All 113 articles.

Lays down harmonised rules for the placing on the market, putting into service, and use of AI systems in the Union. Establishes prohibitions of certain AI practices, requirements for high-risk AI systems, and transparency obligations for certain AI systems and general-purpose AI models.

Applies to providers placing AI systems or general-purpose AI models on the Union market, deployers of AI systems within the Union, and providers and deployers in third countries where AI output is used in the Union. Excludes AI used for military, defence, national security, and purely scientific research purposes.

Defines 68 key terms used throughout the regulation, including "AI system", "provider", "deployer", "placing on the market", "putting into service", "intended purpose", "reasonably foreseeable misuse", "biometric data", "emotion recognition system", "deep fake", and "general-purpose AI model".

Requires providers and deployers to take measures to ensure that their staff and other persons dealing with the operation and use of AI systems on their behalf have a sufficient level of AI literacy, taking into account their technical knowledge, experience, education and training, and the context in which the AI systems are to be used.

Prohibits the placing on the market, putting into service, or use of AI systems that deploy subliminal or manipulative techniques, exploit vulnerabilities, perform social scoring, carry out individual predictive policing based solely on profiling, create facial recognition databases through untargeted scraping, infer emotions in workplaces and education, perform biometric categorisation inferring sensitive attributes, or conduct real-time remote biometric identification in publicly accessible spaces for law enforcement (with limited exceptions).

An AI system is high-risk if it is: (a) intended to be used as a safety component of a product covered by Union harmonisation legislation in Annex I, or is itself such a product; or (b) falls within one of the use cases listed in Annex III. Sets out conditions under which Annex III systems are not considered high-risk despite their area.

Empowers the Commission to adopt delegated acts to amend Annex III by adding or modifying high-risk AI use cases, subject to criteria including the intended purpose, the extent to which an AI system has been used, the severity and probability of harm, and the extent to which existing Union legislation provides effective measures.

High-risk AI systems shall comply with the requirements laid down in this Section, taking into account their intended purpose as well as the generally acknowledged state of the art on AI and AI-related technologies. The risk management system referred to in Article 9 shall be taken into account when ensuring compliance.

A risk management system shall be established, implemented, documented and maintained in relation to high-risk AI systems. It shall be a continuous iterative process planned and run throughout the entire lifecycle of the system, requiring regular systematic review and updating.

High-risk AI systems which make use of techniques involving the training of AI models with data shall be developed on the basis of training, validation and testing data sets that meet quality criteria. Data sets shall be relevant, sufficiently representative, and to the best extent possible, free of errors and complete in view of the intended purpose.

The technical documentation of a high-risk AI system shall be drawn up before that system is placed on the market or put into service and shall be kept up to date. It shall contain, at a minimum, the information set out in Annex IV, as applicable based on the relevant business model of the provider.

High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system. Logging capabilities shall ensure a level of traceability of the AI system's functioning throughout its lifecycle appropriate to the intended purpose of the system.

High-risk AI systems shall be designed and developed in such a way as to ensure that their operation is sufficiently transparent to enable deployers to interpret a system's output and use it appropriately. An appropriate type and degree of transparency shall be ensured, with a view to achieving compliance with the relevant obligations.

High-risk AI systems shall be designed and developed in such a way, including with appropriate human-machine interface tools, that they can be effectively overseen by natural persons during the period in which they are in use.

High-risk AI systems shall be designed and developed in such a way that they achieve an appropriate level of accuracy, robustness, and cybersecurity, and that they perform consistently in those respects throughout their lifecycle.

Providers of high-risk AI systems shall ensure their systems comply with Chapter III requirements, have a quality management system, draw up technical documentation, keep system logs, ensure conformity assessment is carried out, register in the EU database, take corrective action when necessary, and cooperate with competent authorities.

Providers of high-risk AI systems shall put a quality management system in place that ensures compliance with this regulation. The quality management system shall be documented in a systematic and orderly manner in the form of written policies, procedures and instructions.

