European Parliament
2024-2029
TEXTS ADOPTED
P10_TA(2026)0198
Simplification of the implementation of harmonised rules on artificial
intelligence (Digital Omnibus on AI)
European Parliament legislative resolution of 16 June 2026 on the proposal for a
regulation of the European Parliament and of the Council amending Regulations (EU)
2024/1689 and (EU) 2018/1139 as regards the simplification of the implementation of
harmonised rules on artificial intelligence (Digital Omnibus on AI) (COM(2025)0836 –
C10-0304/2025 – 2025/0359(COD))
(Ordinary legislative procedure: first reading)
The European Parliament,
– having regard to the Commission proposal to Parliament and the Council
(COM(2025)0836),
– having regard to Article 294(2) and Article 114 of the Treaty on the Functioning of the
European Union, pursuant to which the Commission submitted the proposal to
Parliament (C10-0304/2025),
– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,
– having regard to the opinion of the European Central Bank of 15 April 20261,
– having regard to the opinion of the European Economic and Social Committee of
18 March 20262,
– having regard to the opinion of the Committee of the Regions of 7 May 20263,
– having regard to the provisional agreement approved by the committees responsible
under Rule 75(4) of its Rules of Procedure and the undertaking given by the Council
representative by letter of 13 May 2026 to approve Parliament’s position, in accordance
with Article 294(4) of the Treaty on the Functioning of the European Union,
– having regard to Rule 60 of its Rules of Procedure,
– having regard to the joint deliberations of the Committee on Internal Market and
Consumer Protection and the Committee on Civil Liberties, Justice and Home Affairs
1 OJ C, C/2026/2285, 15.04.2026, ELI: http://data.europa.eu/eli/C/2026/2285/oj.
2 Opinion of 18 March 2026 (not yet published in the Official Journal).
3 Opinion of 7 May 2026 (not yet published in the Official Journal).
under Rule 59 of the Rules of Procedure,
– having regard to the opinions of the Committee on Transport and Tourism, Committee
on Culture and Education and the Committee on Legal Affairs,
– having regard to the report of the Committee on the Internal Market and Consumer
Protection and the Committee on Civil Liberties, Justice and Home Affairs (A10-
0073/2026),
1. Adopts its position at first reading hereinafter set out4;
2. Calls on the Commission to refer the matter to Parliament again if it replaces,
substantially amends or intends to substantially amend its proposal;
3. Instructs its President to forward its position to the Council, the Commission and the
national parliaments.
4 This position replaces the amendments adopted on 26 March 2026 (Texts adopted,
P10_TA(2026)0098).
P10_TC1-COD(2025)0359
Position of the European Parliament adopted at first reading on 16 June 2026 with a
view to the adoption of Regulation (EU) 2026/… of the European Parliament and of the
Council amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as
regards the simplification of the implementation of harmonised rules on artificial
intelligence (Digital Omnibus on AI)
(Text with EEA relevance)
THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular
Article 114 thereof,
Having regard to the proposal from the European Commission,
After transmission of the draft legislative act to the national parliaments,
Having regard to the opinion of the European Central Bank1,
Having regard to the opinion of the European Economic and Social Committee2,
Having regard to the opinion of the Committee of the Regions3,
Acting in accordance with the ordinary legislative procedure4,
1 OJ C, C/2026/2285, 15.4.2026, ELI: http://data.europa.eu/eli/C/2026/2285/oj.
2 Opinion of 18 March 2026 (not yet published in the Official Journal).
3 Opinion of 7 May 2026 (not yet published in the Official Journal).
4 Position of the European Parliament of 16 June 2026.
http://data.europa.eu/eli/C/2026/2285/oj
Whereas:
(1) Regulation (EU) 2024/1689 of the European Parliament and of the Council5 lays
down harmonised rules on artificial intelligence (AI) and aims to improve the
functioning of the internal market, to promote the uptake of human-centric and
trustworthy AI, while ensuring a high level of protection of health, safety and
fundamental rights and supporting innovation. Regulation (EU) 2024/1689 entered
into force on 1 August 2024. The entry into application of its provisions is staggered,
with all rules entering into application by 2 August 2027.
(2) The experience gathered from the implementation of the parts of Regulation (EU)
2024/1689 that already apply can inform the implementation of those parts that are
yet to apply. In this context, the delayed preparation of standards, which provide
technical solutions for providers of high-risk AI systems to ensure compliance with
their obligations under that Regulation, and the delayed establishment of the
governance and the conformity assessment frameworks at national level has resulted
in a compliance burden that is heavier than expected. In addition, consultations of
stakeholders have revealed the need for additional measures to facilitate and provide
clarification on implementation and compliance, without reducing the level of
protection for health, safety and fundamental rights from AI-related risks that the
provisions of Regulation (EU) 2024/1689 seek to achieve.
5 Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13
June 2024 laying down harmonised rules on artificial intelligence and amending
Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU)
2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU)
2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) (OJ L, 2024/1689,
12.7.2024, ELI: http://data.europa.eu/eli/reg/2024/1689/oj).
http://data.europa.eu/eli/reg/2024/1689/oj
(3) Targeted amendments to Regulation (EU) 2024/1689 are necessary to address certain
implementation challenges, with a view to the effective, simple and uniform
application of the relevant rules ▌.
(4) In order to enable AI innovation in the private and public sectors, it is important
that the Commission and Member States’ competent authorities ensure that the
supervision, enforcement and monitoring of sectoral and national laws do not
create overlaps, inconsistent interpretations or divergent enforcement.
(5) Regulation (EU) 2024/1689 lays down horizontal rules for AI systems to ensure a
consistent and high level of protection of public interests as regards health safety
and fundamental rights. For high-risk AI systems referred to in Article 6(1), that
Regulation applies in conjunction with the Union harmonisation legislation listed
in Section A of Annex I. In certain cases, it is possible for such Union
harmonisation legislation to lay down requirements that achieve the same or a
higher level of protection of relevant public interests as achieved by the specific
requirements or obligations laid down in Regulation (EU) 2024/1689. In that case,
it should be possible to limit the application of specific requirements or obligations
laid down in Regulation (EU) 2024/1689 in order to facilitate compliance,
minimise administrative burden and duplications, while preserving the level of
protection ensured by that Regulation. Such limitation should be possible where,
and to the extent that, the Union harmonisation legislation listed in Section A of
Annex I lays down requirements providing for an equivalent level of protection of
health, safety or fundamental rights as the requirement or obligation concerned.
The Commission should be empowered to adopt delegated acts to supplement that
Regulation by identifying such cases and specifying the products concerned, the
requirements or obligations that may be limited, and the conditions and scope of
any limitation, ensuring that the level of protection provided by Regulation (EU)
2024/1689 is not reduced.
(6) Most Union companies are small and medium-sized enterprises, the majority of
which are micro and small enterprises. Enterprises outgrowing the micro, small and
medium-sized enterprises (SMEs) definition, namely the ‘small mid-cap enterprises’
(SMCs), play a vital role in the Union’s economy. Compared to SMEs, SMCs tend to
demonstrate a faster pace of growth, and a higher level of innovation and digitisation.
