EU-AI-Act
Regulation (EU) 2024/1689 — Artificial Intelligence Act
- I. General Provisions
- Art. 1. Subject matter ref
- Art. 2. Scope ref
- Art. 3. Definitions ref
- Art. 4. AI literacy ref
- II. Prohibited AI Practices
- Art. 5. Prohibited artificial intelligence practices ref
- III. High-Risk AI Systems
- Ch. 1 — Classification of AI Systems as High-Risk
- Art. 6. Classification rules for high-risk AI systems (7)
- Art. 7. Amendments to Annex III (12)
- Ch. 2 — Requirements for High-Risk AI Systems
- Art. 8. Compliance with the requirements (5)
- Art. 9. Risk management system (15)
- Art. 10. Data and data governance (20)
- Art. 11. Technical documentation (7)
- Art. 12. Record-keeping (8)
- Art. 13. Transparency and provision of information to deployers (14)
- Art. 14. Human oversight (11)
- Art. 15. Accuracy, robustness and cybersecurity (9)
- Ch. 3 — Obligations of Providers and Deployers of High-Risk AI Systems and Other Parties
- Art. 16. Obligations of providers of high-risk AI systems (12)
- Art. 17. Quality management system (16)
- Art. 18. Documentation keeping (6)
- Art. 19. Automatically generated logs (2)
- Art. 20. Corrective actions and duty of information (5)
- Art. 21. Cooperation with competent authorities (3)
- Art. 22. Duty of providers of high-risk AI systems to inform (2)
- Art. 23. Obligations of importers (12)
- Art. 24. Obligations of distributors (10)
- Art. 25. Responsibilities along the AI value chain (9)
- Ch. 4 — Obligations of Deployers of High-Risk AI Systems
- Art. 26. Obligations of deployers of high-risk AI systems (17)
- Art. 27. Fundamental rights impact assessment for high-risk AI systems (10)
- Ch. 5 — Notifying Authorities and Notified Bodies
- Art. 28. Notifying authorities (8)
- IV. Transparency Obligations for Providers and Deployers of Certain AI Systems
- Art. 50. Transparency obligations for providers and deployers of certain AI systems (9)
- V. General-Purpose AI Models
- Ch. 1 — Classification Rules
- Art. 51. Classification of general-purpose AI models as general-purpose AI models with systemic risk (4)
- Ch. 2 — Obligations for Providers of General-Purpose AI Models
- Art. 53. Obligations for providers of general-purpose AI models (6)
- Art. 54. Authorised representatives of providers of general-purpose AI models (11)
- Art. 55. Obligations for providers of general-purpose AI models with systemic risk (6)
- Art. 56. Codes of practice (8)
- VIII. Post-Market Monitoring, Information Sharing and Market Surveillance
- Ch. 1 — Post-Market Monitoring
- Art. 72. Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems (7)
- Ch. 2 — Sharing of Information on Serious Incidents
- Art. 73. Reporting of serious incidents (12)
- X. Codes of Conduct and Guidelines
- Art. 95. Codes of conduct for voluntary application of specific requirements (6)
- XII. Penalties
- Art. 99. Penalties (8)
- Art. 100. Administrative fines on Union institutions, bodies, offices and agencies (7)
- Art. 101. Penalties for providers of general-purpose AI models (4)
- Annex I. Union Harmonisation Legislation Listed in Article 6(1)
- Annex III. High-Risk AI Systems Referred to in Article 6(2)
- Annex IV. Technical Documentation Referred to in Article 11(1)
Data Governance Obligations
19Title I — General Provisions
Title II — Prohibited AI Practices
Title III — High-Risk AI Systems
Chapter 1 — Classification of AI Systems as High-Risk
Chapter 2 — Requirements for High-Risk AI Systems
Article 10. Data and data governance
12 obligations
EU-AIA-10-01
Data Governance
Use quality training, validation and testing data sets
High-risk AI systems using training techniques must be developed using training, validation and testing data sets that m
EU-AIA-10-02
Data Governance
Implement appropriate data governance and management practices
Training, validation and testing data sets must be subject to data governance and management practices appropriate for t
EU-AIA-10-07
Data Governance
Assess data availability, quantity and suitability
Data governance practices must include an assessment of the availability, quantity and suitability of the data sets that
EU-AIA-10-10
Data Governance
Identify and address data gaps and shortcomings
Data governance practices must include identification of relevant data gaps or shortcomings that prevent compliance with
EU-AIA-10-11
Data Governance
Ensure data sets are relevant, representative and error-free
Training, validation and testing data sets must be relevant, sufficiently representative, and to the best extent possibl
EU-AIA-10-12
Data Governance
Ensure data sets have appropriate statistical properties
Data sets must have appropriate statistical properties, including, where applicable, as regards the persons or groups of
EU-AIA-10-13
Data Governance
Account for geographical and contextual characteristics in data sets
Data sets must take into account, to the extent required by the intended purpose, the characteristics or elements partic
EU-AIA-10-14
Data Governance
Verify necessity before processing special categories of personal data
Providers may only process special categories of personal data if it is strictly necessary for bias detection and correc
EU-AIA-10-15
Data Governance
Apply technical limitations and security measures to special personal data
Special categories of personal data must be subject to technical limitations on re-use and state-of-the-art security and
EU-AIA-10-16
Data Governance
Implement access controls for special personal data
Special categories of personal data must be subject to measures ensuring they are secured, protected, with suitable safe
EU-AIA-10-18
Data Governance
Delete special personal data after bias correction or retention period
Special categories of personal data must be deleted once the bias has been corrected or the personal data has reached th
EU-AIA-10-20
Data Governance
Apply data requirements to testing data for non-training AI systems
For high-risk AI systems not making use of techniques involving training of AI models, paragraphs 2 to 5 apply only to t
Article 13. Transparency and provision of information to deployers
1 obligation
Chapter 3 — Obligations of Providers and Deployers of High-Risk AI Systems and Other Parties
Article 17. Quality management system
1 obligation
Chapter 4 — Obligations of Deployers of High-Risk AI Systems
Article 26. Obligations of deployers of high-risk AI systems
2 obligations
EU-AIA-26-03
Data Governance
Ensure input data quality when controlling input data
To the extent the deployer exercises control over the input data, that deployer must ensure that input data is relevant
EU-AIA-26-12
Data Governance
Use provider information for DPIA compliance
Where applicable, deployers must use the information provided under Article 13 to comply with their obligation to carry
Chapter 5 — Notifying Authorities and Notified Bodies
Article 28. Notifying authorities
1 obligation
Title IV — Transparency Obligations for Providers and Deployers of Certain AI Systems
Title V — General-Purpose AI Models
Chapter 1 — Classification Rules
Chapter 2 — Obligations for Providers of General-Purpose AI Models
Article 55. Obligations for providers of general-purpose AI models with systemic risk
1 obligation
Title VIII — Post-Market Monitoring, Information Sharing and Market Surveillance
Chapter 1 — Post-Market Monitoring
Article 72. Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems
1 obligation