The provider shall, for a period ending 10 years after the high-risk AI system has been placed on the market or put into service, keep at the disposal of the national competent authorities the technical documentation, the documentation concerning the quality management system, and the EU declaration of conformity.

Providers of high-risk AI systems shall keep the logs referred to in Article 12 automatically generated by their high-risk AI systems, to the extent such logs are under their control. The logs shall be kept for a period appropriate to the intended purpose of the high-risk AI system, of at least six months.

Providers who consider or have reason to consider that a high-risk AI system which they have placed on the market or put into service is not in conformity with this regulation shall immediately take the necessary corrective actions to bring that system into conformity, to withdraw it, or to recall it, as appropriate.

Providers of high-risk AI systems shall, upon a reasoned request by a national competent authority, provide that authority with all the information and documentation necessary to demonstrate the conformity of the high-risk AI system with the requirements set out in Section 2.

Prior to making their high-risk AI systems available on the Union market, providers established in third countries shall, by written mandate, appoint an authorised representative which is established in the Union.

Before placing a high-risk AI system on the market, importers shall ensure the provider has carried out the appropriate conformity assessment procedure, has drawn up the technical documentation, and that the system bears the required CE marking and is accompanied by the required documentation and instructions for use.

Before making a high-risk AI system available on the market, distributors shall verify that the system bears the required CE marking, that it is accompanied by the required documentation and instructions for use, and that the provider and the importer of the system have complied with their respective obligations.

Any distributor, importer, deployer or other third party shall be considered a provider of a high-risk AI system if they put their name or trademark on a system already placed on the market, make a substantial modification to a high-risk AI system, or modify the intended purpose of a system not classified as high-risk in a way that makes it high-risk.

Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use, ensure that natural persons assigned to human oversight are competent, trained and have the necessary authority, and ensure that input data is relevant and sufficiently representative.

Before putting a high-risk AI system into use, deployers that are bodies governed by public law, or are private operators providing public services, and deployers of certain Annex III systems, shall perform an assessment of the impact on fundamental rights that the use of such system may produce.

Each Member State shall designate or establish at least one notifying authority responsible for setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring.

Conformity assessment bodies shall submit an application for notification to the notifying authority of the Member State in which they are established, accompanied by a description of conformity assessment activities, modules and types of AI systems for which they claim to be competent.

Notifying authorities may notify only conformity assessment bodies which have satisfied the requirements laid down in Article 31. They shall notify the Commission and the other Member States using the electronic notification tool developed and managed by the Commission.

Sets out detailed requirements that notified bodies must satisfy, including being established under the national law of a Member State, having the organisational structure, quality management, resources and processes necessary to perform their conformity assessment tasks, and being independent from the provider of the AI system.

Where a conformity assessment body demonstrates its conformity with the criteria laid down in the relevant harmonised standards or parts thereof, it shall be presumed to comply with the corresponding requirements set out in Article 31.

Where a notified body subcontracts specific tasks connected with the conformity assessment or has recourse to a subsidiary, it shall ensure that the subcontractor or the subsidiary meets the applicable requirements and shall inform the notifying authority accordingly.

Notified bodies shall verify the conformity of the high-risk AI system in accordance with the conformity assessment procedures set out in Article 43. They shall perform their activities in a proportionate manner, avoiding unnecessary burdens for providers and taking due account of the size and structure of the undertaking.

The Commission shall assign an identification number to each notified body. It shall make the list of bodies notified under this regulation, including the identification numbers assigned to them and the activities for which they have been notified, publicly available.

The notifying authority shall inform the Commission and the other Member States of any relevant changes to the notification of a notified body, including restriction, suspension or withdrawal of notification.

The Commission shall investigate cases where it has doubts or is made aware of doubts about the competence of a notified body or the continued fulfilment of the applicable requirements by a notified body.

The Commission shall ensure that appropriate coordination and cooperation between notified bodies active in conformity assessment procedures under this regulation are put in place and properly operated in the form of a sectoral group of notified bodies.

