Makes public services decisions, in the European Union

Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 · Read the law's page

• Do not subject a natural person to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless it is necessary to enter into or perform a contract with them, is authorised by a law that itself safeguards their rights, or rests on their explicit consent.
• Where relying on the contract-necessity or explicit-consent exception, implement suitable safeguards, at minimum the right to obtain human intervention, to express a point of view, and to contest the decision.controller
• Do not base such a decision on special category data under Article 9(1) unless the data subject gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.
• Tell the data subject, when collecting their data (or, where the data came from another source, within the Article 14(3) period) and on any access request, that this kind of automated decision-making occurs, and give meaningful information about the logic involved, the significance, and the envisaged consequences.controller

Regulation (EU) 2022/2065, Article 37, supplemented by Commission Delegated Regulation (EU) 2024/436 · Read the law's page

• If you are a Commission-designated very large online platform or very large online search engine, commission an independent audit, at your own expense and at least once a year, of your compliance with Chapter III's due diligence obligations, including the systemic-risk mitigation measures for generated and manipulated content, and with any codes of conduct or crisis protocols you have joined.
• Select an auditing organisation that is independent of you and free of conflicts of interest: it must not have supplied you or a legal person connected to you non-audit services related to the matters audited in the twelve months before the audit began, must have committed not to supply them in the twelve months after it is completed, must not have audited you for more than ten consecutive years, and must not be paid on a result-contingent basis.
• Cooperate with the auditing organisation: give it access to the data, premises, and personnel it needs, and do not hamper, unduly influence, or undermine the audit.
• Where the audit report is not positive, adopt an audit implementation report within one month of receiving the operational recommendations, describing the measures you took, or explaining why you did not and what you did instead (Article 37(6)).
• Transmit the audit report and the audit implementation report to your Digital Services Coordinator of establishment and the Commission without undue delay, and make them public, with confidential information removed where necessary, within three months of receiving the audit report.

Regulation (EU) 2024/1689, Article 4 · Read the law's page

• Take measures to support the development of AI literacy among your staff and other people who operate or use AI systems on your behalf, if you are a provider or deployer of an AI system, taking into account their technical knowledge, experience, education and training, the context the AI systems are to be used in, and the persons or groups of persons the AI systems are to be used on.Makes itRuns itproviderdeployer
• This duty does not require you to guarantee any specific level of AI literacy for any individual.Makes itRuns itproviderdeployer

Regulation (EU) 2024/1689, Article 5 · Read the law's page

• Do not place on the market, put into service, or use an AI system that deploys subliminal, manipulative or deceptive techniques to materially distort a person's behaviour in a way that causes or is reasonably likely to cause significant harm.
• Do not place on the market, put into service, or use an AI system that exploits a person's or group's vulnerabilities due to age, disability, or social or economic situation, to materially distort their behaviour in a way that causes or is reasonably likely to cause significant harm.
• Do not place on the market, put into service, or use an AI system to evaluate or classify people by social behaviour or personal characteristics in a way that leads to unjustified or unrelated detrimental treatment (social scoring).
• Do not place on the market, put into service for this specific purpose, or use an AI system to assess or predict a person's risk of committing a crime based solely on profiling or personality traits, unless it supports a human assessment already based on objective, verifiable facts directly linked to criminal activity.
• Do not place on the market, put into service for this specific purpose, or use an AI system to build or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage.
• Do not place on the market, put into service for this specific purpose, or use an AI system to infer emotions in the workplace or in education, except for medical or safety reasons.
• Do not place on the market, put into service for this specific purpose, or use a biometric categorisation system that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation from biometric data, other than any labelling or filtering of lawfully acquired biometric datasets based on biometric data, or categorising of biometric data in the area of law enforcement.
• Do not use 'real-time' remote biometric identification in publicly accessible spaces for law enforcement unless a Member State has provided for it in national law and the use is strictly necessary for a targeted search for specific victims of abduction, trafficking or sexual exploitation or for missing persons, for preventing a specific, substantial and imminent threat to life or physical safety or a genuine terrorist threat, or for localising or identifying a person suspected of an offence listed in Annex II that is punishable in the Member State concerned by a custodial sentence or detention order of at least four years' maximum; and, in the ordinary case, only after prior authorisation from a judicial or independent administrative authority, a completed fundamental rights impact assessment, and EU database registration. In a duly justified urgent case, use may begin before the authorisation is granted, if it is requested without undue delay and at the latest within 24 hours, and before the EU database registration, if it is completed without undue delay.when it serves a public body

Regulation (EU) 2024/1689, Article 4a · Read the law's page

• If you are a provider of a high-risk AI system, you may exceptionally process special categories of personal data to the extent strictly necessary to detect and correct bias under Article 10(2), points (f) and (g), provided all six conditions of Article 4a(1) are met: the bias cannot be effectively addressed with other data, including synthetic or anonymised data; the data is subject to technical re-use limits and state-of-the-art security, including pseudonymisation; the data is secured with strict access controls and documented access; the data is not transmitted, transferred, or otherwise accessed by other parties; the data is deleted once the bias is corrected or its own retention period ends, whichever comes first; and your records of processing activities under the GDPR, the EU institutions data protection regulation, or the law enforcement directive state why the processing was strictly necessary and why other data could not achieve the same result.Makes itprovider
• If you are a provider or deployer of any other AI system or model, or a deployer of a high-risk AI system, you may exceptionally process special categories of personal data under the same conditions, but only to the extent strictly necessary to detect and correct bias likely to affect health and safety, have a negative impact on fundamental rights, or lead to discrimination prohibited under Union law. This paragraph creates no obligation to conduct such bias detection and correction.Makes itRuns itproviderdeployer

Regulation (EU) 2024/1689, Article 59 · Read the law's page

• If you take part in an AI regulatory sandbox, you may process personal data lawfully collected for other purposes solely for the purpose of developing, training and testing certain AI systems in the sandbox, when all of the following conditions are met (Article 59(1)).Makes itprovider
• The AI systems are developed for safeguarding substantial public interest, by a public authority or another natural or legal person, in one or more of these areas: public safety and public health, a high level of protection and improvement of the quality of the environment, energy sustainability, safety and resilience of transport systems and mobility, critical infrastructure and networks, and efficiency and quality of public administration and public services (Article 59(1), point (a)).Makes itprovider
• The data processed are necessary for complying with one or more of the requirements referred to in Chapter III, Section 2, where those requirements cannot effectively be fulfilled by processing anonymised, synthetic or other non-personal data (Article 59(1), point (b)).Makes itprovider
• There are effective monitoring mechanisms to identify whether any high risks to the rights and freedoms of the data subjects, as referred to in Article 35 of Regulation (EU) 2016/679 and Article 39 of Regulation (EU) 2018/1725, may arise during the sandbox experimentation, as well as response mechanisms to promptly mitigate those risks and, where necessary, stop the processing (Article 59(1), point (c)).Makes itprovider
• Any personal data to be processed are in a functionally separate, isolated and protected data processing environment under the control of the prospective provider, and only authorised persons have access to them; the provider can further share the originally collected data only in accordance with Union data protection law, and personal data created in the sandbox cannot be shared outside the sandbox (Article 59(1), points (d) and (e)).Makes itprovider
• The processing of personal data in the sandbox neither leads to measures or decisions affecting the data subjects nor affects the application of their rights laid down in Union law on the protection of personal data (Article 59(1), point (f)).Makes itprovider
• The personal data processed in the sandbox are protected by appropriate technical and organisational measures and deleted once participation in the sandbox has terminated or the personal data has reached the end of its retention period, and the logs of the processing are kept for the duration of the participation in the sandbox, unless provided otherwise by Union or national law (Article 59(1), points (g) and (h)).Makes itprovider
• A complete and detailed description of the process and rationale behind the training, testing and validation of the AI system is kept together with the testing results as part of the technical documentation referred to in Annex IV (Article 59(1), point (i)).Makes itprovider
• A short summary of the AI project developed in the sandbox, its objectives and expected results is published on the website of the competent authorities; this obligation does not cover sensitive operational data in relation to the activities of law enforcement, border control, immigration or asylum authorities (Article 59(1), point (j)).Makes itprovider
• For the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security, under the control and responsibility of law enforcement authorities, the processing of personal data in an AI regulatory sandbox is based on a specific Union or national law and subject to the same cumulative conditions (Article 59(2)).for a public body
• This permission applies from 2 August 2026, the Regulation's general application date: Article 113, as amended by Regulation (EU) 2026/1744, gives Chapter VI, which holds Article 59, no date of its own. For a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation (Article 2(2), as replaced by Regulation (EU) 2026/1744).
• This permission is without prejudice to Union or national law which excludes processing of personal data for other purposes than those explicitly mentioned in that law, and to Union or national law laying down the basis for the processing of personal data necessary for developing, testing or training innovative AI systems or any other legal basis, in compliance with Union law on the protection of personal data (Article 59(3)).

