Chapter IIIHIGH-RISK AI SYSTEMS

Section 1 – Classification of AI systems as high-risk

• Article 6Classification rules for high-risk AI systems

  1. Irrespective of whether an AI system is placed on the market or put into service independently of the products referred to in points (a) and (b), that…

• Article 7Amendments to Annex III

  1. The Commission is empowered to adopt delegated acts in accordance with Article 97 to amend Annex III by adding or modifying use-cases of high-risk AI systems where…

Section 2 – Requirements for high-risk AI systems

• Article 8Compliance with the requirements

  1. High-risk AI systems shall comply with the requirements laid down in this Section, taking into account their intended purpose as well as the generally acknowledged state of…

• Article 9Risk management system

  1. A risk management system shall be established, implemented, documented and maintained in relation to high-risk AI systems. 2. The risk management system shall be understood as a…

• Article 10Data and data governance

  1. High-risk AI systems which make use of techniques involving the training of AI models with data shall be developed on the basis of training, validation and testing…

• Article 11Technical documentation

  1. The technical documentation of a high-risk AI system shall be drawn up before that system is placed on the market or put into service and shall be…

• Article 12Record-keeping

  1. High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system. 2. In order to ensure a level of…

• Article 13Transparency and provision of information to deployers

  1. High-risk AI systems shall be designed and developed in such a way as to ensure that their operation is sufficiently transparent to enable deployers to interpret a…

• Article 14Human oversight

  1. High-risk AI systems shall be designed and developed in such a way, including with appropriate human-machine interface tools, that they can be effectively overseen by natural persons…

• Article 15Accuracy, robustness and cybersecurity

  1. High-risk AI systems shall be designed and developed in such a way that they achieve an appropriate level of accuracy, robustness, and cybersecurity, and that they perform…

Section 3 – Obligations of providers and deployers of high-risk AI systems and other parties

• Article 16Obligations of providers of high-risk AI systems

  Providers of high-risk AI systems shall: (a) ensure that their high-risk AI systems are compliant with the requirements set out in Section 2 ; (b) indicate on the…

• Article 17Quality management system

  1. Providers of high-risk AI systems shall put a quality management system in place that ensures compliance with this Regulation. That system shall be documented in a systematic…

• Article 18Documentation keeping

  1. The provider shall, for a period ending 10 years after the high-risk AI system has been placed on the market or put into service, keep at the…

• Article 19Automatically generated logs

  1. Providers of high-risk AI systems shall keep the logs referred to in Article 12(1) , automatically generated by their high-risk AI systems, to the extent such logs…

• Article 20Corrective actions and duty of information

  1. Providers of high-risk AI systems which consider or have reason to consider that a high-risk AI system that they have placed on the market or put into…

• Article 21Cooperation with competent authorities

  1. Providers of high-risk AI systems shall, upon a reasoned request by a competent authority, provide that authority all the information and documentation necessary to demonstrate the conformity…

• Article 22Authorised representatives of providers of high-risk AI systems

  1. Prior to making their high-risk AI systems available on the Union market, providers established in third countries shall, by written mandate, appoint an authorised representative which is…

• Article 23Obligations of importers

  1. Before placing a high-risk AI system on the market, importers shall ensure that the system is in conformity with this Regulation by verifying that: (a) the relevant…

• Article 24Obligations of distributors

  1. Before making a high-risk AI system available on the market, distributors shall verify that it bears the required CE marking, that it is accompanied by a copy…

• Article 25Responsibilities along the AI value chain

  1. Any distributor, importer, deployer or other third-party shall be considered to be a provider of a high-risk AI system for the purposes of this Regulation and shall…

• Article 26Obligations of deployers of high-risk AI systems

  1. Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the…

• Article 27Fundamental rights impact assessment for high-risk AI systems

  1. Prior to deploying a high-risk AI system referred to in Article 6(2) , with the exception of high-risk AI systems intended to be used in the area…

