Articles

Defines when an AI system qualifies as high-risk: either as a safety component of products requiring EU conformity assessment (Annex I), or if explicitly listed in Annex III. Provides a self-assessment pathway for systems that pose no significant risk despite being listed in Annex III.

Empowers the European Commission to update Annex III (the list of high-risk AI use cases) by delegated act, adding new use cases or removing outdated ones based on evidence of actual risk.

Providers of high-risk AI systems must ensure their systems comply with the requirements set out in Articles 9 to 15 throughout the entire lifecycle of the system.

Requires providers of high-risk AI systems to establish, implement, document, and maintain a risk management system throughout the entire lifecycle of the AI system.

Sets data governance requirements for high-risk AI systems trained on data. Training, validation and testing datasets must meet quality criteria: relevance, representativeness, freedom from errors, and completeness.

Requires providers of high-risk AI systems to draw up and maintain comprehensive technical documentation before placing the system on the market or putting it into service.

High-risk AI systems must be designed and developed to automatically record events (logs) relevant to identifying risks and ensuring traceability throughout the system's operational lifetime.

High-risk AI systems must be sufficiently transparent to enable deployers to interpret the system's output and use it appropriately. Providers must supply instructions for use.

High-risk AI systems must be designed and developed to enable effective oversight by natural persons during the period in which the AI system is in use.

High-risk AI systems must achieve appropriate levels of accuracy, robustness, and cybersecurity, and perform consistently in those respects throughout their lifecycle.

Sets out the full list of obligations that providers of high-risk AI systems must fulfil, including compliance with technical requirements, quality management, registration, and post-market monitoring.

Requires providers of high-risk AI systems to put in place a quality management system that ensures compliance with the Regulation in a systematic and orderly manner.

Deployers of high-risk AI systems must use systems according to instructions for use, assign human oversight to competent persons, monitor operation, and inform workers about AI use.

Requires public bodies and operators providing public services to conduct a fundamental rights impact assessment before deploying certain high-risk AI systems.

Defines the conformity assessment procedures applicable to high-risk AI systems. Most systems use internal control (Annex VI), while biometric systems and critical infrastructure require third-party assessment (Annex VII).

Providers must draw up a written EU declaration of conformity for each high-risk AI system and keep it at the disposal of national competent authorities for 10 years.

Before placing a high-risk AI system on the EU market, providers must register themselves and their system in the EU database. Deployers of certain systems must also register.