy to the subject or the subject's legal representative (Article 61(2)).Makes itprovider
• In the case of law enforcement, where seeking informed consent would prevent the AI system from being tested, make sure the testing itself and its outcome have no negative effect on the subjects and delete their personal data after the test is performed (Article 60(4), point (i)).Makes itprovider
• Make sure the testing is effectively overseen by you and by deployers or prospective deployers through persons who are suitably qualified in the relevant field and have the necessary capacity, training and authority, and that the predictions, recommendations or decisions of the system can be effectively reversed and disregarded (Article 60(4), points (j) and (k)).Makes itprovider
• Let a subject, or the subject's legally designated representative, withdraw from the testing at any time by revoking informed consent, without detriment and without having to provide any justification, and on request delete the subject's personal data immediately and permanently; the withdrawal does not affect the activities already carried out (Article 60(5)).Makes itprovider
• Report any serious incident identified in the course of the testing to the national market surveillance authority in accordance with Article 73, which requires the report immediately after a causal link, or the reasonable likelihood of one, is established and in any event not later than 15 days after you become aware of the incident, not later than two days for a widespread infringement or a serious and irreversible disruption of the management or operation of critical infrastructure, and not later than 10 days after you become aware of it where a person has died (Article 60(7)).Makes itprovider
• Adopt immediate mitigation measures or, failing that, suspend the testing until mitigation takes place, or otherwise terminate it, and establish a procedure for the prompt recall of the AI system upon termination (Article 60(7)).Makes itprovider
• Notify the national market surveillance authority in the Member State where the testing is to be conducted of the suspension or termination of the testing and of the final outcomes (Article 60(8)).Makes itprovider
• These duties apply from 2 August 2026, the Regulation's general application date: Article 113, as amended by Regulation (EU) 2026/1744, gives Chapter VI, which holds Articles 60 and 61, no date of its own.
• It reaches you if you are a provider, or a prospective provider, of a high-risk AI system listed in Annex III, or covered by the Union harmonisation legislation listed in Section A of Annex I, and you test it in real world conditions outside an AI regulatory sandbox at any time before placing it on the market or putting it into service, alone or in partnership with deployers or prospective deployers; the Article 2(8) exclusion for testing before the market does not cover testing in real world conditions.
• The testing and the plan are understood to have been approved if the authority has given no answer within 30 days, but where national law does not provide for tacit approval the testing remains subject to an authorization (Article 60(4), points (a) and (b)).

Directive (EU) 2024/2831, Art. 7(1)(f) · Read the law's page

• This duty takes effect on 2 December 2026, the date by which Member States must bring into force the laws, regulations and administrative provisions necessary to comply with the Directive (Article 29(1)).
• This Directive is addressed to the Member States (Article 32), which must bring into force the laws, regulations and administrative provisions necessary to comply with it by 2 December 2026 (Article 29(1)), so a digital labour platform meets these rules through each Member State's transposing law.
• If you are a digital labour platform, do not, by means of an automated monitoring system or an automated decision-making system, process any biometric data, as defined in Article 4, point (14), of Regulation (EU) 2016/679, of a person performing platform work to establish that person's identity by comparing that data to stored biometric data of natural persons in a database (Article 7(1)(f)).
• Apply this limit to every person performing platform work from the start of the recruitment or selection procedure, and to automated systems that take or support decisions affecting persons performing platform work in any manner, not only to systems described as monitoring or decision-making systems (Article 7(2) and (3)).