Nevertheless, they face challenges similar to SMEs in relation to administrative
burden, leading to a need for proportionality in the implementation of Regulation
(EU) 2024/1689 and for targeted support. To enable the smooth transition of
enterprises from SMEs to SMCs, it is important to address in a coherent manner the
effect that Regulation may have on their activity once those enterprises become
SMCs and are faced with rules that apply to large enterprises. Regulation (EU)
2024/1689 provides for several measures for small-scale operators, which should be
extended to SMCs where appropriate while safeguarding the overarching
objectives and level of protection afforded under Regulation (EU) 2024/1689. In
order to clarify the treatment of SMEs and SMCs in Regulation (EU) 2024/1689, it is
necessary to introduce definitions for SMEs and SMCs, which should correspond to
the definition set out in the Annex to Commission Recommendation 2003/361/EC6
and Annex to Commission Recommendation (EU) 2025/10997, respectively.
6 Commission Recommendation of 6 May 2003 concerning the definition of micro,
small and medium-sized enterprises (OJ L 124, 20.5.2003, p. 36, ELI:
http://data.europa.eu/eli/reco/2003/361/oj).
7 Commission Recommendation (EU) 2025/1099 of 21 May 2025 on the definition of
small mid-cap enterprises (OJ L, 2025/1099, 28.5.2025, ELI:
http://data.europa.eu/eli/reco/2025/1099/oj).
http://data.europa.eu/eli/reco/2003/361/oj
http://data.europa.eu/eli/reco/2025/1099/oj
(7) The notion of a ‘safety component’ is crucial for the classification of certain AI
systems as high-risk according to Regulation (EU) 2024/1689. Thus, the notion
should be targeted to include only the AI systems which could have an adverse
impact on the health and safety of persons or property, in line with the risk-based
approach of that Regulation. The definition set out in Article 3, point (14) of
Regulation (EU) 2024/1689 does not provide the necessary clarity to allow
providers of AI systems to determine whether an AI system qualifies as a safety
component and, as a result, risks extending the high-risk classification of AI
systems beyond what is justified by the risk-based approach of that Regulation. It is
therefore necessary to amend that definition. First, it is necessary to provide clarity
on the concept of a ‘safety function’. The safety function should be an intended
purpose of the system, which is determined by the provider of the system. An AI
system fulfils a safety function where its intended purpose, as determined by the
provider, is to prevent or mitigate risks to the health and safety of persons or
property. In particular, this does not include AI systems which are intended to
solely fulfil functions related to user assistance, performance optimisation, service
efficiency, automation, convenience, or non-safety related aspects for quality
control operations. The mere fact that an AI system is integrated into or operates
within a product that is subject to Union harmonisation legislation does not, in
itself, mean that it fulfils a safety function.
(8) Article 4 of Regulation (EU) 2024/1689 currently imposes an obligation on all
providers and deployers of AI systems to ensure AI literacy of their staff.
Development of AI literacy starting from education and training and continuing in a
lifelong learning manner is crucial to equip providers, deployers and other affected
persons with the necessary skills to make informed decisions regarding the
deployment of AI systems. However, experience shared by stakeholders reveals that
a ▌ solution imposing stringent obligations to ensure a sufficient level of AI
literacy would not be suitable for all types of providers and deployers in relation to
the promotion of AI literacy ▌. Moreover, data indicates that imposing such
obligations creates an additional compliance burden, particularly for smaller
enterprises, whereas AI literacy should be a strategic priority, regardless of
regulatory obligations and potential sanctions. In light of that information, Article 4
of Regulation (EU) 2024/1689 should be amended to require ▌ providers and
deployers to take measures to support the development of AI literacy of their staff
and of other persons dealing with the operation and use of AI systems on their
behalf. The Commission and Member States should support and facilitate the
efforts of providers and deployers of AI systems, including through offering training
opportunities, providing informational resources, and allowing exchange of good
practices and other ▌ initiatives. When complying with this obligation, the
Commission and the Member States could take into account the European
competence frameworks, for example the Digital Competence Framework for
Citizens (DigComp) and the AI Literacy Framework for Primary and Secondary
Education. The European Artificial Intelligence Board (the Board) should support
the Commission and Member States by adopting recommendations setting out
common objectives to be achieved in order to meet their obligation and ensure
regular exchange between the Commission and Member States on the topic, while
the Apply AI Alliance should allow discussion with the wider community. ▌
▌
(9) Bias detection and correction constitute a substantial public interest because they
protect natural persons from the adverse effects of biases, including discrimination.
For that reason, Regulation (EU) 2024/1689 ▌ provides a legal basis authorising
providers of high-risk AI systems to process special categories of personal data in
certain exceptional cases and subject to strict safeguards. This legal basis is linked
to the obligation on those providers to establish practices concerning the detection,
prevention and correction of biases likely to affect the health and safety of persons,
have a negative impact on fundamental rights or lead to discrimination prohibited
under Union law. Nevertheless, biases likely to have those effects could also result
from the actions of the deployers of high-risk AI systems. Furthermore, such
biases could also arise in the case of other AI systems or models. For example,
biases in eligibility or risk-scoring tools used to assess applications for various
types of public permits or licences can restrict rights or effectively prevent certain
groups from accessing public services. Accordingly, a substantial public interest
exists to allow, exceptionally and where strictly necessary, the processing of special
▌categories of personal data for the purposes of bias detection and correction to
providers and deployers of other AI systems and models and deployers of high-risk
AI systems.
It is therefore necessary to extend the legal basis, established pursuant to
Regulation (EU) 2024/1689, to those providers and deployers. That legal basis
should be subject to the same limitations, conditions and safeguards that apply in
accordance with the existing Article 10(5) of that Regulation, thereby ensuring
compliance with Article 9(2), point (g) of Regulation (EU) 2016/679 of the European
Parliament and of the Council8, Article 10(2), point (g) of Regulation (EU)
2018/1725 of the European Parliament and of the Council9 and Article 10, point (a)
of Directive (EU) 2016/680 of the European Parliament and of the Council10.
Furthermore, to enable providers of high-risk AI systems to lawfully undertake
bias detection and correction activities in preparation for compliance with the
requirements for high-risk AI systems, including Article 10(2), points (f) and (g),
of Regulation (EU) 2024/1689, the legal basis established by Article 4a of
Regulation (EU) 2024/1689 should apply from the date of entry into application of
that Regulation.
8 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of personal data and on the
free movement of such data, and repealing Directive 95/46/EC (General Data Protection
Regulation) (OJ L 119, 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj)
9 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October
2018 on the protection of natural persons with regard to the processing of personal data by
the Union institutions, bodies, offices and agencies and on the free movement of such data,
and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295,
21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj).
10 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal data by competent
authorities for the purposes of the prevention, investigation, detection or prosecution of
criminal offences or the execution of criminal penalties, and on the free movement of such
data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89,
ELI: http://data.europa.eu/eli/dir/2016/680/oj).
http://data.europa.eu/eli/reg/2016/679/oj
http://data.europa.eu/eli/reg/2018/1725/oj
http://data.europa.eu/eli/dir/2016/680/oj
(10) Article 5 of Regulation (EU) 2024/1689 prohibits certain practices of AI systems
that are particularly harmful and abusive, contradict certain Union values and
violate certain fundamental rights. Article 5 is to be kept under review, as laid
down in Article 112(1) of that Regulation. In light of technological and societal
developments since the adoption of that Regulation, including the deployment and
widespread use of AI systems generating non-consensual intimate images, videos,
audio and similar material (‘non-consensual intimate material’) and child sexual
abuse material, it is necessary to amend Article 5 of that Regulation.