Regulation (EU) 2024/1689, Article 85 · Read the law's page

• This right applies from 2 August 2026, the Regulation's general application date: Article 113, as amended by Regulation (EU) 2026/1744, gives Chapter IX, which holds Article 85, no date of its own.
• If you are a natural or legal person who has grounds to consider that there has been an infringement of the provisions of the Regulation, you may submit a complaint to the relevant market surveillance authority; this is without prejudice to other administrative or judicial remedies.
• The complaint is taken into account for the purpose of conducting market surveillance activities and is handled in line with the dedicated procedures the market surveillance authorities have established, in accordance with Regulation (EU) 2019/1020.

Regulation (EU) 2024/1689, Articles 60 and 61 · Read the law's page

• Conduct the testing without prejudice to the prohibitions under Article 5 and to any ethical review that Union or national law requires.Makes itprovider
• Draw up a real-world testing plan and submit it to the market surveillance authority in the Member State where you will test, and test only after that authority has approved the testing and the plan (Article 60(4), points (a) and (b)).Makes itprovider
• Register the testing in accordance with Article 71(4) with a Union-wide unique single identification number and the information specified in Annex IX; if the system is an Annex III point 1, 6 or 7 system in law enforcement, migration, asylum or border control management, register it in the secure non-public section of the EU database under Article 49(4), point (d), and if it is a point 2 system, register it under Article 49(5) (Article 60(4), point (c)).Makes itprovider
• Be established in the Union or appoint a legal representative who is established in the Union (Article 60(4), point (d)).Makes itprovider
• Transfer data collected and processed for the testing to third countries only with appropriate and applicable safeguards under Union law (Article 60(4), point (e)).Makes itprovider
• Do not test for longer than necessary to achieve the testing's objectives and in any case not longer than six months; you may extend it by six months on prior notification to the market surveillance authority with an explanation of the need (Article 60(4), point (f)).Makes itprovider
• Appropriately protect subjects of the testing who belong to vulnerable groups due to their age or disability (Article 60(4), point (g)).Makes itprovider
• If you test with deployers or prospective deployers, inform them of all aspects of the testing relevant to their decision to participate, give them the instructions for use of the system referred to in Article 13, and conclude an agreement specifying your roles and responsibilities to ensure compliance with the provisions for testing in real world conditions and with other applicable Union and national law (Article 60(4), point (h)).Makes itprovider
• Obtain the subjects' freely-given informed consent in accordance with Article 61 before they participate, after informing them in concise, clear, relevant and understandable terms of the nature and objectives of the testing and the possible inconvenience; its conditions, including the expected duration of their participation; their rights and guarantees, in particular the right to refuse and to withdraw at any time without detriment and without justification; the arrangements for requesting the reversal or disregarding of the system's predictions, recommendations or decisions; and the testing's Union-wide unique single identification number and your contact details or those of your legal representative (Article 61(1)).Makes itprovider
• Date and document the informed consent and give a copy to the subject or the subject's legal representative (Article 61(2)).Makes itprovider
• In the case of law enforcement, where seeking informed consent would prevent the AI system from being tested, make sure the testing itself and its outcome have no negative effect on the subjects and delete their personal data after the test is performed (Article 60(4), point (i)).Makes itprovider
• Make sure the testing is effectively overseen by you and by deployers or prospective deployers through persons who are suitably qualified in the relevant field and have the necessary capacity, training and authority, and that the predictions, recommendations or decisions of the system can be effectively reversed and disregarded (Article 60(4), points (j) and (k)).Makes itprovider
• Let a subject, or the subject's legally designated representative, withdraw from the testing at any time by revoking informed consent, without detriment and without having to provide any justification, and on request delete the subject's personal data immediately and permanently; the withdrawal does not affect the activities already carried out (Article 60(5)).Makes itprovider
• Report any serious incident identified in the course of the testing to the national market surveillance authority in accordance with Article 73, which requires the report immediately after a causal link, or the reasonable likelihood of one, is established and in any event not later than 15 days after you become aware of the incident, not later than two days for a widespread infringement or a serious and irreversible disruption of the management or operation of critical infrastructure, and not later than 10 days after you become aware of it where a person has died (Article 60(7)).Makes itprovider
• Adopt immediate mitigation measures or, failing that, suspend the testing until mitigation takes place, or otherwise terminate it, and establish a procedure for the prompt recall of the AI system upon termination (Article 60(7)).Makes itprovider
• Notify the national market surveillance authority in the Member State where the testing is to be conducted of the suspension or termination of the testing and of the final outcomes (Article 60(8)).Makes itprovider
• These duties apply from 2 August 2026, the Regulation's general application date: Article 113, as amended by Regulation (EU) 2026/1744, gives Chapter VI, which holds Articles 60 and 61, no date of its own.
• It reaches you if you are a provider, or a prospective provider, of a high-risk AI system listed in Annex III, or covered by the Union harmonisation legislation listed in Section A of Annex I, and you test it in real world conditions outside an AI regulatory sandbox at any time before placing it on the market or putting it into service, alone or in partnership with deployers or prospective deployers; the Article 2(8) exclusion for testing before the market does not cover testing in real world conditions.
• The testing and the plan are understood to have been approved if the authority has given no answer within 30 days, but where national law does not provide for tacit approval the testing remains subject to an authorization (Article 60(4), points (a) and (b)).

Regulation (EU) 2024/1689, Articles 79 and 81 · Read the law's page

• Cooperate as necessary with the market surveillance authority, and with the other national public authorities or bodies referred to in Article 77(1), when the authority evaluates your AI system under Article 79(2).
• When the market surveillance authority finds that your AI system does not comply with the requirements and obligations of the Regulation and requires it, take all appropriate corrective actions to bring the system into compliance, to withdraw it from the market or to recall it, within the period the authority prescribes and in any event within the shorter of 15 working days or the period in the relevant Union harmonisation legislation (Article 79(2)).
• Ensure that all appropriate corrective action is taken in respect of all the AI systems concerned that you have made available on the Union market (Article 79(4)).
• These procedures apply from 2 August 2026, the Regulation's general application date: Article 113, as amended by Regulation (EU) 2026/1744, gives Chapter IX, which holds Articles 79 and 81, no date of its own. The requirements and obligations an authority evaluates apply on their own dates, for example Chapter III, Sections 1 to 3 from 2 December 2027 for a system classified under Article 6(2) and Annex III and from 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744).
• It reaches you if you are an operator of an AI system presenting a risk, meaning a product presenting a risk as defined in Article 3, point 19 of Regulation (EU) 2019/1020 in so far as it presents risks to the health or safety, or to fundamental rights, of persons (Article 79(1)); it does not reach an AI system related to a product covered by the Union harmonisation legislation listed in Section A of Annex I where those legal acts already provide for procedures ensuring an equivalent level of protection and having the same objective (Article 74(4)).

