Deploys a mental-health chatbot, in the European Union

Regulation (EU) 2024/1689, Article 4 · Read the law's page

• Take measures to support the development of AI literacy among your staff and other people who operate or use AI systems on your behalf, if you are a provider or deployer of an AI system, taking into account their technical knowledge, experience, education and training, the context the AI systems are to be used in, and the persons or groups of persons the AI systems are to be used on.Makes itRuns itproviderdeployer
• This duty does not require you to guarantee any specific level of AI literacy for any individual.Makes itRuns itproviderdeployer

Regulation (EU) 2024/1689, Article 5 · Read the law's page

• Do not place on the market, put into service, or use an AI system that deploys subliminal, manipulative or deceptive techniques to materially distort a person's behaviour in a way that causes or is reasonably likely to cause significant harm.
• Do not place on the market, put into service, or use an AI system that exploits a person's or group's vulnerabilities due to age, disability, or social or economic situation, to materially distort their behaviour in a way that causes or is reasonably likely to cause significant harm.
• Do not place on the market, put into service, or use an AI system to evaluate or classify people by social behaviour or personal characteristics in a way that leads to unjustified or unrelated detrimental treatment (social scoring).
• Do not place on the market, put into service for this specific purpose, or use an AI system to assess or predict a person's risk of committing a crime based solely on profiling or personality traits, unless it supports a human assessment already based on objective, verifiable facts directly linked to criminal activity.
• Do not place on the market, put into service for this specific purpose, or use an AI system to build or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage.
• Do not place on the market, put into service for this specific purpose, or use an AI system to infer emotions in the workplace or in education, except for medical or safety reasons.
• Do not place on the market, put into service for this specific purpose, or use a biometric categorisation system that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation from biometric data, other than any labelling or filtering of lawfully acquired biometric datasets based on biometric data, or categorising of biometric data in the area of law enforcement.
• Do not use 'real-time' remote biometric identification in publicly accessible spaces for law enforcement unless a Member State has provided for it in national law and the use is strictly necessary for a targeted search for specific victims of abduction, trafficking or sexual exploitation or for missing persons, for preventing a specific, substantial and imminent threat to life or physical safety or a genuine terrorist threat, or for localising or identifying a person suspected of an offence listed in Annex II that is punishable in the Member State concerned by a custodial sentence or detention order of at least four years' maximum; and, in the ordinary case, only after prior authorisation from a judicial or independent administrative authority, a completed fundamental rights impact assessment, and EU database registration. In a duly justified urgent case, use may begin before the authorisation is granted, if it is requested without undue delay and at the latest within 24 hours, and before the EU database registration, if it is completed without undue delay.when it serves a public body

Directive (EU) 2023/2673, inserting Article 16d(1), (3) and (4) into Directive 2011/83/EU · Read the law's page

• If you are a trader concluding a financial services contract with a consumer at a distance, give the consumer free of charge, before the contract is concluded, adequate explanations that make it possible to assess whether the proposed contract and ancillary services are adapted to the consumer's needs and financial situation (Article 16d(1)).when it serves a financial business
• If you use online tools, let the consumer request and obtain human intervention at the pre-contractual stage and, in justified cases, after the distance contract is concluded, in the same language as the pre-contractual information (Article 16d(3)).when it serves a financial business
• Be ready to prove that you gave the adequate explanations, since the burden of proof is on the trader (Article 16d(4)).when it serves a financial business
• This Directive is addressed to the Member States (Article 5), which had to adopt and publish the measures necessary to comply with it by 19 December 2025 and apply them from 19 June 2026 (Article 2(1)), so a trader meets these rules through each Member State's national law.