(11) Non-consensual intimate material constitutes sexual violence and abuse against
individuals, in particular women. AI systems that generate or manipulate such
material pose a severe risk to health safety and fundamental rights, including
victims’ human dignity, personal autonomy, integrity and private life, with
potentially serious lasting psychological and other harms, and enable abuse at
scale. The proliferation of such technologies, often described as ‘nudification’
applications, has created an urgent need for an explicit regulatory prohibition.
Child sexual abuse material, including wholly or partially synthetic material,
constitutes a grave threat to the safety and fundamental rights of children. AI
systems generating or manipulating such material pose a grave risk to human
dignity and the rights of the child, and risk normalising, amplifying and
perpetuating sexual violence against children. Accordingly, an amendment to
Article 5 of Regulation (EU) 2024/1689 is necessary both to protect women,
children, other individuals and society from seriously harmful practices, thereby
pursuing the objectives of that Regulation, and to bring clarity to providers and
deployers as to the scope of their obligations, thereby addressing implementation
challenges.
(12) It is necessary to define clearly the scope of the prohibition, including in particular
the extent of providers’ and deployers’ obligations. This prohibition should not
prevent providers from developing the technical capabilities of AI systems to
generate or manipulate images, videos, audio or similar material. As concerns
providers, the prohibition should be limited to the placing on the market or the
putting into service of AI systems that generate or manipulate non-consensual
intimate material or child sexual abuse material in two cases. First, it should cover
systems intended to generate or manipulate such material. Second, it should cover
systems where such generation or manipulation is a reasonably foreseeable and
reproducible outcome and there are no reasonable and adequate technical safety
measures and other safeguards in place, taking into account reasonably
foreseeable misuse, to reliably prevent, and where necessary correct, that outcome
and correct observed or reported misuse, including circumvention of such
measures. Technical measures and other safeguards to prevent the generation of
such material could include data cleaning, refusal training, safe prompt design
and output controls, runtime prompt guardrails, content classification and filtering
mechanisms, usage restrictions, abuse detection mechanisms, and notice and
action mechanisms. Such preventive measures should be reasonable for the
specific AI system, and are considered adequate if they align with the state-of-the-
art measures and demonstrably prevent or sufficiently reduce in each specific case
the likelihood of generating or manipulating such material, taking into account
known and reasonably foreseeable misuse, including reasonably foreseeable
circumvention of the preventive measures without significant technical
modification. For providers retaining effective control over AI systems, for
instance through a platform or a web interface, that could include following and
reporting methods for misuse cases in full compliance with Union privacy and data
protection law.
In cases of observed or reported circumvention of the preventive measures or other
safeguards, adequate corrective measures should be taken provided that such
measures are reasonable, taking into account the specific AI system, including its
release and distribution strategy (such as open-source releases). As concerns
deployers, the use of an AI system should be prohibited only where the deployer
uses an AI system for the purpose of generating or manipulating non-consensual
intimate material or child sexual abuse material. This includes cases where a
deployer uses or misuses AI systems placed on the market or put into service that
lack reasonable and adequate preventive measures or where a deployer
circumvents the preventive measures or uses for such purposes lawful AI systems
not intended to generate or manipulate such material. The prohibition on use
therefore does not cover the use of an AI system for lawful purposes, such as the
generation or manipulation of material other than non-consensual intimate
material or child sexual abuse material, even in cases where the AI system lacks
reasonable and adequate safeguards that should have been put in place by the
provider, nor does it cover accidental generation or manipulation of such content.
Concerning the prohibition regarding non-consensual intimate material, where an
AI system is intended for generation or manipulation of material falling under this
prohibition, measures and other safeguards should include appropriate means for
the distribution of the AI system aimed at enabling the reliable collection and
demonstration of consent of the depicted person to such generation or
manipulation, in compliance with Regulation (EU) 2016/679.
The prohibition regarding non-consensual intimate material should be limited to
realistic depictions of intimate parts, notably the genitals, pubic area, anus,
exposed buttocks or exposed female breasts, nipples or areolae, or of sexually
explicit activity. This ‘realism’ refers to the depiction of the person’s face, voice or
their body in a credible real-life manner, regardless of the realism of the context of
that depiction or whether it fully corresponds to the actual voice or appearance of
the depicted person. Conversely, it excludes cartoonish or physically impossible
depictions of a person’s body. The prohibition of non-consensual intimate material
does not affect the generation or manipulation of other forms of nude material,
such as material that does not depict identifiable natural persons, realistic partially
nude depictions where intimate parts are not revealed and sexually explicit
activities are not depicted, or non-realistic artistic nude works that do not
realistically depict identifiable natural persons engaged in sexually explicit activity
or depict their intimate parts. It also does not cover generative AI applications
where intimate parts are not exposed or, if exposed, this is subject to the freely
given, specific, informed, unambiguous and explicit consent of the depicted person
(for example, try-on applications and medical applications, such as medical
anatomical simulations and mammograms); this prohibition does not preclude the
exceptional use of AI systems generating or manipulating nude depictions of the
intimate parts of an identifiable person, in accordance with fundamental rights
law, including data protection law, and applicable medical law, for the purpose of
medical diagnosis and treatment by medical professionals where the person
concerned is incapable of consent (for instance in an emergency situation).
Finally, the prohibition on ‘manipulating’ non-consensual intimate material
excludes cases where pre-existing intimate material is manipulated in a way that
does not increase the exposure of any depicted intimate parts or alter the nature of
any depicted sexually explicit activities, for instance the mere enhancement of an
existing image depicting intimate parts or video depicting sexually explicit
activities, such as changing the background, adding a text heading or enhancing
the contrast or the brightness. Conversely, any manipulation of material, including
material that already depicts intimate parts or sexually explicit activity, that
increases the level of exposure of any depicted intimate parts or alters the nature of
any depicted sexually explicit activities, falls under the scope of this prohibition.
(13) The prohibition on child sexual abuse material should not prevent the placing on
the market, putting into service or use of an AI system where a ‘without right’
defence applies under national law, as referred to in Article 5(1) of Directive
2011/93/EU of the European Parliament and of the Council11. This includes
activities carried out under domestic legal powers, such as the legitimate
generation, or manipulation of child sexual abuse material by the authorities in
order to conduct criminal proceedings or to prevent, detect or investigate crime, as
well as the legitimate use of the AI system in the context of red-teaming and
evaluation activities for the purpose of assessing the system’s compliance with the
prohibition laid down in this Regulation.
11 Directive 2011/93/EU of the European Parliament and of the Council of 13
December 2011 on combating the sexual abuse and sexual exploitation of children
and child pornography, and replacing Council Framework Decision 2004/68/JHA
(OJ L 335, 17.12.2011, p. 1, ELI: http://data.europa.eu/eli/dir/2011/93/oj).
http://data.europa.eu/eli/dir/2011/93/oj
(14) These prohibitions constitute justified interferences with the freedom of expression
and information and the freedom to conduct a business. They pursue objectives of
general interest and protect the rights and freedoms of others, including those set
out in Article 1, Article 3(1) and Articles 4, 7, 8, 21, 23 and 24 of the Charter of
Fundamental Rights of the European Union (the Charter). They are closely
tailored. In the case of intimate material, they are limited to realistic depictions of
identifiable natural persons and to cases where the AI system is used to increase
the level of nudity or explicitness; and exclude generation or manipulation with
the person’s consent. Moreover, they are limited to requiring providers to
implement ‘reasonable and adequate’ measures and safeguards in the case of
systems not intended to generate or manipulate the prohibited material. They are
also aligned with existing Union law, including Directive (EU) 2011/93/EU and
Directive (EU) 2024/1385 of the European Parliament and of the Council12. The
interferences respect the essence of Articles 11 and 16 of the Charter, are
prescribed by law, and are proportionate.