COM(2025) 837 final · Read the law's page

• If the Commission's text is adopted as proposed, the GDPR would fold in cookie consent, breach notification to the supervisory authority would be limited to breaches likely to result in a high risk, impact assessment lists, a template and a methodology would be set at EU level, and a solely automated decision under Article 22 would be allowed only on three stated conditions, including contract necessity assessed regardless of whether the decision could be taken otherwise than by solely automated means.
• If the Commission's text is adopted as proposed, information would not be personal data for an entity that cannot identify the natural person to whom it relates, taking into account the means reasonably likely to be used by that entity, and would not become personal for that entity merely because a potential subsequent recipient has such means, and the Commission could specify by implementing act the means and criteria for deciding whether data resulting from pseudonymisation is still personal data for certain entities (Article 3, point 1(a), and new Article 41a of the GDPR).

Directive (EU) 2024/2853 · Read the law's page

• The Directive does not apply to free and open-source software that you develop or supply outside the course of a commercial activity (Art. 2(2)).
• If you develop or produce software, or have it developed under your name or trademark, and make it available in the course of a commercial activity, you answer as its manufacturer for damage it causes by a defect (Arts. 4(1), 4(10) and 8(1)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect caused by their absence, or by software, updates or upgrades within your control, is not excused because it arose after you placed the product on the market (Art. 11(2)(b) and (c)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 7(2)(f)), and failing a mandatory product safety requirement that protects against the damage suffered presumes it defective (Art. 10(2)(b)).
• Account for what your product learns or acquires after release: the effect of any ability to continue to learn or acquire new features after it is placed on the market is weighed in deciding whether it is defective (Art. 7(2)(c)).
• Keep technical documentation you could produce if a court orders disclosure; failing to disclose presumes the product defective (Arts. 9(1), 10(2)(a)).
• If you are outside the EU, the importer or your authorized representative answers for the product in your place (Art. 8(1)(c)).
• If you substantially modify a product outside its manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 8(2)).
• Do not count on a contract term to limit or exclude your liability to an injured person; Article 15 bars it.
• Be able to show when you placed the product on the market or put it into service: you are not liable if you prove you did not, or that the defect probably did not exist at that time (Art. 11(1)(a) and (c)).

Regulation (EU) 2024/1624, Art. 76(5) · Read the law's page

• If you are an obliged entity and adopt decisions resulting from automated processes, including profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679, or from processes involving AI systems as defined in Article 3, point (1), of the Artificial Intelligence Act, limit the data processed by those systems to data obtained pursuant to Chapter III of the Regulation (Article 76(5), point (a)).when it serves a financial business
• Subject any decision to enter or refuse to enter into or maintain a business relationship with a customer, or to carry out or refuse to carry out an occasional transaction for a customer, or to increase or decrease the extent of the customer due diligence measures applied pursuant to Article 20, to meaningful human intervention to ensure the accuracy and appropriateness of the decision (Article 76(5), point (b)).when it serves a financial business
• Let the customer obtain an explanation of the decision you have reached, except in relation to a report as referred to in Article 69 (Article 76(5), point (c)).when it serves a financial business
• Let the customer challenge the decision you have reached, except in relation to a report as referred to in Article 69 (Article 76(5), point (c)).when it serves a financial business
• This duty takes effect on 10 July 2027 (Article 90), except for the obliged entities referred to in Article 3, points (3)(n) and (o), football agents and professional football clubs, for which it takes effect on 10 July 2029 (Article 90).

Regulation (EU) 2024/1689, Article 10 · Read the law's page

• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
• If you are the provider of a high-risk AI system that uses techniques involving the training of AI models, develop it on training, validation and testing data sets that meet the criteria below, whenever you use such data sets.Makes itprovider
• Apply data governance and management practices appropriate to the system's intended purpose, covering your design choices; how you collected the data and, for personal data, why you originally collected it; your data-preparation operations, such as annotation, labelling, cleaning, updating, enrichment and aggregation; the assumptions you made about what the data measures and represents; an assessment of whether the data sets you need are available, sufficient in quantity, and suitable; examination of the data for biases likely to affect health and safety, harm fundamental rights, or lead to discrimination prohibited under Union law, especially where one operation's data outputs become a later operation's inputs; and measures to detect, prevent and mitigate any bias you find.Makes itprovider
• Identify any data gaps or shortcomings that would prevent the system from complying with the Regulation, and say how you will address them.Makes itprovider
• Make your training, validation and testing data sets relevant, sufficiently representative, and as free of errors and as complete as possible for the intended purpose, with statistical properties appropriate to the persons or groups the system is intended to be used on, and take into account the specific geographic, contextual, behavioural or functional setting the system is intended to be used in, to the extent your intended purpose requires it.Makes itprovider
• If your high-risk AI system does not use training techniques, these criteria apply only to its testing data set.Makes itprovider

Regulation (EU) 2024/1689, Article 11 · Read the law's page

• If you are the provider of a high-risk AI system, draw up its technical documentation before you place the system on the market or put it into service, and keep it up to date.Makes itprovider
• Draw up the technical documentation so that it demonstrates the system complies with the Chapter III, Section 2 requirements and gives national competent authorities and notified bodies the information they need, in a clear and comprehensive form, to assess that compliance; include at least the elements set out in Annex IV.Makes itprovider
• If you are an SME, including a start-up, or a small mid-cap enterprise, you may provide the Annex IV elements in a simplified manner; if you choose to, use the simplified technical documentation form the Commission establishes.Makes itprovider
• If your high-risk AI system is related to a product covered by the Union harmonisation legislation listed in Section A of Annex I, draw up a single set of technical documentation that contains both the information this Article requires and the information those legal acts require.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 12 · Read the law's page

• Build automatic event logging into a high-risk AI system so it can record events over the system's lifetime, if you are its provider.Makes itprovider
• Design the logging capability to support identifying an emerging risk or a substantial modification, post-market monitoring, and a deployer's monitoring of the system's operation.Makes itprovider
• For a remote biometric identification system, log the start and end date and time of each use, the reference database checked, the input data that produced a match, and the identity of the person who verified the result.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 13 · Read the law's page

• Design and develop the system so that its operation is sufficiently transparent to enable deployers to interpret its output and use it appropriately, with a type and degree of transparency that supports compliance with the provider and deployer obligations of Section 3.Makes itprovider
• Supply the system with instructions for use in an appropriate digital format or otherwise, containing concise, complete, correct and clear information that is relevant, accessible and comprehensible to deployers.Makes itprovider
• Put in the instructions at least: your identity and contact details, and those of your authorised representative where applicable; the system's characteristics, capabilities and limitations of performance (Article 13(3), point (b)); the changes to the system and its performance that you pre-determined at the initial conformity assessment; the human oversight measures of Article 14, including the technical measures that help deployers interpret the output; the computational and hardware resources needed, the expected lifetime and the necessary maintenance and care measures, including software updates; and, where relevant, a description of the mechanisms that let deployers properly collect, store and interpret the logs in accordance with Article 12.Makes itprovider
• Under the characteristics heading, state the system's intended purpose; the level of accuracy, including its metrics, robustness and cybersecurity against which it has been tested and validated, and any known and foreseeable circumstances that may affect that level; any known or foreseeable circumstance, in use according to the intended purpose or under reasonably foreseeable misuse, that may lead to risks to health, safety or fundamental rights; where applicable, the technical capabilities to explain its output; when appropriate, its performance for specific persons or groups; and, when appropriate, the specifications for the input data and information on the training, validation and testing data sets used.Makes itprovider
• This duty takes effect on 2 December 2027 (Article 113, as amended by Regulation (EU) 2026/1744) for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.
• It reaches you if you are the provider of a high-risk AI system, that is, you develop it, or have it developed, and place it on the market or put it into service under your own name or trademark: Article 16, point (a), makes you responsible for the system complying with the requirements of Section 2, which include Article 13.