Conformity assessment bodies established under the law of a third country with which the Union has concluded an agreement may be authorised to carry out the activities of notified bodies under this regulation, provided they meet the applicable requirements.

High-risk AI systems or general-purpose AI models which are in conformity with harmonised standards or parts thereof, the references of which have been published in the Official Journal of the European Union, shall be presumed to be in conformity with the requirements set out in this regulation.

Where harmonised standards do not exist or where the Commission considers that the relevant harmonised standards are insufficient, the Commission may, by means of implementing acts, adopt common specifications in respect of the requirements set out in Section 2.

High-risk AI systems that have been trained and tested on data reflecting the specific geographical, behavioural, contextual or functional setting within which they are intended to be used shall be presumed to comply with the relevant requirement laid down in Article 10(4).

For high-risk AI systems listed in Annex III, the provider shall follow either the conformity assessment procedure based on internal control (Annex VI) or the conformity assessment procedure based on assessment of the quality management system and the technical documentation (Annex VII), with third-party assessment required for biometric identification systems.

Certificates issued by notified bodies shall indicate the conditions under which they are valid, including the scope of the assessment and any conditions for validity. They shall be valid for a maximum of five years and may be extended for further periods of up to five years each.

Notified bodies shall inform the notifying authority of any refusal, restriction, suspension or withdrawal of a certificate, and of any circumstances affecting the scope of or conditions for notification. They shall also inform other notified bodies carrying out similar activities.

Any market surveillance authority may authorise the placing on the market or putting into service of specific high-risk AI systems within its territory, for exceptional reasons of public security or the protection of life and health of persons, environmental protection or the protection of key industrial and infrastructural assets.

The provider shall draw up a written machine-readable, physical or electronically signed EU declaration of conformity for each high-risk AI system, and keep it at the disposal of the national competent authorities for 10 years after the system has been placed on the market or put into service.

The CE marking shall be affixed visibly, legibly and indelibly for high-risk AI systems. Where that is not possible or not warranted on account of the nature of the high-risk AI system, it shall be affixed to the packaging or to the accompanying documentation.

Before placing on the market or putting into service a high-risk AI system listed in Annex III, the provider or, where applicable, the authorised representative shall register themselves and their system in the EU database referred to in Article 71.

Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed such that the persons are informed they are interacting with an AI system. Deployers using emotion recognition or biometric categorisation systems shall inform persons of the system's operation. AI-generated or manipulated content, including deepfakes, shall be clearly labelled.

A general-purpose AI model shall be classified as a general-purpose AI model with systemic risk if it has high impact capabilities evaluated on the basis of appropriate technical tools and methodologies, including indicators and benchmarks, or if the Commission decides to designate it on the basis of specific criteria. A model trained with total compute above 10^25 FLOPS is presumed to have high impact capabilities.

Where a general-purpose AI model meets the condition referred to in Article 51, the relevant provider shall notify the Commission without delay and in any event within two weeks after that condition is met. The Commission shall publish a list of general-purpose AI models with systemic risk.

Providers of general-purpose AI models shall draw up and keep up to date the technical documentation of the model, draw up and keep up to date information and documentation to make available to downstream providers, put in place a policy to comply with Union copyright law, and draw up and make publicly available a sufficiently detailed summary about the content used for training.

Providers of general-purpose AI models that are established in third countries shall, by written mandate, appoint an authorised representative which is established in the Union before making a general-purpose AI model available on the Union market.

Providers of general-purpose AI models with systemic risk shall, in addition to the obligations under Article 53: perform model evaluation in accordance with standardised protocols, assess and mitigate possible systemic risks, keep track of, document and report to the AI Office and national competent authorities serious incidents, and ensure an adequate level of cybersecurity protection.

The AI Office shall encourage and facilitate the drawing up of codes of practice at Union level as an element contributing to the proper application of this regulation, taking into account international approaches. The AI Office and the Board shall aim to ensure that the codes of practice cover at least the obligations provided for in Articles 53 and 55.