12 Directive (EU) 2024/1385 of the European Parliament and of the Council of 14 May 2024
on combating violence against women and domestic violence (OJ L, 2024/1385, 24.5.2024,
ELI: http://data.europa.eu/eli/dir/2024/1385/oj).
http://data.europa.eu/eli/dir/2024/1385/oj
(15) The conduct covered by these prohibitions may also violate other law, including
criminal law. The prohibitions do not preclude prosecution under such law.
However, insofar as an infringement of the prohibitions may result in the
imposition of penalties of a criminal nature, which may be laid down pursuant to
Article 99(1) of Regulation (EU) 2024/1689, and to the extent that the same
conduct is sanctioned under criminal law, including criminal law falling within
the scope of Directives 2011/93/EU and (EU) 2024/1385, Member States are
required to ensure respect for the ne bis in idem principle in accordance with the
Charter.
(16) The prohibitions are without prejudice to remedies available under national laws
for individuals to protect their fundamental rights, including rights to their image,
privacy and human dignity.
(17) In order to ensure consistency, avoid duplication and minimise administrative
burdens in relation to the procedure for the designation of notified bodies pursuant to
Regulation (EU) 2024/1689, while maintaining the same level of scrutiny, a single
application and a unified assessment procedure should be available for new
conformity assessment bodies and notified bodies which are designated pursuant to
the Union harmonisation legislation listed in Section A of Annex I to Regulation
(EU) 2024/1689, such as Regulations (EU) 2017/74513 and (EU) 2017/74614 of the
European Parliament and of the Council, where such an application and procedure is
established pursuant to that Union harmonisation legislation. The single application
and unified assessment procedure aims to facilitate, support and expedite the
designation procedure in accordance with Regulation (EU) 2024/1689, while
ensuring compliance with the requirements applicable to notified bodies in
accordance with that Regulation and the Union harmonisation legislation listed in
Section A of Annex I thereto. The unified assessment procedure should be carried
out with respect to the tasks and responsibilities of the authorities involved.
Moreover, it should be clarified that a conformity assessment body that is
designated pursuant to more than one piece of Union harmonisation legislation
listed in Section A of Annex I should have to apply only once to be designated
pursuant to this Regulation.
13 Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April
2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC)
No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives
90/385/EEC and 93/42/EEC (OJ L 117, 5.5.2017, p. 1, ELI:
http://data.europa.eu/eli/reg/2017/745/oj).
14 Regulation (EU) 2017/746 of the European Parliament and of the Council of 5 April
2017 on in vitro diagnostic medical devices and repealing Directive 98/79/EC and
Commission Decision 2010/227/EU (OJ L 117, 5.5.2017, p. 176, ELI:
http://data.europa.eu/eli/reg/2017/746/oj).
http://data.europa.eu/eli/reg/2017/745/oj
http://data.europa.eu/eli/reg/2017/746/oj
(18) With a view to ensuring the smooth application and consistency of Regulation (EU)
2024/1689, amendments should be made to it. A technical correction to Article
43(3), first subparagraph, of Regulation (EU) 2024/1689 should be made to align the
conformity assessment requirements with the requirements of providers of high-risk
AI systems in Article 16 of that Regulation. Moreover, it should be clarified that
where a provider of a high-risk AI system is subject to the conformity assessment
procedure under Union harmonisation legislation listed in Section A of Annex I to
Regulation (EU) 2024/1689, and the conformity assessment extends to the
compliance of the quality management system of that Regulation and of such Union
harmonisation legislation, the provider should be able to include aspects related to
quality management systems pursuant to that Regulation as part of the quality
management systems pursuant to such Union harmonisation legislation, in
accordance with Article 17(3) of Regulation (EU) 2024/1689. Article 43(3), second
subparagraph, of that Regulation should be amended to clarify that notified bodies
which have been notified pursuant to the Union harmonisation legislation listed in
Section A of Annex I to Regulation (EU) 2024/1689 and which aim to assess high-
risk AI systems covered by the Union harmonisation legislation listed in Section A of
Annex I to that Regulation, should have the power to assess the conformity of high-
risk AI systems under certain conditions for 18 months from … [the entry into force
of this Regulation].
This amendment is without prejudice to Article 28 of Regulation (EU) 2024/1689,
thus conformity assessment bodies that wish to be designated and notified
pursuant to that Regulation can submit an application at any time during and after
these 18 months. Moreover, Regulation (EU) 2024/1689 should be amended to
clarify that where a high-risk AI system is both covered by the Union harmonisation
legislation listed in Section A of Annex I to Regulation (EU) 2024/1689 and falls
within one of the use-cases listed in Annex III to that Regulation, the provider should
follow the relevant conformity assessment procedure as required under that relevant
harmonisation legislation.
(19) Regulation (EU) 2024/1689 and Regulation (EU) 2024/2847 of the European
Parliament and of the Council15 complement each other so that the safety and
cybersecurity of products with digital elements is ensured. Article 12 of Regulation
(EU) 2024/2847 states that where high-risk AI systems and processes put in place
by manufacturers fulfil the essential cybersecurity requirements set out in
Regulation (EU) 2024/2847, they should be deemed to comply with the
cybersecurity requirements set out in Article 15 of Regulation (EU) 2024/1689 in
so far as those requirements are covered by the EU declaration of conformity or
parts thereof issued pursuant to Regulation (EU) 2024/2847. In order to improve
the visibility of the interplay of Regulation (EU) 2024/1689 and Regulation (EU)
2024/2847, the rule of Article 12 of Regulation (EU) 2024/2847 should also be
reflected in Regulation (EU) 2024/1689. The interplay between the two
instruments should not be affected.
15 Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23
October 2024 on horizontal cybersecurity requirements for products with digital
elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and
Directive (EU) 2020/1828 (Cyber Resilience Act) (OJ L, 2024/2847, 20.11.2024,
ELI: http://data.europa.eu/eli/reg/2024/2847/oj).
http://data.europa.eu/eli/reg/2024/2847/oj
(20) In accordance with Article 6(1) of Regulation (EU) 2024/1689, AI systems are
classified as high-risk where an AI system that is a component of a product
covered by Union harmonisation legislation listed in Section A of Annex I to that
Regulation is a safety component and that product requires a third-party
conformity assessment. The requirement that such product must require a third-
party conformity assessment, however, does not affect the choice of the
manufacturer regarding the conformity assessment procedure for such product.
Where Union harmonisation legislation listed in Section A of Annex I allows to
choose a conformity assessment procedure based on harmonised standards
amongst conformity assessment procedures, this possibility remains applicable also
to products in which a high-risk AI system is embedded. Article 6(1) of Regulation
(EU) 2024/1689 should not be understood to require products in which a high-risk
AI system is embedded to automatically undergo a third-party conformity
assessment involving a notified body. Where this possibility is provided for in
Union harmonisation legislation, the provider of the product in which the high-
risk AI system is embedded could continue to rely on harmonised standards to
comply with the requirements of the Union harmonisation legislation and
Regulation (EU) 2024/1689 as a conformity assessment procedure.