Regulation (EU) 2024/1689, Article 14 · Read the law's page

• If you are the provider of a high-risk AI system, design and develop it, including its human-machine interface, so that a natural person can effectively oversee it while it is in use.Makes itprovider
• Build oversight measures proportionate to the system's risks, autonomy and context of use, either into the system itself before it is placed on the market or put into service, or as measures you identify for the deployer to implement.Makes itprovider
• Provide the system to the deployer so that the natural persons assigned to oversee it can understand its capacities and limitations and duly monitor its operation, including detecting and addressing anomalies, dysfunctions and unexpected performance.Makes itprovider
• Provide the system so the assigned overseers can remain aware of the tendency to automatically rely or over-rely on its output, in particular where the system informs a decision a person will make.Makes itprovider
• Provide the system so the assigned overseers can correctly interpret its output.Makes itprovider
• Provide the system so the assigned overseers can decide, in a particular situation, not to use it, or can disregard, override or reverse its output.Makes itprovider
• Provide the system so the assigned overseers can intervene in its operation or interrupt it through a stop button or similar procedure that brings it to a halt in a safe state.Makes itprovider
• For a remote biometric identification system (Annex III point 1(a)), build your oversight measures so that no action or decision is taken on the identification result unless it has been separately verified and confirmed by at least two natural persons with the necessary competence, training and authority, except where the system is used for law enforcement, migration, border control or asylum and Union or national law treats that two-person requirement as disproportionate.Makes itprovider
• If you are a deployer of a high-risk AI system, assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.Runs itdeployer
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 15 · Read the law's page

• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
• If you are the provider of a high-risk AI system, design and develop it to achieve an appropriate level of accuracy, robustness and cybersecurity, held consistently throughout its lifecycle.Makes itprovider
• Declare the levels of accuracy and the relevant accuracy metrics of your high-risk AI system in its accompanying instructions of use.Makes itprovider
• Build your high-risk AI system to be as resilient as possible to errors, faults or inconsistencies, including those arising from its interaction with people or other systems, through technical and organisational measures.Makes itprovider
• If your high-risk AI system continues to learn after it is placed on the market or put into service, develop it to eliminate or reduce as far as possible the risk of biased outputs feeding back into future operations, and put mitigation measures in place for any feedback loop that remains.Makes itprovider
• Make your high-risk AI system resilient against attempts by unauthorised third parties to alter its use, outputs or performance by exploiting vulnerabilities, with technical solutions appropriate to the circumstances and the risk.Makes itprovider
• Where appropriate to the risk, include measures to prevent, detect, respond to, resolve and control for data poisoning, model poisoning, adversarial examples or model evasion, confidentiality attacks and other model flaws.Makes itprovider

Regulation (EU) 2024/1689, Article 16 · Read the law's page

• If you are the provider of a high-risk AI system, indicate your name, registered trade name or registered trade mark and the address at which you can be contacted on the system or, where that is not possible, on its packaging or its accompanying documentation.Makes itprovider
• Upon a reasoned request of a national competent authority, demonstrate that your high-risk AI system conforms with the Chapter III, Section 2 requirements.Makes itprovider
• Ensure that your high-risk AI system complies with accessibility requirements in accordance with Directives (EU) 2016/2102 and (EU) 2019/882.Makes itprovider
• Ensure the system undergoes the relevant conformity assessment procedure under Article 43 before you place it on the market or put it into service, draw up an EU declaration of conformity under Article 47, affix the CE marking under Article 48, and comply with the registration obligations of Article 49(1).Makes itprovider
• Article 16 also makes these your obligations as provider, each set out in its own Article: compliance with the Chapter III, Section 2 requirements, a quality management system under Article 17, keeping the documentation referred to in Article 18, keeping the logs referred to in Article 19 when they are under your control, and the corrective actions and information required by Article 20.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 17 · Read the law's page

• If you are the provider of a high-risk AI system, put in place a quality management system that ensures compliance with the Regulation, documented in a systematic and orderly manner as written policies, procedures and instructions.Makes itprovider
• Cover at least: a regulatory compliance strategy, including conformity assessment and the management of modifications; design, design control and design verification; development, quality control and quality assurance; examination, test and validation procedures before, during and after development, and how often they run; the technical specifications and standards you apply; data management; the Article 9 risk management system; a post-market monitoring system under Article 72; procedures for reporting serious incidents under Article 73; communication with authorities, notified bodies, other operators, customers and other interested parties; record-keeping of all relevant documentation and information; resource management, including security of supply; and an accountability framework for management and other staff.Makes itprovider
• Implement those aspects in proportion to the size of your organization, in particular if you are an SME, including a start-up, or a small mid-cap enterprise, while keeping the degree of rigor and level of protection your systems need to comply.Makes itprovider
• If you are an SME, including a start-up, with no partner enterprises or linked enterprises within the meaning of Recommendation 2003/361/EC, you may comply with certain elements of the quality management system in a simplified manner under Article 63(1); that does not exempt you from any other requirement or obligation of the Regulation, including Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73.Makes itprovider
• If you are already subject to quality management system obligations, or an equivalent function, under relevant sectoral Union law, you may include these aspects in that quality management system.Makes itprovider
• If you are a financial institution subject to internal-governance requirements under Union financial services law, you meet this duty by complying with those internal-governance rules, except that you must still have the risk management system, the post-market monitoring system and the serious-incident reporting procedures of Article 17(1), points (g), (h) and (i); harmonised standards referred to in Article 40 are taken into account to that end.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 18 · Read the law's page

• If you are the provider of a high-risk AI system, keep at the disposal of the national competent authorities, for a period ending 10 years after the system has been placed on the market or put into service: its technical documentation under Article 11; the documentation concerning your quality management system under Article 17; where applicable, the documentation concerning changes approved by notified bodies and the decisions and other documents notified bodies issued; and the EU declaration of conformity under Article 47.Makes itprovider
• If you are a financial institution subject to internal-governance requirements under Union financial services law, maintain the technical documentation as part of the documentation kept under the relevant Union financial services law.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 19 · Read the law's page

• Keep the logs your high-risk AI system automatically generates under Article 12, to the extent they are under your control, if you are its provider.Makes itprovider
• Retain the logs for a period appropriate to the system's intended purpose, at least six months, unless other Union or national law, such as data-protection law, provides otherwise.Makes itprovider
• If you are a financial institution, keep the logs as part of the documentation your sector's internal-governance rules already require.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 20 · Read the law's page