Directive (EU) 2024/2853 · Read the law's page

• The Directive does not apply to free and open-source software that you develop or supply outside the course of a commercial activity (Art. 2(2)).
• If you develop or produce software, or have it developed under your name or trademark, and make it available in the course of a commercial activity, you answer as its manufacturer for damage it causes by a defect (Arts. 4(1), 4(10) and 8(1)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect caused by their absence, or by software, updates or upgrades within your control, is not excused because it arose after you placed the product on the market (Art. 11(2)(b) and (c)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 7(2)(f)), and failing a mandatory product safety requirement that protects against the damage suffered presumes it defective (Art. 10(2)(b)).
• Account for what your product learns or acquires after release: the effect of any ability to continue to learn or acquire new features after it is placed on the market is weighed in deciding whether it is defective (Art. 7(2)(c)).
• Keep technical documentation you could produce if a court orders disclosure; failing to disclose presumes the product defective (Arts. 9(1), 10(2)(a)).
• If you are outside the EU, the importer or your authorized representative answers for the product in your place (Art. 8(1)(c)).
• If you substantially modify a product outside its manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 8(2)).
• Do not count on a contract term to limit or exclude your liability to an injured person; Article 15 bars it.
• Be able to show when you placed the product on the market or put it into service: you are not liable if you prove you did not, or that the defect probably did not exist at that time (Art. 11(1)(a) and (c)).

Regulation (EU) 2024/1689, Article 11 · Read the law's page

• If you are the provider of a high-risk AI system, draw up its technical documentation before you place the system on the market or put it into service, and keep it up to date.Makes itprovider
• Draw up the technical documentation so that it demonstrates the system complies with the Chapter III, Section 2 requirements and gives national competent authorities and notified bodies the information they need, in a clear and comprehensive form, to assess that compliance; include at least the elements set out in Annex IV.Makes itprovider
• If you are an SME, including a start-up, or a small mid-cap enterprise, you may provide the Annex IV elements in a simplified manner; if you choose to, use the simplified technical documentation form the Commission establishes.Makes itprovider
• If your high-risk AI system is related to a product covered by the Union harmonisation legislation listed in Section A of Annex I, draw up a single set of technical documentation that contains both the information this Article requires and the information those legal acts require.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 12 · Read the law's page

• Build automatic event logging into a high-risk AI system so it can record events over the system's lifetime, if you are its provider.Makes itprovider
• Design the logging capability to support identifying an emerging risk or a substantial modification, post-market monitoring, and a deployer's monitoring of the system's operation.Makes itprovider
• For a remote biometric identification system, log the start and end date and time of each use, the reference database checked, the input data that produced a match, and the identity of the person who verified the result.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 14 · Read the law's page

• If you are the provider of a high-risk AI system, design and develop it, including its human-machine interface, so that a natural person can effectively oversee it while it is in use.Makes itprovider
• Build oversight measures proportionate to the system's risks, autonomy and context of use, either into the system itself before it is placed on the market or put into service, or as measures you identify for the deployer to implement.Makes itprovider
• Provide the system to the deployer so that the natural persons assigned to oversee it can understand its capacities and limitations and duly monitor its operation, including detecting and addressing anomalies, dysfunctions and unexpected performance.Makes itprovider
• Provide the system so the assigned overseers can remain aware of the tendency to automatically rely or over-rely on its output, in particular where the system informs a decision a person will make.Makes itprovider
• Provide the system so the assigned overseers can correctly interpret its output.Makes itprovider
• Provide the system so the assigned overseers can decide, in a particular situation, not to use it, or can disregard, override or reverse its output.Makes itprovider
• Provide the system so the assigned overseers can intervene in its operation or interrupt it through a stop button or similar procedure that brings it to a halt in a safe state.Makes itprovider
• For a remote biometric identification system (Annex III point 1(a)), build your oversight measures so that no action or decision is taken on the identification result unless it has been separately verified and confirmed by at least two natural persons with the necessary competence, training and authority, except where the system is used for law enforcement, migration, border control or asylum and Union or national law treats that two-person requirement as disproportionate.Makes itprovider
• If you are a deployer of a high-risk AI system, assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.Runs itdeployer
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 16 · Read the law's page