▌
(21) In order to enhance competitiveness and innovation, it is essential to support
economic operators that are required to comply simultaneously with the
requirements or obligations set out in Chapter III, Sections 2 and 3 of Regulation
(EU) 2024/1689, and with the relevant requirements and obligations laid down in
the Union harmonisation legislation listed in Annex I to that Regulation. To
support and simplify the regulatory compliance pathways of such economic
operators, the Commission should request that, without undue delay, the European
standardisation organisations develop standardisation deliverables, including,
where appropriate, harmonised standards. Those standardisation deliverables
should be based on the harmonised standards published in the Official Journal of
the European Union that give the presumption of conformity with the
requirements or obligations of Regulation (EU) 2024/1689, as well as any relevant
harmonised standards published in the Official Journal of the European Union
that give the presumption of conformity with the relevant requirements or
obligations set out in the Union harmonisation legislation listed in Annex I to that
Regulation. Such standardisation deliverables should help reduce legal
uncertainty, avoid unnecessary duplication of conformity assessment activities,
testing, documentation and reporting obligations, and lower compliance costs, in
particular for small and medium-sized enterprises and start-ups. Timely
development of such deliverables is essential in order to provide economic
operators with practical and reliable technical solutions, strengthen legal certainty
and facilitate the placing on the market, putting into service and use of AI systems
in accordance with this Regulation and the Union harmonisation legislation listed
in Annex I to that Regulation.
(22) To streamline compliance and reduce associated costs, the registration of AI systems
referred to in Article 6(3) of Regulation (EU) 2024/1689 in the EU database pursuant
to Article 49(2) of that Regulation should be simplified by streamlining the content
required under Annex VIII to that Regulation. While it remains crucial for
effective market surveillance and public accountability that such AI systems are
registered in the EU database, the registration requirements should be simplified
and made more proportionate. This simplification would strike a better balance
without undermining the protection laid down by Regulation (EU) 2024/1689.
Such AI systems are not considered to be high risk under certain conditions where
they do not pose a significant risk of harm to the health, safety or fundamental rights
of persons. Furthermore, a provider applying Article 6(3) of Regulation (EU)
2024/1689 remains obligated to document its assessment before that AI system is
placed on the market or put into service. National competent authorities should be
able to request that assessment .
(23) Articles 57, 58 and 60 of Regulation (EU) 2024/1689 should be amended to
strengthen further cooperation at Union level of AI regulatory sandboxes, foster
clarity and consistency in the governance of AI regulatory sandboxes, and to extend
the scope of real-world testing outside AI regulatory sandboxes to high-risk AI
systems covered by the Union harmonisation legislation listed in Annex I to that
Regulation. In particular, to allow procedural simplification, where applicable, in the
projects supervised in the AI regulatory sandboxes that also include real-world
testing, the real-world testing plan should be integrated into the sandbox plan agreed
by the providers or prospective providers and the competent authority. ▌
(24) In addition, it is appropriate to provide for the possibility of the European Artificial
Intelligence Office (AI Office) to establish an AI regulatory sandbox at Union level
for AI systems that are covered by Article 75(1) of Regulation (EU) 2024/1689. To
ensure coherence, legal certainty and an efficient allocation of supervisory
responsibilities between Union and national levels, the scope of the Union-level AI
regulatory sandbox should be clearly defined in order to avoid any overlap with
national AI regulatory sandboxes established pursuant to that Regulation. In order
to foster innovation and facilitate the uptake of AI, SMEs, including startups, and
SMCs should be provided with priority access to the AI regulatory sandboxes
established by the AI Office.
(25) Moreover, the provisions on the cooperation between relevant competent
authorities for the operation of an AI regulatory sandbox should be clarified in
order to ensure their effective functioning. For that reason, the empowerment of
the Commission to adopt implementing acts specifying the detailed arrangements
for the establishment, development, implementation, operation and supervision of
the AI regulatory sandboxes should be extended to also cover governance aspects
of such sandboxes. In addition, where AI regulatory sandboxes involve innovative
AI systems that process personal data or otherwise fall under the supervisory remit
of other national authorities or competent authorities providing or supporting
access to data, the relevant competent supervisory authorities should be associated
with the operation of the AI regulatory sandbox and involved in the supervision of
those aspects to the extent of their respective tasks and powers.
(26) To foster innovation, it is also appropriate to extend the scope of real-world testing
outside AI regulatory sandboxes in Article 60 of Regulation (EU) 2024/1689,
currently applicable to high-risk AI systems listed in Annex III to that Regulation,
and allow providers and prospective providers of high-risk AI systems covered by
the Union harmonisation legislation listed in Annex I to that Regulation to also test
such systems in real-world conditions, subject to sufficient safeguards. This is
without prejudice to other Union or national law on the testing in real-world
conditions of high-risk AI systems related to products covered by that Union
harmonisation legislation. ▌
(27) It is also appropriate to ensure that real-world testing of high-risk AI systems
covered by the Union harmonisation legislation listed in Section B of Annex I to
Regulation (EU) 2024/1689 is possible. Those systems are subject to the
requirements and procedures of the relevant sectoral legislation and are, for most
purposes, not directly subject to that Regulation. Those sectoral acts will, in due
course, incorporate requirements corresponding to the requirements set out in
Articles 8 to15 of that Regulation. Therefore, it is appropriate to ensure that
Member States can allow real-world testing of these AI systems with a view to
assessing and verifying the conformity of those systems with the requirements set
out in Articles 8 to 15 of that Regulation. If Member States decide to allow such
testing, that Regulation should require them to adopt frameworks setting out the
detailed requirements for such testing. That Regulation should provide for
essential elements to be contained in such frameworks. When designing such
frameworks, Member States should ensure a high level of protection of health
safety and fundamental rights of natural persons. Before implementing the
framework, Member States should notify it to the Commission. The real-world
testing should comply with the relevant Union harmonisation legislation listed in
Section B of Annex I to Regulation (EU) 2024/1689, including any applicable
provisions regarding testing. However, this should not affect the application of the
new article regarding real-world testing.
(28) Article 63 of Regulation (EU) 2024/1689 offers microenterprises who are providers
of high-risk AI systems the possibility to benefit from a simplified way to comply
with the obligation to establish a quality management system. With a view to
facilitating compliance for more innovators, that possibility should be extended to all
SMEs, including start-ups.
(29) In light of the important role of the AI Office for the effective and coordinated
governance of Regulation (EU) 2024/1689, as further reinforced by this
Regulation, and without prejudice to the next Multiannual Financial Framework
and to the budgetary procedure, the Commission should allocate adequate human,
financial and technical resources to the AI Office to ensure that it can effectively,
and within reasonable timeframes, perform its tasks in relation to the enforcement
of Regulation (EU) 2024/1689, including the allocation of a sufficient number of
permanent personnel with in-depth competences and technical expertise.
(30) Article 69 of Regulation (EU) 2024/1689 should be amended to simplify the fee
structure of the scientific panel. If Member States call upon the panel’s expertise, the
fees they may be required to pay to the experts should be equivalent to the
remuneration the Commission is obliged to pay in similar circumstances. ▌
(31) In order to strengthen the governance system for AI systems ▌ , it is necessary to
clarify the role of the AI Office in monitoring and supervising the compliance of
such AI systems with Regulation (EU) 2024/1689. The Commission has exclusive
competence as regards general-purpose AI models under Article 88 of that
Regulation. To increase coherence, clarity and effectiveness, and in light of the
reach and impacts of AI systems linked to those competences, the scope of the AI
Office’s exclusive competence to supervise systems should be refined. In particular,
the AI Office should have exclusive competence over AI systems built on general-
purpose AI models, not only where both the system and the model are developed by
the same provider, but also where they are developed by providers that form part of
the same undertaking. However, in certain cases, in particular where there is
specific sectoral supervision, responsibility should remain with the relevant
national competent authority. Accordingly, certain exceptions should be laid down.