• If you are the provider of a high-risk AI system and consider, or have reason to consider, that a system you have placed on the market or put into service is not in conformity with the Regulation, immediately take the necessary corrective actions to bring it into conformity, withdraw it, disable it or recall it, as appropriate.Makes itprovider
• Inform the distributors of the system and, where applicable, its deployers, your authorised representative and importers accordingly.Makes itprovider
• Where the system presents a risk to the health or safety, or to fundamental rights, of persons within the meaning of Article 79(1) and you become aware of that risk, immediately investigate the causes, in collaboration with the reporting deployer where applicable, and inform the market surveillance authorities competent for the system and, where applicable, the notified body that issued its certificate under Article 44, in particular of the nature of the non-compliance and of any relevant corrective action taken.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 21(1) and (3) · Read the law's page

• If you are the provider of a high-risk AI system, provide a competent authority, when it makes a reasoned request, with all the information and documentation necessary to demonstrate the conformity of the system with the requirements of Chapter III, Section 2 (Article 21(1)).Makes itprovider
• Give that information and documentation in a language which the authority can easily understand, being one of the official languages of the institutions of the Union as indicated by the Member State concerned (Article 21(1)).Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 21(2) · Read the law's page

• Give a competent authority access to the automatically generated logs of your high-risk AI system, to the extent they are under your control, when it makes a reasoned request, if you are the system's provider.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 22(1), (2), (3) except points (b) and (c), and (4) · Read the law's page

• If you are a provider of a high-risk AI system established in a third country, appoint, by written mandate, an authorised representative established in the Union before you make the system available on the Union market (Article 22(1)).Makes itprovider
• Enable your authorised representative to perform the tasks specified in the mandate you gave it (Article 22(2)).Makes itprovider
• Make the mandate empower the authorised representative to carry out the tasks listed in Article 22(3), and to be addressed, in addition to or instead of you, by the competent authorities on all issues related to ensuring compliance with the Regulation.Makes itprovider
• If you are the authorised representative of such a provider, perform the tasks specified in the mandate you received, and provide a copy of the mandate to the market surveillance authorities upon request, in one of the official languages of the institutions of the Union, as indicated by the competent authority (Article 22(3)).Distributes itauthorised representative
• Verify that the EU declaration of conformity referred to in Article 47 and the technical documentation referred to in Article 11 have been drawn up and that an appropriate conformity assessment procedure has been carried out by the provider (Article 22(3), point (a)).Distributes itauthorised representative
• Cooperate with competent authorities, upon a reasoned request, in any action they take in relation to the high-risk AI system, in particular to reduce and mitigate the risks it poses (Article 22(3), point (d)).Distributes itauthorised representative
• Where applicable, comply with the registration obligations referred to in Article 49(1) or, if the provider carries out the registration itself, ensure that the information referred to in point 3 of Section A of Annex VIII is correct (Article 22(3), point (e)).Distributes itauthorised representative
• Terminate the mandate if you consider or have reason to consider that the provider is acting contrary to its obligations under the Regulation, and immediately inform the relevant market surveillance authority and, where applicable, the relevant notified body of the termination and the reasons for it (Article 22(4)).Distributes itauthorised representative
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 22(3), points (b) and (c) · Read the law's page

• Perform the tasks specified in the mandate, which Article 22(3) says must empower you to carry out the tasks in points (b) and (c) below.Distributes itauthorised representative
• Keep at the disposal of the competent authorities and the national authorities or bodies referred to in Article 74(10), for 10 years after the high-risk AI system has been placed on the market or put into service, the contact details of the provider that appointed you, a copy of the EU declaration of conformity, the technical documentation and, if applicable, the certificate issued by the notified body (Article 22(3), point (b)).Distributes itauthorised representative
• When a competent authority makes a reasoned request, provide it with all the information and documentation, including the items listed in the point above, necessary to demonstrate the conformity of the high-risk AI system with the requirements of Section 2, including access to the logs automatically generated by the system, as referred to in Article 12(1), to the extent those logs are under the control of the provider (Article 22(3), point (c)).Distributes itauthorised representative
• This duty takes effect on 2 December 2027 (Article 113, as amended by Regulation (EU) 2026/1744) for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.
• It reaches you if you are the authorised representative of a provider of a high-risk AI system: you are established in the Union and have received and accepted a written mandate from a provider established in a third country, which Article 22(1) requires that provider to appoint before it makes the system available on the Union market.

Regulation (EU) 2024/1689, Article 23 · Read the law's page

• Before you place the system on the market, ensure that it is in conformity with the Regulation by verifying that the provider has carried out the conformity assessment procedure referred to in Article 43, has drawn up the technical documentation in accordance with Article 11 and Annex IV, and has appointed an authorised representative in accordance with Article 22(1), and that the system bears the required CE marking and is accompanied by the EU declaration of conformity referred to in Article 47 and instructions for use (Article 23(1)).Distributes itimporter
• If you have sufficient reason to consider that the system is not in conformity with the Regulation, or is falsified, or is accompanied by falsified documentation, do not place it on the market until it has been brought into conformity (Article 23(2)).Distributes itimporter
• Where the system presents a risk within the meaning of Article 79(1), inform the provider of the system, the authorised representative and the market surveillance authorities (Article 23(2)).Distributes itimporter
• Indicate your name, registered trade name or registered trade mark, and the address at which you can be contacted on the system and on its packaging or its accompanying documentation, where applicable (Article 23(3)).Distributes itimporter
• While the system is under your responsibility, ensure that storage or transport conditions, where applicable, do not jeopardise its compliance with the requirements of Section 2 (Article 23(4)).Distributes itimporter
• Keep, for 10 years after the system has been placed on the market or put into service, a copy of the certificate issued by the notified body, where applicable, of the instructions for use, and of the EU declaration of conformity referred to in Article 47 (Article 23(5)).Distributes itimporter
• Provide the relevant competent authorities, upon a reasoned request, with all the necessary information and documentation, including the items you keep for 10 years, to demonstrate the conformity of the system with the requirements of Section 2, in a language which can be easily understood by them, and ensure that the technical documentation can be made available to those authorities (Article 23(6)).Distributes itimporter
• Cooperate with the relevant competent authorities in any action they take in relation to a system you placed on the market, in particular to reduce and mitigate the risks posed by it (Article 23(7)).Distributes itimporter
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.
• It reaches you if you are an importer of a high-risk AI system: you are located or established in the Union and place on the market an AI system that bears the name or trademark of a natural or legal person established in a third country.

Regulation (EU) 2024/1689, Article 24 · Read the law's page

• Before you make the system available on the market, verify that it bears the required CE marking, that it is accompanied by a copy of the EU declaration of conformity referred to in Article 47 and instructions for use, and that the provider and the importer, as applicable, have complied with their obligations under Article 16, points (b) and (c), and Article 23(3) (Article 24(1)).Distributes itdistributor
• If you consider or have reason to consider, on the basis of the information in your possession, that the system is not in conformity with the requirements of Section 2, do not make it available on the market until it has been brought into conformity; where it presents a risk within the meaning of Article 79(1), also inform the provider or the importer, as applicable (Article 24(2)).Distributes itdistributor
• While the system is under your responsibility, ensure that storage or transport conditions, where applicable, do not jeopardise its compliance with the requirements of Section 2 (Article 24(3)).Distributes itdistributor
• If you consider or have reason to consider that a system you have made available on the market is not in conformity with the requirements of Section 2, take the corrective actions necessary to bring it into conformity, to withdraw it or recall it, or ensure that the provider, the importer or any relevant operator, as appropriate, takes them (Article 24(4)).Distributes itdistributor
• Where such a system presents a risk within the meaning of Article 79(1), immediately inform the provider or importer and the authorities competent for the system, giving details, in particular, of the non-compliance and of any corrective actions taken (Article 24(4)).Distributes itdistributor
• Upon a reasoned request from a relevant competent authority, provide it with all the information and documentation regarding your actions under Article 24(1) to (4) that are necessary to demonstrate the conformity of the system with the requirements of Section 2 (Article 24(5)).Distributes itdistributor
• Cooperate with the relevant competent authorities in any action they take in relation to a system you made available on the market, in particular to reduce or mitigate the risk posed by it (Article 24(6)).Distributes itdistributor
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.
• It reaches you if you are a distributor of a high-risk AI system: you are a natural or legal person in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market.