• If you are the provider of a high-risk AI system, indicate your name, registered trade name or registered trade mark and the address at which you can be contacted on the system or, where that is not possible, on its packaging or its accompanying documentation.Makes itprovider
• Upon a reasoned request of a national competent authority, demonstrate that your high-risk AI system conforms with the Chapter III, Section 2 requirements.Makes itprovider
• Ensure that your high-risk AI system complies with accessibility requirements in accordance with Directives (EU) 2016/2102 and (EU) 2019/882.Makes itprovider
• Ensure the system undergoes the relevant conformity assessment procedure under Article 43 before you place it on the market or put it into service, draw up an EU declaration of conformity under Article 47, affix the CE marking under Article 48, and comply with the registration obligations of Article 49(1).Makes itprovider
• Article 16 also makes these your obligations as provider, each set out in its own Article: compliance with the Chapter III, Section 2 requirements, a quality management system under Article 17, keeping the documentation referred to in Article 18, keeping the logs referred to in Article 19 when they are under your control, and the corrective actions and information required by Article 20.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 17 · Read the law's page

• If you are the provider of a high-risk AI system, put in place a quality management system that ensures compliance with the Regulation, documented in a systematic and orderly manner as written policies, procedures and instructions.Makes itprovider
• Cover at least: a regulatory compliance strategy, including conformity assessment and the management of modifications; design, design control and design verification; development, quality control and quality assurance; examination, test and validation procedures before, during and after development, and how often they run; the technical specifications and standards you apply; data management; the Article 9 risk management system; a post-market monitoring system under Article 72; procedures for reporting serious incidents under Article 73; communication with authorities, notified bodies, other operators, customers and other interested parties; record-keeping of all relevant documentation and information; resource management, including security of supply; and an accountability framework for management and other staff.Makes itprovider
• Implement those aspects in proportion to the size of your organization, in particular if you are an SME, including a start-up, or a small mid-cap enterprise, while keeping the degree of rigor and level of protection your systems need to comply.Makes itprovider
• If you are an SME, including a start-up, with no partner enterprises or linked enterprises within the meaning of Recommendation 2003/361/EC, you may comply with certain elements of the quality management system in a simplified manner under Article 63(1); that does not exempt you from any other requirement or obligation of the Regulation, including Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73.Makes itprovider
• If you are already subject to quality management system obligations, or an equivalent function, under relevant sectoral Union law, you may include these aspects in that quality management system.Makes itprovider
• If you are a financial institution subject to internal-governance requirements under Union financial services law, you meet this duty by complying with those internal-governance rules, except that you must still have the risk management system, the post-market monitoring system and the serious-incident reporting procedures of Article 17(1), points (g), (h) and (i); harmonised standards referred to in Article 40 are taken into account to that end.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 18 · Read the law's page

• If you are the provider of a high-risk AI system, keep at the disposal of the national competent authorities, for a period ending 10 years after the system has been placed on the market or put into service: its technical documentation under Article 11; the documentation concerning your quality management system under Article 17; where applicable, the documentation concerning changes approved by notified bodies and the decisions and other documents notified bodies issued; and the EU declaration of conformity under Article 47.Makes itprovider
• If you are a financial institution subject to internal-governance requirements under Union financial services law, maintain the technical documentation as part of the documentation kept under the relevant Union financial services law.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 19 · Read the law's page

• Keep the logs your high-risk AI system automatically generates under Article 12, to the extent they are under your control, if you are its provider.Makes itprovider
• Retain the logs for a period appropriate to the system's intended purpose, at least six months, unless other Union or national law, such as data-protection law, provides otherwise.Makes itprovider
• If you are a financial institution, keep the logs as part of the documentation your sector's internal-governance rules already require.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 20 · Read the law's page

