Foreword 5
Chapter I. General provisions 15
Article 1 Subject matter 15
Article 2 Scope 21
Article 3 Definitions 33
Article 4 AI literacy 72
Chapter II. Prohibited AI practices 75
Article 5 Prohibited Artificial Intelligence Practices 75
Chapter III. High-risk AI systems 89
Section 1. Classification of AI systems as high-risk 89
Article 6 Classification rules for high-risk AI systems 89
Article 7 Amendments to Annex III 94
Section 2. Requirements for high-risk AI systems 97
Article 8 Compliance with the requirements 97
Article 9 Risk management system 99
Article 10 Data and data governance 103
Article 11 Technical documentation 110
Article 12 Record-keeping 111
Article 13 Transparency and provision of information to deployers 113
Article 14 Human oversight 117
Article 15 Accuracy, robustness and cybersecurity 120
Section 3. Obligations of providers and deployers of high-risk AI systems and other parties 124
Article 16 Obligations of providers of high-risk AI systems 124
Article 17 Quality management system 127
Article 18 Documentation keeping 131
Article 19 Automatically generated logs 132
Article 20 Corrective actions and duty of information 133
Article 21 Cooperation with competent authorities 134
Article 22 Authorised representatives of providers of high-risk AI systems 135
Article 23 Obligations of importers 137
Article 24 Obligations of distributors 140
Article 25 Responsibilities along the AI value chain 142
Article 26 Obligations of deployers of high-risk AI systems 146
Article 27 Fundamental rights impact assessment for high-risk AI systems 153
Section 4. Notifying authorities and notified bodies 159
Article 28 Notifying authorities 159
Article 29 Application of a conformity assessment body for notification 160
Article 30 Notification procedure 161
Article 31 Requirements relating to notified bodies 163
Article 32 Presumption of conformity with requirements relating to notified bodies 166
Article 33 Subsidiaries of notified bodies and subcontracting 166
Article 34 Operational obligations of notified bodies 167
Article 35 Identification numbers and lists of notified bodies 168
Article 36 Changes to notifications 168
Article 37 Challenge to the competence of notified bodies 172
Article 38 Coordination of notified bodies 173
Article 39 Conformity assessment bodies of third countries 174
Section 5. Standards, conformity assessment, certificates, registration 174
Article 40 Harmonised standards and standardisation deliverables 174
Article 41 Common specifications 177
Article 42 Presumption of conformity with certain requirements 180
Article 43 Conformity assessment 181
Article 44 Certificates 185
Article 45 Information obligations of notified bodies 186
Article 46 Derogation from conformity assessment procedure 187
Article 47 EU declaration of conformity 189
Article 48 CE marking 191
Article 49 Registration 192
CHAPTER IV. Transparency obligations for providers and deployers of certain AI systems 195
Article 50 Transparency obligations for providers and deployers of certain AI systems 195
CHAPTER V. General-purpose AI models 203
Section 1. Classification rules 203
Article 51 Classification of general-purpose AI models as general-purpose
AI models with systemic risk 203
Article 52 Procedure 206
Section 2. Obligations for providers of general-purpose AI models 208
Article 53 Obligations for providers of general-purpose AI models 208
Article 54 Authorised representatives of providers of general-purpose AI models 212
Section 3. Obligations for providers of general-purpose AI models with systemic risk 214
Article 55 Obligations for providers of general-purpose AI models with systemic risk 214
Section 4. Codes of practice 216
Article 56 Codes of practice 216
CHAPTER VI. Measures in support of innovation 221
Article 57 AI regulatory sandboxes 221
Article 58 Detailed arrangements for and functioning of AI regulatory sandboxes 227
Article 59 Further processing of personal data for developing certain
AI systems in the public interest in the AI regulatory sandbox 230
Article 60 Testing of high-risk AI systems in real world conditions outside AI regulatory sandboxes 233
Article 61 Informed consent to participate in testing in real world conditions outside AI regulatory sandboxes 239
Article 62 Measures for providers and deployers, in particular SMEs, including start-ups 240
Article 63 Derogations for specific operators 242
CHAPTER VII. Governance 245
Section 1. Governance at Union level 245
Article 64 AI Office 245
Article 65 Establishment and structure of the European Artificial Intelligence Board 246
Article 66 Tasks of the Board 249
Article 67 Advisory forum 251
Article 68 Scientific panel of independent experts 252
Article 69 Access to the pool of experts by the Member States 255
Section 2. Competent authorities 256
Article 70 Designation of competent authorities and single points of contact 256
CHAPTER VIII. EU database for high-risk AI systems 259
Article 71 EU database for high-risk AI systems listed in Annex III 259
CHAPTER IX. Post-market monitoring, information sharing and market surveillance 261
Section 1. Post-market monitoring 261
Article 72 Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems 261
Section 2. Sharing of information on serious incidents 263
Article 73 Reporting of serious incidents 263
Section 3. Enforcement 266
Article 74 Market surveillance and control of AI systems in the Union market 266
Article 75 Mutual assistance, market surveillance and control of general-purpose AI systems 272