Regulation (EU) 2024/1689, Article 25 · Read the law's page

• If you are a distributor, importer, deployer, or other third party who puts your name or trademark on a high-risk AI system already on the market, makes a substantial modification to one that keeps it high-risk, or changes an AI system's intended purpose so it becomes high-risk, you are treated as its provider and take on the Article 16 provider obligations.
• If you are the initial provider and one of those events happens, closely cooperate with the new provider: make available technical documentation sufficient to assess compliance with Article 16, inform them of known limitations and failure modes, and give them targeted technical access, including for testing and validation, unless you clearly specified that your system was not to be changed into a high-risk one.Makes itprovider
• If you are a product manufacturer and a high-risk AI system is a safety component placed on the market or put into service under your name or trademark, you are treated as its provider.Makes itproduct manufacturer
• If you are the provider of a high-risk AI system, or a third party supplying an AI system, AI model, tool, service, component, or process it integrates, specify by written agreement the necessary information, capabilities, technical access, and other assistance needed for the provider to comply with this Regulation, unless the third party makes the tool, service, process or component available to the public under a free and open-source licence; that exception never covers a general-purpose AI model.
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 26(1) to (5) · Read the law's page

• If you are the deployer of a high-risk AI system, take appropriate technical and organisational measures to ensure you use it in accordance with the provider's instructions for use.Runs itdeployer
• If you are the deployer of a high-risk AI system, assign its human oversight to natural persons who have the necessary competence, training and authority, and give them the necessary support.Runs itdeployer
• If you are the deployer of a high-risk AI system and you exercise control over its input data, ensure that input data is relevant and sufficiently representative in view of the system's intended purpose.Runs itdeployer
• If you are the deployer of a high-risk AI system, monitor its operation on the basis of the provider's instructions for use, and inform the provider where relevant.Runs itdeployer
• Where you have reason to consider that using the system per its instructions may present a risk to health, safety or fundamental rights, inform the provider or distributor and the relevant market surveillance authority without undue delay, and suspend use of the system.Runs itdeployer
• Where you have identified a serious incident, immediately inform first the provider, then the importer or distributor and the relevant market surveillance authorities; if you cannot reach the provider, report the incident yourself as Article 73 requires of a provider.Runs itdeployer
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.
• This duty, and your duty to assign human oversight, do not override any other deployer obligation under Union or national law, and do not limit your freedom to organise your own resources and activities when implementing the provider's human oversight measures.
• This duty does not require disclosing your sensitive operational data if you are a law enforcement authority.
• If you are a financial institution subject to internal-governance requirements under Union financial services law, you satisfy this monitoring duty by complying with those rules.

Regulation (EU) 2024/1689, Article 26(10) · Read the law's page

• If you are a law enforcement deployer using a high-risk AI system for post-remote biometric identification in a targeted search for a suspected or convicted person, request authorisation from a judicial authority or a binding, judicially reviewable administrative authority, in advance or without undue delay and no later than 48 hours, unless you are using the system only for the initial identification of a potential suspect on objective and verifiable facts directly linked to the offence.Runs itdeployerfor a public body
• Limit each use to what is strictly necessary for the investigation of a specific criminal offence.Runs itdeployerfor a public body
• If the authorisation is rejected, stop the linked use immediately and delete the personal data the use generated.Runs itdeployerwhen it serves a public body
• Never use such a system in an untargeted way, without any link to a criminal offence, a criminal proceeding, a genuine threat of one, or the search for a specific missing person.Runs itdeployerfor a public body
• Do not take, or let a law enforcement authority take, any decision producing an adverse legal effect on a person based solely on the system's output.Runs itdeployer
• Document every use in the relevant police file, and make it available to the market surveillance authority and the national data protection authority on request, excluding sensitive operational data.Runs itdeployerwhen it serves a public body
• Submit annual reports to the relevant market surveillance and data protection authorities on your use of post-remote biometric identification systems.Runs itdeployerwhen it serves a public body
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 26(11) · Read the law's page

• If you are the deployer of a high-risk AI system listed in Annex III that makes, or assists in making, a decision about a natural person, inform that person that they are subject to the use of the high-risk AI system.Runs itdeployer
• If the system is used for law enforcement purposes, follow Article 13 of Directive (EU) 2016/680 instead of this duty.Runs itdeployerwhen it serves a public body
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, the only classification this duty reaches, so the later date of 2 August 2028 for one classified under Article 6(1) and Annex I adds no system to it; a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I is outside it too, since under Article 2(2) only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 26(6) · Read the law's page

• Keep the logs your high-risk AI system automatically generates, to the extent they are under your control, if you are its deployer.Runs itdeployer
• Retain the logs for a period appropriate to the system's intended purpose, at least six months, unless other Union or national law, such as data-protection law, provides otherwise.Runs itdeployer
• If you are a financial institution, keep the logs as part of the documentation your sector's internal-governance rules already require.Runs itdeployer
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 26(9) · Read the law's page

• If you are the deployer of a high-risk AI system and you are separately required to carry out a data protection impact assessment under the GDPR or the Law Enforcement Directive, use the information the provider supplies you under Article 13 in that assessment.Runs itdeployer
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 27 · Read the law's page

• If you are a body governed by public law, a private entity providing a public service, or a deployer of a credit-scoring or life-and-health-insurance-risk-pricing high-risk AI system (Annex III points 5(b) or (c)), assess the impact on fundamental rights of a high-risk AI system before its first use, unless the system is the Annex III point 2 critical-infrastructure use case.Runs itdeployer
• Cover in that assessment: your intended process for using the system, the period and frequency of use, the categories of people likely affected, the specific risks of harm to them, your human oversight measures, and the steps you would take if those risks materialise, including complaint and internal-governance arrangements.Runs itdeployer
• Update the assessment if any of those elements changes during use, rather than treating it as a one-time exercise.Runs itdeployer
• Once you have performed the assessment, notify the market surveillance authority of its results using the AI Office's template, unless you are exempt, which Article 27(3) allows in the case referred to in Article 46(1), where a market surveillance authority has authorised the system for exceptional reasons such as public security or the protection of life and health.Runs itdeployer
• If a data protection impact assessment you already owe under the GDPR or the Law Enforcement Directive covers part of this assessment, let this one complement rather than duplicate it.Runs itdeployer
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, the only classification this duty reaches, so the later date of 2 August 2028 for one classified under Article 6(1) and Annex I adds no system to it; a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I is outside it too, since under Article 2(2) only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 43 · Read the law's page