The personal scope of this exclusive competence should extend to the providers of
those AI systems and to their deployers within the same undertaking. Other
deployers should remain subject to national supervision and enforcement.
Moreover, this does not include AI systems placed on the market, put into service or
used by Union institutions, bodies, offices or agencies, which are under the
supervision of the European Data Protection Supervisor pursuant to Article 74(9) of
Regulation (EU) 2024/1689. ▌
▌
▌
(32) Additionally, considering the existing supervisory and enforcement system under
Regulation (EU) 2022/2065 of the European Parliament and of the Council16, it is
appropriate to grant the Commission the powers of a competent market surveillance
authority pursuant to Regulation (EU) 2024/1689 where an AI system qualifies as a
very large online platform or a very large online search engine in accordance with
Regulation (EU) 2022/2065, or where it is embedded in such a platform or search
engine. This should contribute to ensuring that the exercise of the Commission’s
supervision and enforcement powers pursuant to Regulation (EU) 2024/1689 and
Regulation (EU) 2022/2065, as well as those applicable to general-purpose AI
models integrated into such platforms or search engines, is carried out in a coherent
and effective manner. This is also appropriate in light of the importance of such
platforms and search engines, in view of their reach, impact and potential to cause
complex and large societal harms. The personal scope of this exclusive competence
should extend to the providers of those AI systems and to their deployers within the
same undertaking. In the case of AI systems embedded in or qualifying as a very
large online platform or search engine, the first point of entry for the assessment of
the AI systems are the risk assessment, mitigating measures and audit obligations
prescribed by Articles 34, 35 and 37 of Regulation (EU) 2022/2065, without
prejudice to the AI Office’s powers to investigate and enforce ex post non-
compliance with the rules of Regulation (EU) 2024/1689.
16 Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October
2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital
Services Act) (OJ L 277, 27.10.2022, p. 1, ELI: http://data.europa.eu/eli/reg/2022/2065/oj).
http://data.europa.eu/eli/reg/2022/2065/oj
In the context of the analysis of this risk assessment, mitigating measures and audits,
the Commission services responsible for the enforcement of Regulation (EU)
2022/2065 may seek the opinion of the AI Office on the outcome of a potential
earlier or parallel risk assessment carried out in accordance with Regulation (EU)
2024/1689 and the applicability of prohibitions pursuant to Regulation (EU)
2024/1689. In addition, the AI Office and the competent national authorities should,
in accordance with Regulation (EU) 2024/1689, coordinate their enforcement efforts
with the authorities competent for the supervision and enforcement of Regulation
(EU) 2022/2065, including the Commission, in order to ensure that the principles of
loyal cooperation, proportionality and non bis in idem are respected, while
information obtained pursuant to one Regulation is to be used for the purposes of
supervision and enforcement of the other only provided the undertaking agrees. In
particular, those authorities should exchange views regularly and take into account,
in their respective areas of competence, any fines and penalties imposed on the same
provider for the same conduct through a final decision in proceedings relating to an
infringement of other Union or national rules, so as to ensure that the overall fines
and penalties imposed are proportionate and correspond to the seriousness of the
infringements committed.
(33) When supervising and enforcing obligations in relation to AI systems under its
competence, the AI Office has the same role and responsibility as a market
surveillance authority pursuant to Regulation (EU) 2024/1689. Consequently, it is
necessary for the AI Office to have all of the powers and responsibilities that
market surveillance authorities have pursuant to that Regulation and Regulation
(EU) 2019/1020 of the European Parliament and of the Council 17 (‘the general
powers’). These should ensure the appropriate and effective enforcement of the
requirements and obligations set out in Regulation (EU) 2024/1689. However, it is
necessary to specify, complement, and frame certain essential elements and other
aspects of the general powers, as well as their safeguards (‘the specifying
provisions’). In particular, it is necessary to lay down provisions governing the
relationship between the AI Office and national authorities; provisions specifying,
complementing, and constraining the powers to request information and conduct
on-site inspections; provisions governing investigations, including the possibility to
make commitments binding; and provisions specifying and constraining power to
find non-compliance, impose fines and impose periodic penalties. Where a type of
general power has been so specified, the AI Office may not circumvent the
conditions and limits of those powers by relying on a related general power.
Conversely, types of general power that are not specified and framed in respect of
the AI Office, such as the power to adopt measures referred to in Article 16(3) of
Regulation (EU) 2019/1020, may be relied on by the AI Office.
17 Regulation (EU) 2019/1020 of the European Parliament and of the Council of 20 June 2019
on market surveillance and compliance of products and amending Directive 2004/42/EC and
Regulations (EC) No 765/2008 and (EU) No 305/2011 (OJ L 169, 25.6.2019, p. 1,
ELI: http://data.europa.eu/eli/reg/2019/1020/oj).
http://data.europa.eu/eli/reg/2019/1020/oj
As necessary for the proper implementation of Regulation (EU) 2024/1689, the
Commission should be able to adopt implementing acts further defining the rules
and the procedures concerning the application of limitation periods and, the access
to the file and the negotiated disclosure of information. In exercising all of these
powers, the AI Office must comply with the Charter. Additionally, the AI Office is
subject to the safeguards and protection for fundamental rights laid down in the
specifying provisions.
(34) In addition to those procedural and fundamental rights safeguards ▌ the
procedural rights provided for in Article 18 of Regulation (EU) 2019/1020 should
apply mutatis mutandis to providers of AI systems, without prejudice to more
specific procedural rights provided for in Regulation (EU) 2024/1689. When
national market surveillance authorities, through the single point of contact,
request that the AI Office takes supervisory and enforcement measures with
regards to AI systems under its exclusive supervision, the AI Office should no later
than four months following the receipt of that request, inform the single point of
contact of its intention to exercise its supervisory and enforcement powers or of its
reasons for not exercising its powers. If the AI Office decides to exercise its
supervisory and enforcement powers, it should also inform the single point of
contact about the final outcome of such proceedings and of intermediate
developments that the AI Office considers as having a major impact in the
investigation, including the decision to open proceedings, to impose a fine, and to
withdraw or recall the AI system from the market.
(35) To enable access to the Union market for AI systems which are under the supervision
of the AI Office pursuant to Article 75 of Regulation (EU) 2024/1689 and subject to
a third party conformity assessment, the Commission should be responsible for the
pre-market conformity assessments of those systems.
(36) Article 77 and related provisions of Regulation (EU) 2024/1689 constitute an
important governance mechanism, as they aim to enable authorities or bodies
responsible for enforcing or supervising Union law intended to protect fundamental
rights to fulfil their mandate under specific conditions and to foster cooperation with
market surveillance authorities responsible for the supervision and enforcement of
that Regulation. It is necessary to clarify the scope of such cooperation, as well as to
clarify which public authorities or bodies benefit from it. With a view to reinforcing
cooperation, it should be clarified that requests to access information and
documentation should be made to the competent market surveillance authority,
which should respond to such requests without undue delay, and that the authorities
or bodies involved should have a mutual obligation to cooperate. It should be
clarified that these provisions are without prejudice to the competences, tasks,
powers and independence of the relevant national public authorities or bodies
under their mandates. In particular, those provisions do not limit any powers that
those authorities and bodies have to request information pursuant to other Union
or national law. Accordingly, those authorities and bodies retain any power they
have to directly request information from operators pursuant to their mandate or
Union or national law.