Article 76 Supervision of testing in real world conditions by market surveillance authorities 273
Article 77 Powers of authorities protecting fundamental rights 275
Article 78 Confidentiality 276
Article 79 Procedure at national level for dealing with AI systems presenting a risk 280
Article 80 Procedure for dealing with AI systems classified by the provider as non-high-risk in application of
Annex III 284
Article 81 Union safeguard procedure 286
Article 82 Compliant AI systems which present a risk 287
Article 83 Formal non-compliance 288
Article 84 Union AI testing support structures 289
Section 4. Remedies 290
Article 85 Right to lodge a complaint with a market surveillance authority 290
Article 86 Right to explanation of individual decision-making 290
Article 87 Reporting of infringements and protection of reporting persons 292
Section 5. Supervision, investigation, enforcement and monitoring in respect of providers of general-purpose AI models 293
Article 88 Enforcement of the obligations of providers of general-purpose AI models 293
Article 89 Monitoring actions 294
Article 90 Alerts of systemic risks by the scientific panel 294
Article 91 Power to request documentation and information 296
Article 92 Power to conduct evaluations 297
Article 93 Power to request measures 299
Article 94 Procedural rights of economic operators of the general-purpose
AI model 300
CHAPTER X. Codes of conduct and guidelines 301
Article 95 Codes of conduct for voluntary application of specific requirements 301
Article 96 Guidelines from the Commission on the implementation of this Regulation 304
CHAPTER XI. Delegation of power and committee procedure 307
Article 97 Exercise of the delegation 307
Article 98 Committee procedure 309
CHAPTER XII. Penalties 311
Article 99 Penalties 311
Article 100 Administrative fines on Union institutions, bodies, offices and agencies 316
Article 101 Fines for providers of general-purpose AI models 318
CHAPTER XIII. Final provisions 321
Article 102 Amendment to Regulation (EC) No 300/2008 321
Article 103 Amendment to Regulation (EU) No 167/2013 321
Article 104 Amendment to Regulation (EU) No 168/2013 322
Article 105 Amendment to Directive 2014/90/EU 322
Article 106 Amendment to Directive (EU) 2016/797 323
Article 107 Amendment to Regulation (EU) 2018/858 323
Article 108 Amendments to Regulation (EU) 2018/1139 324
Article 109 Amendment to Regulation (EU) 2019/2144 325
Article 110 Amendment to Directive (EU) 2020/1828 326
Article 111 AI systems already placed on the market or put into service and general-purpose AI models already placed on the market 326
Article 112 Evaluation and review 328
Article 113 Entry into force and application 333
ANNEX I. List of Union harmonisation legislation 335
Section A. List of Union harmonisation legislation based on the New Legislative Framework 335
Section B. List of other Union harmonisation legislation 336
ANNEX II. List of criminal offences referred to in Article 5(1), first subparagraph, point (h)(iii) 339
ANNEX III. High-risk AI systems referred to in Article 6(2) 341
1. Biometrics, in so far as their use is permitted under relevant Union or national law 341
2. Critical infrastructure 342
3. Education and vocational training 343
4. Employment, workers management and access to self-employment 344
5. Access to and enjoyment of essential private services and essential public services and benefits 345
6. Law enforcement, in so far as their use is permitted under relevant Union or national law 347
7. Migration, asylum and border control management, in so far as their use is permitted under relevant Union or national law 349
8. Administration of justice and democratic processes 350
ANNEX IV. Technical documentation referred to in Article 11(1) 353
ANNEX V. EU declaration of conformity 361
ANNEX VI. Conformity assessment procedure based on internal control 363
ANNEX VII. Conformity based on an assessment of the quality management system and an assessment of the technical documentation 365
ANNEX VIII. Information to be submitted upon the registration of high-risk AI systems in accordance with Article 49 369
Section A. Information to be submitted by providers of high-risk AI systems in accordance with Article 49(1) 369
Section B. Information to be submitted by providers of high-risk AI systems in accordance with Article 49(2) 370
Section C. Information to be submitted by deployers of high-risk AI systems in accordance with Article 49(3) 371
ANNEX IX. Information to be submitted upon the registration of high-risk AI systems listed in Annex III in relation to testing in real world conditions in accordance with Article 60 373
ANNEX X. Union legislative acts on large-scale IT systems in the area of Freedom, Security and Justice 375
ANNEX XI. Technical documentation referred to in Article 53(1), point (a) - technical documentation for providers of general-purpose AI models 379
Section 1. Information to be provided by all providers of general-purpose AI models 379
Section 2. Additional information to be provided by providers of general-purpose AI models with systemic risk 382
ANNEX XII. Transparency information referred to in Article 53(1), point (b) 383
ANNEX XIII. Criteria for the designation of general-purpose AI models with systemic risk referred to in Article 51 385
REFERENCES 387
INDEX 399
GLOSSARY OF KEY TERMS 405
CROSS-REFERENCES ARTICLES AND RECITALS 409
RECITALS TO ARTICLES 409
ARTICLES TO RECITALS 414