• If your system is listed in point 1 of Annex III (biometrics) and, in demonstrating compliance with Section 2, you applied the harmonised standards of Article 40 or, where applicable, the common specifications of Article 41, choose between the procedure based on internal control in Annex VI and the procedure of Annex VII, which involves a notified body.Makes itprovider
• If your system is listed in point 1 of Annex III, follow the Annex VII procedure, rather than choosing, if harmonised standards do not exist and common specifications are not available, if you did not apply the harmonised standard or applied only part of it, if you did not apply existing common specifications, or, as to the restricted part, if a harmonised standard was published with a restriction.Makes itprovider
• For the Annex VII procedure under point 1 of Annex III you may choose any notified body; where the system is intended to be put into service by law enforcement, immigration or asylum authorities or by Union institutions, bodies, offices or agencies, the market surveillance authority referred to in Article 74(8) or (9), as applicable, acts as the notified body.Makes itprovider
• If your system is referred to in points 2 to 8 of Annex III, follow the conformity assessment procedure based on internal control in Annex VI, which does not involve a notified body: verify that your quality management system complies with Article 17, examine the technical documentation to assess the system's compliance with the Section 2 requirements, and verify that the design and development process and the post-market monitoring under Article 72 are consistent with the technical documentation.Makes itprovider
• If your system is covered by the Union harmonisation legislation listed in Section A of Annex I, follow the conformity assessment procedure that legislation requires, with the Section 2 requirements as part of the assessment, and also undertake the assessment of the quality management system set out in Article 17, to which points 3, 4.3, 4.4 and 4.5, the fifth paragraph of point 4.6 and point 5 of Annex VII apply; if the system also falls within an Annex III category, follow the Section A procedure.Makes itprovider
• Where that legislation lets the manufacturer opt out of a third-party conformity assessment on the basis of harmonised standards, use the option only if you have also applied harmonised standards or, where applicable, common specifications referred to in Article 41, covering all the requirements set out in Section 2.Makes itproviderproduct manufacturer
• Undergo a new conformity assessment procedure if you substantially modify a high-risk AI system that has already been assessed, whether or not the modified system is intended to be further distributed or continues to be used by the current deployer; for a system that continues to learn after it is placed on the market or put into service, changes you pre-determined at the initial assessment and set out in the technical documentation under point 2(f) of Annex IV are not a substantial modification.Makes itprovider
• Under the Annex VII procedure, allow the notified body to access the premises where the system is designed, developed and tested, share all necessary information with it, and inform the notified body that issued the certificate of any change you intend to introduce, or become aware of, that could affect compliance with the requirements or the intended purpose.Makes itprovider
• This duty takes effect on 2 December 2027 (Article 113, as amended by Regulation (EU) 2026/1744, read with Article 16, point (f)) for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.
• It reaches you if you are the provider of a high-risk AI system, that is, you develop it, or have it developed, and place it on the market or put it into service under your own name or trademark: Article 16, point (f), requires you to have the system undergo the relevant conformity assessment procedure of Article 43 before you place it on the market or put it into service.

Regulation (EU) 2024/1689, Article 6(3) and (4) · Read the law's page

• If your AI system is listed in Annex III but performs only a narrow procedural task, improves the result of a previously completed human activity, detects deviations from prior human decision-making patterns and is not meant to replace or influence the previously completed human assessment without proper human review, or performs a preparatory task to an Annex III assessment, and does not pose a significant risk of harm, you may treat it as not high-risk, unless it profiles natural persons, in which case it is always high-risk.Makes itprovider
• Document your assessment that the system is not high-risk before placing it on the market or putting it into service.Makes itprovider
• You are subject to the Article 49(2) EU database registration obligation.Makes itprovider
• Provide the documentation of your assessment to national competent authorities on request.Makes itprovider
• This duty takes effect on 2 December 2027 (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744) for a system classified as high-risk under Article 6(2) and Annex III, the only route Article 6(3) and (4) concern, so the later date of 2 August 2028 for one classified under Article 6(1) and Annex I adds no system to it; a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I is outside it too, since under Article 2(2) only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 72 · Read the law's page

• If you are the provider of a high-risk AI system, establish and document a post-market monitoring system proportionate to the nature of the AI technologies and the risks of the system.Makes itprovider
• Have the system actively and systematically collect, document and analyze relevant data on the system's performance throughout its lifetime, whether provided by deployers or collected through other sources, so that you can evaluate its continuous compliance with the Chapter III, Section 2 requirements; where relevant, include an analysis of its interaction with other AI systems. This does not cover sensitive operational data of deployers that are law-enforcement authorities.Makes itprovider
• Base the post-market monitoring system on a post-market monitoring plan, and make the plan part of the technical documentation referred to in Annex IV.Makes itprovider
• If your high-risk AI system is covered by the Union harmonisation legislation listed in Section A of Annex I and a post-market monitoring system and plan already exist under that legislation, you may integrate the necessary elements of this Article into them, using the template referred to in Article 72(3), provided that achieves an equivalent level of protection; a financial institution subject to internal-governance requirements under Union financial services law has the same choice for a high-risk AI system referred to in point 5 of Annex III that it places on the market or puts into service.Makes itprovider
• For a high-risk AI system placed on the market or put into service, this duty takes effect on 2 December 2027 for a system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I; a system already on the market before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities. It does not apply to a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply.

Regulation (EU) 2024/1689, Article 73 · Read the law's page

• If you test a high-risk AI system in real-world conditions outside an AI regulatory sandbox, report a serious incident identified in the course of the testing to the national market surveillance authority in accordance with this Article; Article 60(7) applies this from 2 August 2026.Makes itprovider
• If your high-risk AI system is placed on the EU market and you are its provider, report any serious incident to the market surveillance authority of the Member State where the incident occurred.Makes itprovider
• Report a serious incident not later than 15 days after you become aware of it, or immediately once you establish a causal link between your AI system and the incident, or the reasonable likelihood of one, whichever is sooner.Makes itprovider
• Report immediately, and not later than 2 days after becoming aware of it, a widespread infringement or a serious incident causing a serious and irreversible disruption to the management or operation of critical infrastructure.Makes itprovider
• Report a serious incident involving the death of a person not later than 10 days after becoming aware of it, and immediately once you establish, or suspect, a causal link between your AI system and the incident.Makes itRuns itproviderdeployer
• Where necessary for timely reporting, you may submit an initial report that is incomplete, followed by a complete report.Makes itRuns itproviderdeployer
• If you are a deployer of a high-risk AI system and identify a serious incident, Article 26(5) requires you to immediately inform first the provider, then the importer or distributor, and the relevant market surveillance authority; if you cannot reach the provider, report the incident yourself under the same rules that bind a provider. This does not require you to disclose sensitive operational data if you are a law enforcement authority.Runs itdeployer
• After reporting a serious incident, without delay investigate it, including a risk assessment and corrective action, and cooperate with the competent authorities; do not alter the AI system in a way that could affect the investigation before telling the authorities.Makes itprovider
• If your high-risk AI system is, or is a safety component of, a device covered by Regulation (EU) 2017/745 or (EU) 2017/746, report only an incident that infringes obligations under Union law intended to protect fundamental rights, and report it to the national competent authority the Member State chose for that purpose rather than to its market surveillance authority.Makes itprovider
• If your high-risk AI system is within the AI Office's exclusive competence under Article 75(1), report the serious incident to the AI Office instead, on the same schedule. That covers an AI system based on a general-purpose AI model developed by you or by a provider in your undertaking, except an AI system related to a product covered by the Union harmonisation legislation listed in Annex I, one referred to in point 2 of Annex III, one provided by a law enforcement authority, a border management authority or a financial institution so far as Article 74(6) applies, and one referred to in point 8 of Annex III as regards the administration of justice; it also covers an AI system that constitutes or is integrated into a very large online platform or very large online search engine designated under Regulation (EU) 2022/2065.Makes itprovider
• For a high-risk AI system placed on the market or put into service, this duty takes effect on 2 December 2027 for a system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I; a system already on the market before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 74(12) and (13), and Article 77 · Read the law's page