Member States shall ensure that their competent authorities establish at least one AI regulatory sandbox at national level, which shall be operational by 2 August 2026. Sandboxes provide a controlled environment that facilitates the development, testing and validation of innovative AI systems for a limited time before their placement on the market.

The competent authorities that have established an AI regulatory sandbox shall provide participants with guidance and supervision within the sandbox with a view to identifying risks, in particular to fundamental rights, health and safety, testing and mitigation measures.

In the AI regulatory sandbox, personal data lawfully collected for other purposes may be processed for the purposes of developing, training and testing certain AI systems in the sandbox, under specified conditions including the existence of a substantial public interest, strict technical safeguards including pseudonymisation, and mandatory deletion upon exit.

Testing of high-risk AI systems in real world conditions outside AI regulatory sandboxes may be conducted by providers or prospective providers of high-risk AI systems, in accordance with conditions set out in this Article, including prior registration in the EU database and obtaining informed consent from test subjects.

Test subjects for testing in real world conditions shall give their informed consent prior to their participation in the testing. The consent shall be freely given, specific, unambiguous and informed, and shall be revocable at any time without detriment.

Member States shall undertake actions to provide SMEs, including start-ups, having a registered office or a branch in the Union, with priority access to AI regulatory sandboxes, organise specific awareness raising and training activities, utilise existing dedicated channels for communication, and facilitate participation in the standardisation development process.

Microenterprises may fulfil certain elements of the quality management system required by Article 17 in a simplified manner, and the Commission shall develop guidelines to support simplified compliance approaches for SMEs.

The Commission shall develop Union expertise and capabilities in the field of AI through the AI Office. The AI Office shall carry out the tasks entrusted to it under this regulation, including contributing to the coherent application of the regulation across the Member States and enforcing rules on general-purpose AI models.

A European Artificial Intelligence Board is established. The Board shall be composed of one representative per Member State. The European Data Protection Supervisor shall participate as observer. The Board shall be chaired by one of its members, elected from among the members of the Board for a term of three years, renewable once.

The Board shall advise and assist the Commission and the Member States in order to facilitate the consistent and effective application of this regulation. It shall collect and share technical expertise and best practices, contribute to a uniform application of the regulation, and provide recommendations and written opinions on relevant matters.

An advisory forum shall be established to provide technical expertise and advise the Board and the Commission. The advisory forum shall consist of a balanced selection of stakeholders, including industry, start-ups, SMEs, civil society, academia and other relevant stakeholders.

A scientific panel of independent experts shall be established by the Commission to support the enforcement activities under this regulation. The panel shall be composed of experts selected by the Commission on the basis of up-to-date scientific or technical expertise in the field of AI.

Member States may call on the pool of experts established by the scientific panel to support their enforcement activities under this regulation. Member States may require the applicants for notification of conformity assessment bodies to demonstrate their competence through independent expert assessment.

Each Member State shall establish or designate as national competent authorities at least one notifying authority and at least one market surveillance authority for the purposes of this regulation. Member States shall designate a market surveillance authority to act as the single point of contact for this regulation.

The Commission shall, in collaboration with the Member States, set up and maintain an EU database containing information referred to in Article 49(2) and (3) concerning high-risk AI systems registered in accordance with Articles 49 and 60. The database shall be publicly accessible, user-friendly and easily navigable.

Providers shall establish and document a post-market monitoring system in a manner that is proportionate to the nature of the AI technologies and the risks of the high-risk AI system. The system shall actively and systematically collect, document and analyse relevant data provided by deployers or which are collected through other sources.

Providers of high-risk AI systems placed on the Union market shall report any serious incident to the market surveillance authorities of the Member States where that incident occurred. The report shall be made immediately after the provider has established a causal link or the reasonable likelihood of a causal link between the AI system and the serious incident.

