- 1Purpose of the regulation
- 2Regulation in balance with the values of the Union
- 3Consistent and high level of protection
- 4Artificial Intelligence
- 5Risks and harms
- 6Human-centric technology
- 7High-risk AI systems
- 8Framework for harmonised rules
- 9Application of existing rights and remedies
- 10Fundamental right to the protection of personal data
- 11Liability of intermediary service providers of Directive 2000/31/EG
- 12AI system
- 13Deployer
- 14Biometric data
- 15Biometric identification
- 16Biometric categorisation
- 17Remote biometric identification system
- 18Emotion recognition system
- 19Publicly accessible space
- 20Equipping with necessary notions
- 21Application to providers and deployers
- 22Application to third country operators
- 23Application to Union institutions, bodies and other agencies
- 24No application for military, defence or national security
- 25No application to scientific research and development
- 26Risk-based approach
- 27Principles for trustworthy and ethical AI
- 28Prohibition of harmful and misused practices
- 29AI-enabled influence on human behaviour
- 30AI systems for biometric categorisation
- 31AI systems for social scoring
- 32AI systems for 'real-time' remote biometric identification
- 33'Real-time' remote biometric identification systems for law enforcement purposes
- 34Fundamental rights impact assessment
- 35Authorisation obligation
- 36Notification of the authorities
- 37Adoption into national law
- 38Use and processing of biometric data
- 39Applicability of Directive (EU) 2016/680
- 40Limited binding effect for Ireland
- 41Limited binding effect for Denmark
- 42Presumption of innocence in profiling
- 43Banning AI facial recognition for mass surveillance
- 44Risks and limits of emotion-recognising AI systems
- 45Practices not permitted under EU law remain unaffected
- 46Mandatory security requirements for high-risk AI systems in the EU
- 47Risk minimisation in AI systems for health and safety
- 48Fundamental rights and risk assessment of AI systems
- 49Adaptation of regulations for high-risk AI systems in safety-critical products and systems
- 50High-risk classification for AI security products
- 51High-risk AI systems and product risk
- 52Classification and regulation of high-risk AI systems
- 53Supplementing human activity and pattern recognition
- 54Risk assessment and use cases for biometric systems
- 55Classification of high-risk AI systems in critical infrastructure
- 56High-risk AI systems in education
- 57High-risk AI systems in employment and human resources
- 58High-risk AI systems deployment in social benefits, creditworthiness, and emergencies
- 59High-risk AI systems in law enforcement
- 60High-risk AI systems in migration and asylum
- 61High-risk AI systems in the administration of justice
- 62High-risk AI systems in elections
- 63Lawfulness
- 64Compliance with other Union law
- 65Risk-management system
- 66Scope of the requirements
- 67Data governance and management practices
- 68Access to high-quality data
- 69Data privacy
- 70Processing of special categories of personal data
- 71Documentation of the development
- 72Transparency for high-risk AI systems
- 73Oversight by natural persons
- 74Performance metrics
- 75Resilience of high-risk AI systems
- 76Cybersecurity appropriate to the risks
- 77Cybersecurity requirements as set out in the regulation
- 78Conformity assessment
- 79Specification of the provider
- 80Protection and equality of persons with disabilities
- 81Establishing a quality management system
- 82Level-playing field for operators
- 83Clarification of the roles and obligations of operators along the value chain
- 84Extension of obligations to distributors, importers, deployers or other third parties as providers of high-risk AI system
- 85Cooperation of high-risk AI system providers along the value chain and with authorities
- 86Obligation for former providers to cooperate
- 87Obligations in the event of high-risk AI system as a safety component of a product
- 88Written agreement on the provision of information
- 89Release from value chain responsibilities and promotion of trustworthy AI
- 90Development of voluntary model contract terms by the Commission
- 91Definition of special responsibilities and obligations for deployers
- 92Duty of employers to inform and consult employees or their representatives
- 93Notification and information of persons by the deployer
- 94Application of Directive (EU) 2016/680 when using AI systems for biometric identification for law enforcement purposes
- 95Compliance with safeguards for subsequent remote biometric identification
- 96Implementation of fundamental rights impact assessment and further follow-up measures
- 97Precise definition of individual AI systems
- 98Model determination based on parameters
- 99Example of AI model with general-purpose
- 100Further cases of AI models with a general-purpose
- 101Transparency obligations for providers of general-purpose AI models
- 102Transparency obligations for general-purpose AI models under open-source license