• If you are the provider of a high-risk AI system, grant the market surveillance authorities full access to the documentation and to the training, validation and testing data sets used for the development of the system, where relevant and limited to what is necessary for their tasks, including, where appropriate and subject to security safeguards, through application programming interfaces or other technical means enabling remote access (Article 74(12)); this is without prejudice to the powers provided for under Regulation (EU) 2019/1020.Makes itprovider
• Give a market surveillance authority access to the source code of your high-risk AI system upon its reasoned request, but only when access to the source code is necessary to assess the system's conformity with the requirements of Chapter III, Section 2 and testing or auditing procedures and verifications based on the data and documentation you provided have been exhausted or proved insufficient (Article 74(13)).Makes itprovider
• If you are the provider or deployer of an AI system, a market surveillance authority may request from you the information or documentation that a national public authority or body protecting fundamental rights has requested from it under Article 77(1); Article 77(1a) has the authority obtain that information or documentation, including by requesting it from the provider or the deployer, where necessary and without undue delay.Makes itRuns itproviderdeployer
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 86 · Read the law's page

• If you are the deployer of a high-risk AI system listed in Annex III, other than the Annex III point 2 critical-infrastructure use case, and your decision based on the system's output produces a legal effect, or similarly significantly affects a person in a way they consider to adversely impact their health, safety or fundamental rights, give that person, on request, a clear and meaningful explanation of the AI system's role in the decision-making procedure and the main elements of the decision.Runs itdeployer
• For a decision based on a high-risk AI system placed on the market or put into service, this right takes effect on 2 December 2027 for a system classified under Article 6(2) and Annex III; a system already on the market before then is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.
• You do not owe this explanation where Union or national law, consistent with Union law, provides an exception or restriction, or where the person already holds an equivalent right under other Union law.

Regulation (EU) 2024/1689, Article 9 · Read the law's page

• If you are the provider of a high-risk AI system, establish, implement, document, and maintain a risk management system for it, run as a continuous process across its whole lifecycle with regular review and updates.Makes itprovider
• Identify and analyze the known and reasonably foreseeable risks the system can pose to health, safety, or fundamental rights under its intended use, and estimate and evaluate risks that may emerge under intended use and reasonably foreseeable misuse.Makes itprovider
• Fold in other risks surfaced by your post-market monitoring data, and adopt targeted risk management measures for the risks you identified.Makes itprovider
• Bring residual risk, per hazard and overall, down to an acceptable level: eliminate or reduce risk through design and development where technically feasible, then mitigate or control what cannot be eliminated, then provide required information and, where appropriate, deployer training, taking the deployer's likely expertise and context of use into account.Makes itprovider
• Test the system to confirm your risk management measures work, that the system performs consistently for its intended purpose, and that it meets the Section 2 requirements; you may use real-world testing under Article 60 for this. Test throughout development and, in any event, before placing the system on the market or putting it into service, against metrics and probabilistic thresholds set in advance.Makes itprovider
• Consider whether the system is likely to adversely affect persons under 18 or other vulnerable groups, given its intended purpose, when implementing your risk management system.Makes itprovider
• If you are already subject to an internal risk-management regime under other Union law, for example as a provider of a device covered by Annex I harmonisation legislation, you may combine this risk management system with your existing one rather than running two.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Articles 80, 82 and 83 · Read the law's page

• If you are the provider of an AI system you classified as non-high-risk under Article 6(3), and a market surveillance authority, after evaluating the classification against the conditions of Article 6(3) and the Commission guidelines, finds the system high-risk, take without undue delay all necessary actions to bring the system into compliance with the requirements and obligations of the Regulation, and take the appropriate corrective action, within the period the authority prescribes (Article 80(2) and (4)).Makes itprovider
• Ensure that all appropriate corrective action is taken in respect of all the AI systems concerned that you have made available on the Union market, if you are the provider of an AI system the authority has found to be high-risk (Article 80(5)).Makes itprovider
• If you are the provider or other relevant operator of a high-risk AI system that complies with the Regulation but that the market surveillance authority, after consulting the national public authority referred to in Article 77(1), finds presents a risk to the health or safety of persons, to fundamental rights or to other aspects of public interest protection, take all appropriate measures the authority requires so that the system, when placed on the market or put into service, no longer presents that risk, without undue delay and within the period the authority prescribes (Article 82(1)).
• Ensure that corrective action is taken in respect of all the AI systems concerned that you have made available on the Union market within the timeline the market surveillance authority prescribes (Article 82(2)).
• If you are the provider of a high-risk AI system and the market surveillance authority finds that the CE marking was affixed in violation of Article 48 or was not affixed, that the EU declaration of conformity under Article 47 was not drawn up or not drawn up correctly, that the registration in the EU database under Article 71 was not carried out, that no authorised representative was appointed where applicable, or that technical documentation is not available, put an end to the non-compliance within the period the authority prescribes (Article 83(1)).Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.
• It does not reach an AI system related to a product covered by the Union harmonisation legislation listed in Section A of Annex I where those legal acts already provide for procedures ensuring an equivalent level of protection and having the same objective; the relevant sectoral procedures apply instead (Article 74(4)).

Regulation (EU) 2024/1689, Article 6(1) and Annex I · Read the law's page

• Treat the system as a high-risk AI system and meet the obligations of a provider under Article 16, each set out in its own Article: ensure the system complies with the Chapter III, Section 2 requirements, have a quality management system (Article 17), keep the documentation (Article 18) and the logs under your control (Article 19), take corrective actions and provide information (Article 20), draw up an EU declaration of conformity (Article 47), affix the CE marking (Article 48), comply with the registration obligations of Article 49(1), and ensure the system complies with the accessibility requirements of Directives (EU) 2016/2102 and (EU) 2019/882.Makes itprovider
• Follow the conformity assessment procedure that the Union harmonisation legislation listed in Section A of Annex I requires for the product, with the Chapter III, Section 2 requirements as part of that assessment, and also undertake the assessment of the quality management system set out in Article 17 (Article 43(3)).Makes itprovider
• This duty takes effect on 2 August 2028 (Article 113, third paragraph, point (c)(ii), as replaced by Regulation (EU) 2026/1744) for a high-risk AI system classified under Article 6(1) and Annex I, the only classification Article 6(1) reaches, so the earlier date of 2 December 2027 for one classified under Article 6(2) and Annex III adds no system to it; for a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, under Article 2(2) only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.
• It reaches you if you are the provider of an AI system that you intend to be used as a safety component of a product, or that is itself a product, covered by the Union harmonisation legislation listed in Annex I, where that product is required to undergo a third-party conformity assessment, with a view to its placing on the market or putting into service, pursuant to that legislation: Article 6(1) makes it a high-risk AI system whether or not you place it on the market independently of the product, and you are its provider if you develop it, or have it developed, and place it on the market or put it into service under your own name or trademark.

Regulation (EU) 2025/327, Article 27(2) · Read the law's page

• This duty takes effect on 26 March 2029 for the priority categories of personal electronic health data in Article 14(1), points (a), (b) and (c), and for EHR systems intended by the manufacturer to process them, and on 26 March 2031 for the categories in points (d), (e) and (f) (Article 105).
• If you are a provider of an AI system considered high-risk under Article 6 of Regulation (EU) 2024/1689, outside the scope of Regulation (EU) 2017/745 or (EU) 2017/746, and you claim interoperability of the system with the harmonised software components of EHR systems, prove compliance with the essential requirements on the European interoperability software component and the European logging software component in Section 2 of Annex II (Article 27(2)).

Regulation (EU) 2024/1689, Article 111(2) · Read the law's page

• If you are a provider or deployer of a high-risk AI system intended to be used by public authorities, and the system was placed on the market or put into service before Chapter III applies to it, take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030, regardless of whether the system is later significantly redesigned.Makes itRuns itproviderdeployer