Section 4 – Notifying authorities and notified bodies

• Article 28Notifying authorities

  1. Each Member State shall designate or establish at least one notifying authority responsible for setting up and carrying out the necessary procedures for the assessment, designation and…

• Article 29Application of a conformity assessment body for notification

  1. Conformity assessment bodies shall submit an application for notification to the notifying authority of the Member State in which they are established. 2. The application for notification…

• Article 30Notification procedure

  1. Notifying authorities may notify only conformity assessment bodies which have satisfied the requirements laid down in Article 31 . 2. Notifying authorities shall notify the Commission and…

• Article 31Requirements relating to notified bodies

  1. A notified body shall be established under the national law of a Member State and shall have legal personality. 2. Notified bodies shall satisfy the organisational, quality…

• Article 32Presumption of conformity with requirements relating to notified bodies

  Where a conformity assessment body demonstrates its conformity with the criteria laid down in the relevant harmonised standards or parts thereof, the references of which have been published…

• Article 33Subsidiaries of notified bodies and subcontracting

  1. Where a notified body subcontracts specific tasks connected with the conformity assessment or has recourse to a subsidiary, it shall ensure that the subcontractor or the subsidiary…

• Article 34Operational obligations of notified bodies

  1. Notified bodies shall verify the conformity of high-risk AI systems in accordance with the conformity assessment procedures set out in Article 43 . 2. Notified bodies shall…

• Article 35Identification numbers and lists of notified bodies

  1. The Commission shall assign a single identification number to each notified body, even where a body is notified under more than one Union act. 2. The Commission…

• Article 36Changes to notifications

  1. The notifying authority shall notify the Commission and the other Member States of any relevant changes to the notification of a notified body via the electronic notification…

• Article 37Challenge to the competence of notified bodies

  1. The Commission shall, where necessary, investigate all cases where there are reasons to doubt the competence of a notified body or the continued fulfilment by a notified…

• Article 38Coordination of notified bodies

  1. The Commission shall ensure that, with regard to high-risk AI systems, appropriate coordination and cooperation between notified bodies active in the conformity assessment procedures pursuant to this…

• Article 39Conformity assessment bodies of third countries

  Conformity assessment bodies established under the law of a third country with which the Union has concluded an agreement may be authorised to carry out the activities of…

Section 5 – Standards, conformity assessment, certificates, registration

• Article 40Harmonised standards and standardisation deliverables

  1. High-risk AI systems or general-purpose AI models which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official…

• Article 41Common specifications

  1. The Commission may adopt, implementing acts establishing common specifications for the requirements set out in Section 2 of this Chapter or, as applicable, for the obligations set…

• Article 42Presumption of conformity with certain requirements

  1. High-risk AI systems that have been trained and tested on data reflecting the specific geographical, behavioural, contextual or functional setting within which they are intended to be…

• Article 43Conformity assessment

  1. For high-risk AI systems listed in point 1 of Annex III , where, in demonstrating the compliance of a high-risk AI system with the requirements set out…

• Article 44Certificates

  1. Certificates issued by notified bodies in accordance with Annex VII shall be drawn-up in a language which can be easily understood by the relevant authorities in the…

• Article 45Information obligations of notified bodies

  1. Notified bodies shall inform the notifying authority of the following: (a) any Union technical documentation assessment certificates, any supplements to those certificates, and any quality management system…

• Article 46Derogation from conformity assessment procedure

  1. By way of derogation from Article 43 and upon a duly justified request, any market surveillance authority may authorise the placing on the market or the putting…

• Article 47EU declaration of conformity

  1. The provider shall draw up a written machine readable, physical or electronically signed EU declaration of conformity for each high-risk AI system, and keep it at the…

• Article 48CE marking

  1. The CE marking shall be subject to the general principles set out in Article 30 of Regulation (EC) No 765/2008 . 2. For high-risk AI systems provided…

• Article 49Registration

  1. Before placing on the market or putting into service a high-risk AI system listed in Annex III , with the exception of high-risk AI systems referred to…