- 103Definition of the term AI model with general-purpose under open-source license
- 104Exemptions for transparency obligations for general-purpose AI models under open-source license
- 105Use of protected content for developing general-purpose AI models
- 106Strategy for compliance with Union law for providers of general-purpose AI models
- 107Transparency obligations for providers of general-purpose AI models concerning training data
- 108Compliance monitoring by the AI Office
- 109Proportionality of monitoring measures by the AI Office
- 110Systemic risks of general-purpose AI models
- 111Methodology for classifying AI models as systemically risky
- 112Notification of general-purpose AI models with systemic risk at AI Office
- 113Subsequent classification of AI models with systemic risk
- 114Obligations for providers of general-purpose AI models with systemic risks
- 115Mandatory reporting of risk events for providers of general-purpose AI models with systemic risks
- 116Codes of practice for providers of general-purpose AI models with systemic risks
- 117Implementation of harmonised codes of practice by the EU Commission
- 118AI Act and Digital Services Act when embedding AI models in platforms and search engines
- 119AI systems as intermediary services under the Digital Services Act
- 120Obligation to identify systemic risks for AI models and intermediary services
- 121Harmonised standards of the Commission
- 122Compliance with cybersecurity requirements
- 123Conformity assessment for high-risk AI systems
- 124Conformity assessment according to relevant EU harmonisation legislation
- 125Limited conformity assessment by third parties
- 126Procedure for third-party conformity assessments
- 127Recognition of conformity results from third countries
- 128Reassessment of conformity in the event of significant system changes
- 129CE marking for high-risk AI systems
- 130Authorisation for high-risk AI systems in the public interest
- 131Registration obligations for providers and deployers of high-risk AI systems in EU database
- 132Transparency obligations for AI systems
- 133Mandatory labeling of AI results
- 134Obligation to disclose artificially generated content
- 135Development of codes of conduct at Union level for AI content review
- 136Importance of transparency for the implementation of the AI Regulation
- 137Transparency is no substitute for lawfulness
- 138Establishing of AI regulatory sandboxes to test innovative systems
- 139Objectives of AI regulatory sandboxes
- 140Legal basis for the use of personal data for the development of AI systems in the public interest
- 141Requirements for testing high-risk AI systems under real-world conditions
- 142Encourage the funding of research and development on AI solutions
- 143Special consideration of the interests of SMEs
- 144Promotion and protection of innovation
- 145Minimising risk and facilitating the fulfillment of obligations
- 146Facilitating the introduction of quality management for microenterprises
- 147Facilitating access to testing and experimentation facilities for certain entities
- 148Establishment of governance framework
- 149Establishment of Regulation Board
- 150Establishment of advisory forum
- 151Establishment of scientific panel
- 152Establishment of Union structures to support the testing of AI
- 153Establishment of at least one notifying authority and one market surveillance authority per Member State
- 154Independence, impartiality and confidentiality of the relevant national authorities
- 155System for monitoring high-risk AI systems and system for reporting serious incidents
- 156System of market surveillance and conformity of products
- 157Position of national authorities or other bodies in relation to the regulations of the AI Act
- 158Coherent application and enforcement of obligations for financial services
- 159Necessary powers of market surveillance authorities for high-risk AI systems in the area of biometric data
- 160Joint activities of the market surveillance authorities of the Member States or the Commission
- 161Clarification of responsibilities and competencies
- 162Synergies at Union level
- 163Support for the AI Office by scientific panel
- 164Competencies of the AI Office
- 165Voluntary codes of conduct
- 166Safety of AI systems that are not high-risk
- 167Trustful cooperation of competent authorities
- 168Ensuring the implementation of the provisions
- 169Administrative fines
- 170Legal remedies for natural and legal persons
- 171Explanation on the use of high-risk systems
- 172Protection of whistleblowers
- 173Delegation of powers to the Commission
- 174Regular evaluation and review
- 175Implementing powers of the Commission
- 176Principle of subsidiarity and principle of proportionality
- 177Ensuring continuity
- 178Voluntary compliance
- 179Date of validity
- 180Adoption of the regulation
AI Act Recital 23
This Regulation should also apply to Union institutions, bodies, offices and agencies when acting as a provider or deployer of an AI system.