Regulation (EU) 2019/1020 shall apply to AI systems covered by this regulation. Market surveillance authorities shall have all the enforcement powers laid down in that regulation, including the power to carry out unannounced on-site inspections and access to source code, data and documentation.

Where an AI system is based on a general-purpose AI model, and the model and the system are provided by different providers, the relevant market surveillance authority and the AI Office shall cooperate. Each authority may request the other to exercise powers on its behalf where necessary.

Market surveillance authorities shall have the competence and powers to ensure that the testing in real world conditions is in accordance with this regulation. They may, where justified, allow providers to test high-risk AI systems in real world conditions under their supervision.

National public authorities or bodies which supervise or enforce the respect of obligations under Union law protecting fundamental rights shall have the power to request and access any documentation created or maintained under this regulation when access to that documentation is necessary for effectively fulfilling their mandates.

The Commission, market surveillance authorities, notified bodies and any other natural or legal person involved in the application of this regulation shall, in accordance with Union or national law, respect the confidentiality of information and data obtained in carrying out their tasks and activities.

Where the market surveillance authority of a Member State has sufficient reasons to consider that an AI system presents a risk, it shall carry out an evaluation of the AI system concerned in respect of its compliance with all requirements and obligations laid down in this regulation.

Where the market surveillance authority has sufficient reasons to consider that an AI system classified by the provider as non-high-risk under Article 6(3) is indeed high-risk, it shall carry out an evaluation and may require the provider to take all appropriate and duly justified measures to bring the AI system into compliance.

Where the national measures taken under Article 79 are objected to by another Member State or the Commission considers the measure to be contrary to Union law, the Commission shall without delay enter into consultations with the relevant Member State and the relevant operator and shall evaluate the national measure.

Where a market surveillance authority finds that, although a high-risk AI system is in compliance with this regulation, it nevertheless presents a risk to the health or safety of persons, to fundamental rights, or to other aspects of public interest protection, it shall require the relevant provider to take all appropriate measures.

Where the market surveillance authority of a Member State makes specific findings including that the CE marking has been affixed in violation of this regulation, the CE marking is absent, or the EU declaration of conformity has not been drawn up, it shall require the relevant operator to put an end to the non-compliance concerned.

The Commission shall designate one or more Union AI testing support structures to carry out the tasks listed in Article 21(6) of Regulation (EU) 2019/1020 in the area of AI. The structures shall provide independent technical or scientific advice at the request of the Board, the Commission or market surveillance authorities.

Any natural or legal person having grounds to consider that there has been an infringement of this regulation may lodge a complaint with the relevant market surveillance authority. The authority shall inform the complainant of the progress and outcome of the complaint within a reasonable period.

Any affected person subject to a decision which is taken by the deployer on the basis of the output from a high-risk AI system listed in Annex III and which produces legal effects or similarly significantly affects that person shall have the right to obtain from the deployer clear and meaningful explanations of the role of the AI system in the decision-making procedure.

Persons reporting infringements of this regulation shall be protected under Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law (the Whistleblower Directive).

The Commission shall have the exclusive power to supervise and enforce Chapter V on general-purpose AI models. The AI Office shall be entrusted with the carrying out of the supervisory and enforcement tasks.

The AI Office may take the necessary actions to monitor the effective implementation of and compliance with the obligations for providers of general-purpose AI models laid down in this regulation, including their adherence to approved codes of practice.

The scientific panel may issue a qualified alert to the AI Office where it has reason to suspect that a general-purpose AI model poses a concrete identifiable risk at Union level. The AI Office may, following the alert, carry out an evaluation of the model to assess whether it poses systemic risk.

The Commission may request providers of general-purpose AI models to provide the documentation drawn up by the provider in accordance with Articles 53 and 55, or any additional information that is necessary to assess compliance of the provider with this regulation.

The AI Office, having consulted the Board, may conduct evaluations of the general-purpose AI model concerned to assess compliance with obligations under this regulation, as well as to investigate systemic risks at Union level. It may request access to the model, including its source code, weights, and architecture.