(37) The requirements for high-risk AI systems laid down in Regulation (EU)
2024/1689 address specific risks inherent to AI systems, including bias,
unpredictable model behaviour, poor robustness or accuracy, vulnerabilities to
attacks by third parties, and a lack of transparency of the AI system. By addressing
AI-specific risks, that Regulation complements the requirements laid down in
Union harmonisation legislation listed in Annex I to that Regulation, without
duplicating them. Regulation (EU) 2024/1689 provides mechanisms for economic
operators to minimise the compliance burden. In particular, Article 8(2) on the
interplay with the sectoral legislation, Article 9(10) on risk management and
Article 17(3) on quality management, allow economic operators to integrate, when
necessary and appropriate, an assessment of AI-specific risks into existing risk and
quality management systems. Article 40 of Regulation (EU) 2024/1689 further
requires the Commission to specify that harmonised standards developed pursuant
to that Regulation are to be consistent with standards developed pursuant to the
Union harmonisation legislation listed in Annex I to that Regulation. The
Commission should provide guidelines to assist economic operators of high-risk AI
systems covered in Annex I to Regulation (EU) 2024/1689 in complying with that
Regulation, including by providing guidance on the application of Article 8(2),
Article 9(10) and Article 17(3) of that Regulation as mechanisms to minimise the
compliance burden, in line with principles of complementarity and proportionality.
Those guidelines should be published, at the latest, by 1 August 2027.
(38) To allow sufficient time for providers of generative AI systems subject to the
marking obligations laid down in Article 50(2) of Regulation (EU) 2024/1689 to
adapt their practices within a reasonable time without disrupting the market, it is
appropriate to introduce a transitional period of four months for providers who have
already placed their systems on the market before the 2 August 2026.
(39) To provide sufficient time for providers of high-risk AI systems and to clarify rules
applicable to the AI systems already placed on the market or put into service before
the relevant provisions of Regulation (EU) 2024/1689 apply, it is appropriate to
clarify the scope of the grace period provided in Article 111(2) of that Regulation.
For the purpose of that Article 111(2), the grace period should apply where the
type and model of AI system has already been placed on the market. This means that
if at least one individual unit of the high-risk AI system has been lawfully placed on
the market or put into service before the date specified in Article 111(2), other
individual units of the same type and model of high-risk AI system are subject to the
grace period provided in that Article 111(2) and thus may continue to be placed on
the market, made available or put into service on the Union market without any
additional obligations, requirements or the need for additional certification, as long
as the design of that high-risk AI system remains unchanged. For the purposes of the
application of the grace period provided in Article 111(2), the decisive factor is the
date on which the first unit of that type and model of high-risk AI system was placed
on the market or put into service on the Union market for the first time. Any
significant change to the design of that AI system after the date specified in Article
111(2) should trigger the obligation of the provider to fully comply with all relevant
provisions of that Regulation applicable to high-risk AI systems, including the
conformity assessment requirements.
(40) Article 113 of Regulation (EU) 2024/1689 establishes the dates of entry into force
and application of that Regulation, in particular that the general date of application is
2 August 2026. For the obligations related to high-risk AI systems laid down in
Sections 1, 2 and 3 of Chapter III of Regulation (EU) 2024/1689, the delayed
availability of standards, common specifications, and alternative guidance and the
delayed establishment of national competent authorities lead to challenges that
jeopardise the effective entry into application of those obligations and that risk a
significant increase in implementation costs in a way that does not justify
maintaining their initial date of application, namely 2 August 2026. Therefore, it is
appropriate that the date of application of Sections 1, 2 and 3 of Chapter III is set to
2 December 2027 for AI systems classified as high-risk pursuant to Article 6(2) and
Annex III, and to 2 August 2028 for AI systems classified as high-risk pursuant to
Article 6(1) and Annex I ▌. The distinction between the entry into application of the
rules as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex
III and Article 6(1) and Annex I to that Regulation is consistent with the difference
between the initial dates of application envisaged in Regulation (EU) 2024/1689 and
aims to provide the necessary time for adaptation and implementation of the
corresponding obligations. The timely availability of support instruments, including
guidance, relevant standards, common specifications and codes of practice is
important in order to facilitate compliance and reduce the risk of divergent
interpretation and uneven application of the rules across Member States. In order
to ensure legal certainty and to avoid further delays in the application of
Regulation (EU) 2024/1689, the Commission should ensure that measures in
support of compliance with regard to Chapter III, Sections 1, 2, and 3 of that
Regulation are in place in due time to ensure timely and effective implementation
of the necessary provisions.
▌
(41) In light of the objective to reduce implementation challenges for citizens, businesses
and public administrations, it is essential that harmonised conditions for the
implementation of certain rules are adopted only where strictly necessary. For that
purpose, it is appropriate to remove certain empowerments bestowed on the
Commission to adopt such harmonised conditions by means of implementing acts in
cases where that is not the case. Article 50(7), Article 56(6), and Article 72(3) of
Regulation (EU) 2024/1689 should therefore be amended to remove the
empowerments conferred on the Commission to adopt implementing acts. Given
that the codes of practice referred to in Article 50(7) and Article 56(6) have limited
legal effect, and in particular do not grant a presumption of conformity, it is not
strictly necessary for these codes to be approved by an implementing act. Providers
should be able to rely, pursuant to Article 53(4) and Article 54(2) of Regulation
(EU) 2024/1689, on codes of practice assessed as adequate pursuant to Article
56(6) thereof. The removal of the empowerment to adopt a harmonised template for
a post-market monitoring plan in Article 72(3) of Regulation (EU) 2024/1689 has the
additional benefit of offering more flexibility for providers of high-risk AI systems to
put in place a system for post-market monitoring that is tailored to their organisation.
At the same time, recognising the need to offer clarity regarding how providers of
high-risk AI systems are required to comply with their obligation set out in Article
72(1) of Regulation (EU) 2024/1689, the Commission should be required to publish
guidance, including a voluntary template, on the post-market monitoring plan by 2
September 2027.
(42) The use of artificial intelligence in machinery can help foster innovation and
improve the efficiency of those machines. The application of Regulation (EU)
2023/1230 of the European Parliament and of the Council18 and Regulation (EU)
2024/1689 might lead to overlaps. At the same time, it is important to ensure a level
of protection with regard to risks related to the use of artificial intelligence in
machinery that is consistent with the level of protection provided in Regulation
(EU) 2024/1689 with regard to high-risk AI systems. Given the specific nature of
machinery and the machinery sector, and in order to address the need to simplify
the regulatory framework for AI-enabled machinery, it is appropriate to move to a
sectoral approach by moving Regulation (EU) 2023/1230 from Section A to
Section B of Annex I to Regulation (EU) 2024/1689. Accordingly, first, the
application of Regulation (EU) 2024/1689 to those machines should be limited to
the provisions referred to in Article 2(2) of that Regulation. The reference to
Directive 2006/42/EC should be moved from Section A to Section B of Annex I to
Regulation (EU) 2024/1689 and updated so as to refer to Regulation (EU)
2023/1230. Second, it is crucial to ensure that Regulation (EU) 2023/1230
incorporates essential health and safety requirements for high-risk AI systems
classified pursuant to Article 6(1) of Regulation (EU) 2024/1689 and used as a
safety component in machinery or high-risk AI systems constituting machinery
that ensure a level of protection consistent with Regulation (EU) 2024/1689.
