European UnionAI Act, Articles 80, 82 and 83 (misclassified systems, compliant systems presenting a risk, formal non-compliance)
Regulation (EU) 2024/1689, Articles 80, 82 and 83
An AI risk obligations rule binding public and private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Market targeting, Operator establishment, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
As of .
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- If you are the provider of an AI system you classified as non-high-risk under Article 6(3), and a market surveillance authority, after evaluating the classification against the conditions of Article 6(3) and the Commission guidelines, finds the system high-risk, take without undue delay all necessary actions to bring the system into compliance with the requirements and obligations of the Regulation, and take the appropriate corrective action, within the period the authority prescribes (Article 80(2) and (4)).
- Ensure that all appropriate corrective action is taken in respect of all the AI systems concerned that you have made available on the Union market, if you are the provider of an AI system the authority has found to be high-risk (Article 80(5)).
- If you are the provider or other relevant operator of a high-risk AI system that complies with the Regulation but that the market surveillance authority, after consulting the national public authority referred to in Article 77(1), finds presents a risk to the health or safety of persons, to fundamental rights or to other aspects of public interest protection, take all appropriate measures the authority requires so that the system, when placed on the market or put into service, no longer presents that risk, without undue delay and within the period the authority prescribes (Article 82(1)).
- Ensure that corrective action is taken in respect of all the AI systems concerned that you have made available on the Union market within the timeline the market surveillance authority prescribes (Article 82(2)).
- If you are the provider of a high-risk AI system and the market surveillance authority finds that the CE marking was affixed in violation of Article 48 or was not affixed, that the EU declaration of conformity under Article 47 was not drawn up or not drawn up correctly, that the registration in the EU database under Article 71 was not carried out, that no authorised representative was appointed where applicable, or that technical documentation is not available, put an end to the non-compliance within the period the authority prescribes (Article 83(1)).
- It does not reach an AI system related to a product covered by the Union harmonisation legislation listed in Section A of Annex I where those legal acts already provide for procedures ensuring an equivalent level of protection and having the same objective; the relevant sectoral procedures apply instead (Article 74(4)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Settledness
- As of
- Open questions
- What counts as misclassifying an AI system as non-high-risk 'in order to circumvent the application of requirements in Chapter III, Section 2' under Article 80(7)?
What it makes you log
Logging duty
Articles 80, 82 and 83 set the procedures by which an authority evaluates a classification, a compliant system that presents a risk and formal non-compliance, and require corrective action; they create no logging or record-keeping duty.
- Kind
- None
- As of
What this law does
Where a market surveillance authority has sufficient reason to consider that an AI system the provider classified as non-high-risk under Article 6(3) is in fact high-risk, it must evaluate the system's classification against the conditions of Article 6(3) and the Commission guidelines.
If the evaluation finds the AI system high-risk, the market surveillance authority must without undue delay require the relevant provider to take all necessary actions to bring the system into compliance with the requirements and obligations of the Regulation and to take appropriate corrective action within the period the authority prescribes.
The provider must ensure that all necessary action is taken to bring the AI system into compliance, and a provider that does not bring it into compliance within the period set under Article 80(2) is subject to fines in accordance with Article 99. The provider must ensure that all appropriate corrective action is taken in respect of all the AI systems concerned that it has made available on the Union market.
Where the market surveillance authority establishes in its evaluation that the provider misclassified the AI system as non-high-risk in order to circumvent the application of requirements in Chapter III, Section 2, the provider is subject to fines in accordance with Article 99.
Where the market surveillance authority, after consulting the national public authority referred to in Article 77(1), finds that a high-risk AI system complies with the Regulation but nevertheless presents a risk to the health or safety of persons, to fundamental rights or to other aspects of public interest protection, it must require the relevant operator to take all appropriate measures so that the system, when placed on the market or put into service, no longer presents that risk without undue delay and within a period it may prescribe.
The provider or other relevant operator must ensure that corrective action is taken in respect of all the AI systems concerned that it has made available on the Union market within the timeline the market surveillance authority prescribes.
Where a market surveillance authority finds that the CE marking was affixed in violation of Article 48 or was not affixed, that the EU declaration of conformity was not drawn up or not drawn up correctly, that the registration in the EU database was not carried out, that no authorised representative was appointed where applicable, or that technical documentation is not available, it must require the relevant provider to put an end to the non-compliance within a period it may prescribe.
Where the non-compliance persists, the market surveillance authority must take appropriate and proportionate measures to restrict or prohibit the high-risk AI system's being made available on the market or to ensure that it is recalled or withdrawn from the market without delay.
The procedures in Articles 79 to 83 do not apply to AI systems related to products covered by the Union harmonisation legislation listed in Section A of Annex I where such legal acts already provide for procedures ensuring an equivalent level of protection and having the same objective, and the relevant sectoral procedures apply instead.
Articles 80, 82 and 83 concern high-risk AI systems, and the Digital Omnibus on AI (Regulation (EU) 2026/1744) moved Chapter III, Sections 1 to 3, which hold the Article 6 rules that classify a system as high-risk, to for a system classified under Article 6(2) and Annex III and to for one classified under Article 6(1) and Annex I. The Omnibus also rewrote Article 111(2) so that the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly, and the providers and deployers of a system intended for use by public authorities must take the necessary steps to comply by .
Articles 80, 82 and 83 do not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
Articles 80, 82 and 83 sit in Chapter IX, to which Article 113 gives no date of its own, so the chapter applies from the Regulation's general application date of .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.