• If you are the provider of a high-risk AI system and consider, or have reason to consider, that a system you have placed on the market or put into service is not in conformity with the Regulation, immediately take the necessary corrective actions to bring it into conformity, withdraw it, disable it or recall it, as appropriate.Makes itprovider
• Inform the distributors of the system and, where applicable, its deployers, your authorised representative and importers accordingly.Makes itprovider
• Where the system presents a risk to the health or safety, or to fundamental rights, of persons within the meaning of Article 79(1) and you become aware of that risk, immediately investigate the causes, in collaboration with the reporting deployer where applicable, and inform the market surveillance authorities competent for the system and, where applicable, the notified body that issued its certificate under Article 44, in particular of the nature of the non-compliance and of any relevant corrective action taken.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 21(1) and (3) · Read the law's page

• If you are the provider of a high-risk AI system, provide a competent authority, when it makes a reasoned request, with all the information and documentation necessary to demonstrate the conformity of the system with the requirements of Chapter III, Section 2 (Article 21(1)).Makes itprovider
• Give that information and documentation in a language which the authority can easily understand, being one of the official languages of the institutions of the Union as indicated by the Member State concerned (Article 21(1)).Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 21(2) · Read the law's page

• Give a competent authority access to the automatically generated logs of your high-risk AI system, to the extent they are under your control, when it makes a reasoned request, if you are the system's provider.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 26(10) · Read the law's page

• If you are a law enforcement deployer using a high-risk AI system for post-remote biometric identification in a targeted search for a suspected or convicted person, request authorisation from a judicial authority or a binding, judicially reviewable administrative authority, in advance or without undue delay and no later than 48 hours, unless you are using the system only for the initial identification of a potential suspect on objective and verifiable facts directly linked to the offence.Runs itdeployerfor a public body
• Limit each use to what is strictly necessary for the investigation of a specific criminal offence.Runs itdeployerfor a public body
• If the authorisation is rejected, stop the linked use immediately and delete the personal data the use generated.Runs itdeployerwhen it serves a public body
• Never use such a system in an untargeted way, without any link to a criminal offence, a criminal proceeding, a genuine threat of one, or the search for a specific missing person.Runs itdeployerfor a public body
• Do not take, or let a law enforcement authority take, any decision producing an adverse legal effect on a person based solely on the system's output.Runs itdeployer
• Document every use in the relevant police file, and make it available to the market surveillance authority and the national data protection authority on request, excluding sensitive operational data.Runs itdeployerwhen it serves a public body
• Submit annual reports to the relevant market surveillance and data protection authorities on your use of post-remote biometric identification systems.Runs itdeployerwhen it serves a public body
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 26(11) · Read the law's page

• If you are the deployer of a high-risk AI system listed in Annex III that makes, or assists in making, a decision about a natural person, inform that person that they are subject to the use of the high-risk AI system.Runs itdeployer
• If the system is used for law enforcement purposes, follow Article 13 of Directive (EU) 2016/680 instead of this duty.Runs itdeployerwhen it serves a public body
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, the only classification this duty reaches, so the later date of 2 August 2028 for one classified under Article 6(1) and Annex I adds no system to it; a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I is outside it too, since under Article 2(2) only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 26(6) · Read the law's page

• Keep the logs your high-risk AI system automatically generates, to the extent they are under your control, if you are its deployer.Runs itdeployer
• Retain the logs for a period appropriate to the system's intended purpose, at least six months, unless other Union or national law, such as data-protection law, provides otherwise.Runs itdeployer
• If you are a financial institution, keep the logs as part of the documentation your sector's internal-governance rules already require.Runs itdeployer
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 43 · Read the law's page