Where the Commission considers the evidence collected sufficient to establish a finding of an infringement, the AI Office may request the provider to take appropriate measures to comply with the obligations laid down in this regulation, implement commitments made under codes of practice, or restrict the making available of the model.

Article 18 of Regulation (EU) 2019/1020 shall apply mutatis mutandis to providers of general-purpose AI models, without prejudice to more specific procedural rights provided for under this regulation. Providers have the right to be heard before any measure is adopted.

The AI Office and the Member States shall encourage and facilitate the drawing up of codes of conduct, including related governance mechanisms, intended to foster the voluntary application to AI systems, other than high-risk AI systems, of some or all of the requirements set out in Chapter III, Section 2.

The Commission shall develop guidelines on the practical implementation of this regulation, and in particular on the application of the requirements and obligations referred to in Articles 8 to 15, Article 25, Article 50, and Article 101.

The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. The delegation of power may be revoked at any time by the European Parliament or by the Council.

The Commission shall be assisted by a committee within the meaning of Regulation (EU) No 182/2011. The committee shall be composed of representatives of the Member States and chaired by a representative of the Commission.

Member States shall lay down rules on penalties applicable to infringements. Maximum administrative fines: up to EUR 35 million or 7% of total worldwide annual turnover for prohibited practices; up to EUR 15 million or 3% for other infringements; up to EUR 7.5 million or 1% for supplying incorrect information. Proportionate caps for SMEs and start-ups.

The European Data Protection Supervisor may impose administrative fines on Union institutions, bodies, offices and agencies falling within the scope of this regulation. The same maximum fine thresholds as Article 99 apply.

The Commission may impose on providers of general-purpose AI models fines not exceeding 3% of their total worldwide annual turnover in the preceding financial year, or EUR 15 million, whichever is higher, where the provider intentionally or negligently infringes the relevant provisions of this regulation.

Amends Regulation (EC) No 300/2008 on common rules in the field of civil aviation security to account for AI systems used as security equipment or components thereof.

Amends Regulation (EU) No 167/2013 on the approval and market surveillance of agricultural and forestry vehicles to integrate references to AI systems used in those vehicles.

Amends Regulation (EU) No 168/2013 on the approval and market surveillance of two- or three-wheel vehicles and quadricycles to integrate references to AI systems.

Amends Directive 2014/90/EU on marine equipment to account for AI systems used in marine equipment and components thereof.

Amends Directive (EU) 2016/797 on the interoperability of the rail system within the European Union to account for AI systems used as safety components in rail infrastructure and rolling stock.

Amends Regulation (EU) 2018/858 on the approval and market surveillance of motor vehicles and their trailers to integrate references to AI systems used in those vehicles.

Amends Regulation (EU) 2018/1139 on common rules in the field of civil aviation and establishing a European Union Aviation Safety Agency to account for AI systems used in aviation.

Amends Regulation (EU) 2019/2144 on type-approval requirements for motor vehicles relating to their general safety and the protection of vehicle occupants and vulnerable road users to account for AI systems.

Amends Directive (EU) 2020/1828 on representative actions for the protection of the collective interests of consumers to include infringements of this regulation within its scope.

This regulation shall not apply to AI systems which are components of large-scale IT systems established by legislative acts listed in Annex X that have been placed on the market or put into service before 2 August 2027, unless the replacement or amendment of those legal acts leads to a significant change in their design or intended purpose.

The Commission shall assess the need for amendment of the list in Annex III and of the list of prohibited AI practices laid down in Article 5, once a year following the entry into force of this regulation and until the end of the period of delegation of power. The Commission shall evaluate and review this regulation by 2 August 2029.

This regulation enters into force on the twentieth day following its publication in the Official Journal. It shall apply from 2 August 2026, with specific provisions applying earlier or later: prohibited practices from 2 February 2025, GPAI and governance from 2 August 2025, high-risk product safety AI from 2 August 2027, and certain Annex I systems from 2 August 2030.