Regulation (EU) 2024/1689, Article 50 · Read the law's page

• If you are a provider of an AI system intended to interact directly with natural persons, design and develop it so that the people it interacts with are informed that they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person, taking into account the circumstances and the context of use (Article 50(1)). This does not apply to an AI system authorized by law to detect, prevent, investigate or prosecute criminal offenses, subject to appropriate safeguards for the rights and freedoms of third parties, unless the system is available for the public to report a criminal offense.Makes itprovider
• If you are a provider of an AI system, including a general-purpose AI system, that generates synthetic audio, image, video or text content, ensure that its outputs are marked in a machine-readable format and detectable as artificially generated or manipulated, using technical solutions that are effective, interoperable, robust and reliable as far as technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art (Article 50(2)). This marking duty is the provider's; a deployer's disclosure duties are in Article 50(3) and (4). It does not apply to the extent the system performs an assistive function for standard editing or does not substantially alter the input data the deployer provided or its semantics, or where authorized by law to detect, prevent, investigate or prosecute criminal offenses.Makes itprovider
• If you are a provider of an AI system that generates synthetic audio, image, video or text content and was placed on the market before 2 August 2026, take the necessary steps to comply with the Article 50(2) marking duty by 2 December 2026 (Article 111(4), inserted by Regulation (EU) 2026/1744).Makes itprovider
• If you are a deployer of an emotion recognition system or a biometric categorisation system, inform the natural persons exposed to it of the operation of the system, and process their personal data in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable (Article 50(3)). This does not apply to an AI system used for biometric categorisation and emotion recognition that is permitted by law to detect, prevent or investigate criminal offenses, subject to appropriate safeguards for the rights and freedoms of third parties and in accordance with Union law.Runs itdeployer
• If you are a deployer of an AI system that generates or manipulates image, audio or video content constituting a deep fake, disclose that the content has been artificially generated or manipulated (Article 50(4)). A deep fake is AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful (Article 3, point (60)). Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the disclosure is limited to the existence of the generated or manipulated content, in an appropriate manner that does not hamper the display or enjoyment of the work. This does not apply where the use is authorized by law to detect, prevent, investigate or prosecute criminal offenses.Runs itdeployer
• If you are a deployer of an AI system that generates or manipulates text that is published with the purpose of informing the public on matters of public interest, disclose that the text has been artificially generated or manipulated (Article 50(4)). This does not apply where the use is authorized by law to detect, prevent, investigate or prosecute criminal offenses, or where the AI-generated content has undergone a process of human review or editorial control and a natural or legal person holds editorial responsibility for the publication of the content.Runs itdeployer
• If you owe the information required by Article 50(1) to (4), provide it to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure, in a form that conforms to the applicable accessibility requirements (Article 50(5)).Makes itRuns itproviderdeployer

Directive (EU) 2024/2853 · Read the law's page

• The Directive does not apply to free and open-source software that you develop or supply outside the course of a commercial activity (Art. 2(2)).
• If you develop or produce software, or have it developed under your name or trademark, and make it available in the course of a commercial activity, you answer as its manufacturer for damage it causes by a defect (Arts. 4(1), 4(10) and 8(1)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect caused by their absence, or by software, updates or upgrades within your control, is not excused because it arose after you placed the product on the market (Art. 11(2)(b) and (c)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 7(2)(f)), and failing a mandatory product safety requirement that protects against the damage suffered presumes it defective (Art. 10(2)(b)).
• Account for what your product learns or acquires after release: the effect of any ability to continue to learn or acquire new features after it is placed on the market is weighed in deciding whether it is defective (Art. 7(2)(c)).
• Keep technical documentation you could produce if a court orders disclosure; failing to disclose presumes the product defective (Arts. 9(1), 10(2)(a)).
• If you are outside the EU, the importer or your authorized representative answers for the product in your place (Art. 8(1)(c)).
• If you substantially modify a product outside its manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 8(2)).
• Do not count on a contract term to limit or exclude your liability to an injured person; Article 15 bars it.
• Be able to show when you placed the product on the market or put it into service: you are not liable if you prove you did not, or that the defect probably did not exist at that time (Art. 11(1)(a) and (c)).

Regulation (EU) 2024/1689, Article 12 · Read the law's page

• Build automatic event logging into a high-risk AI system so it can record events over the system's lifetime, if you are its provider.Makes itprovider
• Design the logging capability to support identifying an emerging risk or a substantial modification, post-market monitoring, and a deployer's monitoring of the system's operation.Makes itprovider
• For a remote biometric identification system, log the start and end date and time of each use, the reference database checked, the input data that produced a match, and the identity of the person who verified the result.Makes itprovider
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 25 · Read the law's page

• If you are a distributor, importer, deployer, or other third party who puts your name or trademark on a high-risk AI system already on the market, makes a substantial modification to one that keeps it high-risk, or changes an AI system's intended purpose so it becomes high-risk, you are treated as its provider and take on the Article 16 provider obligations.
• If you are the initial provider and one of those events happens, closely cooperate with the new provider: make available technical documentation sufficient to assess compliance with Article 16, inform them of known limitations and failure modes, and give them targeted technical access, including for testing and validation, unless you clearly specified that your system was not to be changed into a high-risk one.Makes itprovider
• If you are a product manufacturer and a high-risk AI system is a safety component placed on the market or put into service under your name or trademark, you are treated as its provider.Makes itproduct manufacturer
• If you are the provider of a high-risk AI system, or a third party supplying an AI system, AI model, tool, service, component, or process it integrates, specify by written agreement the necessary information, capabilities, technical access, and other assistance needed for the provider to comply with this Regulation, unless the third party makes the tool, service, process or component available to the public under a free and open-source licence; that exception never covers a general-purpose AI model.
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Regulation (EU) 2024/1689, Article 26(11) · Read the law's page

• If you are the deployer of a high-risk AI system listed in Annex III that makes, or assists in making, a decision about a natural person, inform that person that they are subject to the use of the high-risk AI system.Runs itdeployer
• If the system is used for law enforcement purposes, follow Article 13 of Directive (EU) 2016/680 instead of this duty.Runs itdeployerwhen it serves a public body
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, the only classification this duty reaches, so the later date of 2 August 2028 for one classified under Article 6(1) and Annex I adds no system to it; a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I is outside it too, since under Article 2(2) only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.