• If your system is listed in point 1 of Annex III (biometrics) and, in demonstrating compliance with Section 2, you applied the harmonised standards of Article 40 or, where applicable, the common specifications of Article 41, choose between the procedure based on internal control in Annex VI and the procedure of Annex VII, which involves a notified body.Makes itprovider
• If your system is listed in point 1 of Annex III, follow the Annex VII procedure, rather than choosing, if harmonised standards do not exist and common specifications are not available, if you did not apply the harmonised standard or applied only part of it, if you did not apply existing common specifications, or, as to the restricted part, if a harmonised standard was published with a restriction.Makes itprovider
• For the Annex VII procedure under point 1 of Annex III you may choose any notified body; where the system is intended to be put into service by law enforcement, immigration or asylum authorities or by Union institutions, bodies, offices or agencies, the market surveillance authority referred to in Article 74(8) or (9), as applicable, acts as the notified body.Makes itprovider
• If your system is referred to in points 2 to 8 of Annex III, follow the conformity assessment procedure based on internal control in Annex VI, which does not involve a notified body: verify that your quality management system complies with Article 17, examine the technical documentation to assess the system's compliance with the Section 2 requirements, and verify that the design and development process and the post-market monitoring under Article 72 are consistent with the technical documentation.Makes itprovider
• If your system is covered by the Union harmonisation legislation listed in Section A of Annex I, follow the conformity assessment procedure that legislation requires, with the Section 2 requirements as part of the assessment, and also undertake the assessment of the quality management system set out in Article 17, to which points 3, 4.3, 4.4 and 4.5, the fifth paragraph of point 4.6 and point 5 of Annex VII apply; if the system also falls within an Annex III category, follow the Section A procedure.Makes itprovider
• Where that legislation lets the manufacturer opt out of a third-party conformity assessment on the basis of harmonised standards, use the option only if you have also applied harmonised standards or, where applicable, common specifications referred to in Article 41, covering all the requirements set out in Section 2.Makes itproviderproduct manufacturer
• Undergo a new conformity assessment procedure if you substantially modify a high-risk AI system that has already been assessed, whether or not the modified system is intended to be further distributed or continues to be used by the current deployer; for a system that continues to learn after it is placed on the market or put into service, changes you pre-determined at the initial assessment and set out in the technical documentation under point 2(f) of Annex IV are not a substantial modification.Makes itprovider
• Under the Annex VII procedure, allow the notified body to access the premises where the system is designed, developed and tested, share all necessary information with it, and inform the notified body that issued the certificate of any change you intend to introduce, or become aware of, that could affect compliance with the requirements or the intended purpose.Makes itprovider
• This duty takes effect on 2 December 2027 (Article 113, as amended by Regulation (EU) 2026/1744, read with Article 16, point (f)) for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.
• It reaches you if you are the provider of a high-risk AI system, that is, you develop it, or have it developed, and place it on the market or put it into service under your own name or trademark: Article 16, point (f), requires you to have the system undergo the relevant conformity assessment procedure of Article 43 before you place it on the market or put it into service.

Regulation (EU) 2024/1689, Article 72 · Read the law's page

• If you are the provider of a high-risk AI system, establish and document a post-market monitoring system proportionate to the nature of the AI technologies and the risks of the system.Makes itprovider
• Have the system actively and systematically collect, document and analyze relevant data on the system's performance throughout its lifetime, whether provided by deployers or collected through other sources, so that you can evaluate its continuous compliance with the Chapter III, Section 2 requirements; where relevant, include an analysis of its interaction with other AI systems. This does not cover sensitive operational data of deployers that are law-enforcement authorities.Makes itprovider
• Base the post-market monitoring system on a post-market monitoring plan, and make the plan part of the technical documentation referred to in Annex IV.Makes itprovider
• If your high-risk AI system is covered by the Union harmonisation legislation listed in Section A of Annex I and a post-market monitoring system and plan already exist under that legislation, you may integrate the necessary elements of this Article into them, using the template referred to in Article 72(3), provided that achieves an equivalent level of protection; a financial institution subject to internal-governance requirements under Union financial services law has the same choice for a high-risk AI system referred to in point 5 of Annex III that it places on the market or puts into service.Makes itprovider
• For a high-risk AI system placed on the market or put into service, this duty takes effect on 2 December 2027 for a system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I; a system already on the market before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities. It does not apply to a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply.

Regulation (EU) 2024/1689, Article 73 · Read the law's page

• If you test a high-risk AI system in real-world conditions outside an AI regulatory sandbox, report a serious incident identified in the course of the testing to the national market surveillance authority in accordance with this Article; Article 60(7) applies this from 2 August 2026.Makes itprovider
• If your high-risk AI system is placed on the EU market and you are its provider, report any serious incident to the market surveillance authority of the Member State where the incident occurred.Makes itprovider
• Report a serious incident not later than 15 days after you become aware of it, or immediately once you establish a causal link between your AI system and the incident, or the reasonable likelihood of one, whichever is sooner.Makes itprovider
• Report immediately, and not later than 2 days after becoming aware of it, a widespread infringement or a serious incident causing a serious and irreversible disruption to the management or operation of critical infrastructure.Makes itprovider
• Report a serious incident involving the death of a person not later than 10 days after becoming aware of it, and immediately once you establish, or suspect, a causal link between your AI system and the incident.Makes itRuns itproviderdeployer
• Where necessary for timely reporting, you may submit an initial report that is incomplete, followed by a complete report.Makes itRuns itproviderdeployer
• If you are a deployer of a high-risk AI system and identify a serious incident, Article 26(5) requires you to immediately inform first the provider, then the importer or distributor, and the relevant market surveillance authority; if you cannot reach the provider, report the incident yourself under the same rules that bind a provider. This does not require you to disclose sensitive operational data if you are a law enforcement authority.Runs itdeployer
• After reporting a serious incident, without delay investigate it, including a risk assessment and corrective action, and cooperate with the competent authorities; do not alter the AI system in a way that could affect the investigation before telling the authorities.Makes itprovider
• If your high-risk AI system is, or is a safety component of, a device covered by Regulation (EU) 2017/745 or (EU) 2017/746, report only an incident that infringes obligations under Union law intended to protect fundamental rights, and report it to the national competent authority the Member State chose for that purpose rather than to its market surveillance authority.Makes itprovider
• If your high-risk AI system is within the AI Office's exclusive competence under Article 75(1), report the serious incident to the AI Office instead, on the same schedule. That covers an AI system based on a general-purpose AI model developed by you or by a provider in your undertaking, except an AI system related to a product covered by the Union harmonisation legislation listed in Annex I, one referred to in point 2 of Annex III, one provided by a law enforcement authority, a border management authority or a financial institution so far as Article 74(6) applies, and one referred to in point 8 of Annex III as regards the administration of justice; it also covers an AI system that constitutes or is integrated into a very large online platform or very large online search engine designated under Regulation (EU) 2022/2065.Makes itprovider
• For a high-risk AI system placed on the market or put into service, this duty takes effect on 2 December 2027 for a system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I; a system already on the market before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 74(12) and (13), and Article 77 · Read the law's page

• If you are the provider of a high-risk AI system, grant the market surveillance authorities full access to the documentation and to the training, validation and testing data sets used for the development of the system, where relevant and limited to what is necessary for their tasks, including, where appropriate and subject to security safeguards, through application programming interfaces or other technical means enabling remote access (Article 74(12)); this is without prejudice to the powers provided for under Regulation (EU) 2019/1020.Makes itprovider
• Give a market surveillance authority access to the source code of your high-risk AI system upon its reasoned request, but only when access to the source code is necessary to assess the system's conformity with the requirements of Chapter III, Section 2 and testing or auditing procedures and verifications based on the data and documentation you provided have been exhausted or proved insufficient (Article 74(13)).Makes itprovider
• If you are the provider or deployer of an AI system, a market surveillance authority may request from you the information or documentation that a national public authority or body protecting fundamental rights has requested from it under Article 77(1); Article 77(1a) has the authority obtain that information or documentation, including by requesting it from the provider or the deployer, where necessary and without undue delay.Makes itRuns itproviderdeployer
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.