18 Regulation (EU) 2023/1230 of the European Parliament and of the Council of 14 June 2023
on machinery and repealing Directive 2006/42/EC of the European Parliament and of the
Council and Council Directive 73/361/EEC (OJ L 165, 29.6.2023, p. 1,
ELI: http://data.europa.eu/eli/reg/2023/1230/oj).
http://data.europa.eu/eli/reg/2023/1230/oj
To that end, the Commission should be required to adopt delegated acts amending
Annex III to Regulation (EU) 2023/1230 in order to reflect the relevant
requirements set out in Chapter III, Section 2, and Articles 17, 19, 72 and 73 of
Regulation (EU) 2024/1689 . To avoid a legal gap and ensure alignment with the
entry into application of the relevant high-risk AI system rules set out in
Regulation (EU) 2024/1689, those delegated acts should apply by 2 August 2028.
For the same reasons, manufacturers should be free to rely on harmonised
standards or common specifications referenced or adopted pursuant to Regulation
(EU) 2024/1689 that cover the relevant essential requirements for the presumption
of conformity within the meaning of Article 20 of Regulation (EU) 2023/1230 until
harmonised standards or common specifications regarding AI are referenced or
adopted pursuant to Regulation (EU) 2023/1230.
▌
(43) Conformity assessments of high-risk AI systems pursuant to Regulation (EU)
2024/1689 can require the involvement of conformity assessment bodies. Only
conformity assessment bodies that have been designated pursuant to that Regulation
are able to carry out conformity assessments, and only for the activities related to the
categories and types of AI systems concerned. To enable the specification of the
scope of the designation of conformity assessment bodies notified pursuant to Article
30 of Regulation (EU) 2024/1689, it is necessary to draw up a list of codes,
categories, and corresponding types of AI systems. The list of codes should take into
account whether the AI system is a component of a product or itself a product
covered by the Union harmonisation legislation listed in Annex I to Regulation (EU)
2024/1689 (referred to as ‘AIP codes’, for AI systems covered by product
legislation), or a system listed in Annex III to that Regulation, which currently
concerns only biometric AI systems referred to in point (1) of Annex III (referred to
as ‘AIB codes’, for biometric AI systems). Both AIP codes and AIB codes are
vertical codes. The AIP codes are reference codes that provide a link to the Union
harmonisation legislation listed in Section A of Annex I to Regulation (EU)
2024/1689. The AIB codes are new codes specific to Regulation (EU) 2024/1689
that identify biometric AI systems referred to in point (1) of Annex III to that
Regulation.
The list of codes should also take into account specific types and underlying
technologies of AI systems (referred to as ‘AIH codes’, for horizontal AI system
codes). The AIH codes are new AI technology-specific codes and can be applied in
conjunction with AIP or AIB vertical codes. The AIH codes cover the underlying
types and technologies of AI systems. The list of codes, comprising three categories,
should provide for a multi-dimensional typology of AI systems which ensures that
conformity assessment bodies designated as notified bodies are fully competent in
regard to the AI systems they are required to assess.
(44) Regulation (EU) 2018/1139 of the European Parliament and the Council19 lays down
common rules in the field of civil aviation. Article 108 of Regulation (EU)
2024/1689 amends Regulation (EU) 2018/1139 to ensure that the Commission, when
adopting any relevant delegated or implementing acts pursuant to Regulation (EU)
2018/1139, takes into account, on the basis of the technical and regulatory
specificities of the civil aviation sector, and without interfering with existing
governance, conformity assessment and enforcement mechanisms and authorities
established therein, the mandatory requirements for high-risk AI systems laid down
in Regulation (EU) 2024/1689. A technical correction to amend additional Articles
of Regulation (EU) 2018/1139 is necessary to ensure that the mandatory
requirements for high-risk AI systems laid down in Regulation (EU) 2024/1689 are
fully covered when adopting relevant delegated or implementing acts pursuant to
Regulation (EU) 2018/1139.
19 Regulation (EU) 2018/1139 of the European Parliament and of the Council of 4 July
2018 on common rules in the field of civil aviation and establishing a European
Union Aviation Safety Agency, and amending Regulations (EC) No 2111/2005, (EC)
No 1008/2008, (EU) No 996/2010, (EU) No 376/2014 and Directives 2014/30/EU
and 2014/53/EU of the European Parliament and of the Council, and repealing
Regulations (EC) No 552/2004 and (EC) No 216/2008 of the European Parliament
and of the Council and Council Regulation (EEC) No 3922/91(OJ L 212, 22.8.2018,
p. 1, ELI: http://data.europa.eu/eli/reg/2018/1139/oj).
http://data.europa.eu/eli/reg/2018/1139/oj
▌
(45) In order to amend certain non-essential elements of Regulations (EU) 2024/1689
and (EU) 2023/1230, the power to adopt acts in accordance with Article 290 of the
Treaty on the Functioning of the European Union should be delegated to the
Commission in respect of:
- limiting the application of specific requirements or obligations laid
down in Regulation (EU) 2024/1689 where Union harmonisation
legislation listed in Section A of Annex I of that Regulation lays down
requirements providing for an equivalent level of protection,
- amending the list of codes, categories, and corresponding types of AI
systems in Annex XIV of Regulation (EU) 2024/1689, and
- amending Annex III of Regulation (EU) 2023/1230 to reflect the
relevant requirements of Regulation (EU) 2024/1689.
It is of particular importance that the Commission carry out appropriate
consultations during its preparatory work, including at expert level, and that those
consultations be conducted in accordance with the principles laid down in the
Interinstitutional Agreement of 13 April 2016 on Better Law-Making20. In
particular, to ensure equal participation in the preparation of delegated acts, the
European Parliament and the Council receive all documents at the same time as
Member States' experts, and their experts systematically have access to meetings of
Commission expert groups dealing with the preparation of delegated acts.
(46) In order to ensure legal certainty without delay, with a view to the imminent general
application of Regulation (EU) 2024/1689, this Regulation should enter into force as
a matter of urgency on the third day following that of its publication in the Official
Journal of the European Union.
(47) The European Data Protection Supervisor and the European Data Protection
Board were consulted in accordance with Article 42(1) and (2) of Regulation (EU)
2018/1725 and delivered their joint opinion on 20 January 2026,
HAVE ADOPTED THIS REGULATION:
20 OJ L 123, 12.5.2016, p. 1, ELI: http://data.europa.eu/eli/agree_interinstit/2016/512/oj.
http://data.europa.eu/eli/agree_interinstit/2016/512/oj
Article 1
Amendments to Regulation (EU) 2024/1689
Regulation (EU) 2024/1689 is amended as follows:
(1) in Article 1(2), point (g) is replaced by the following:
’(g) measures to support innovation, with a particular focus on small mid-
cap enterprises (SMCs) and small and medium-sized enterprises (SMEs),
including start-ups.’;
(2) ▌ Article 2 is amended as follows:
(a) paragraph 2 is replaced by the following:
‘2. For AI systems classified as high-risk AI systems in accordance with
Article 6(1) related to products covered by the Union harmonisation
legislation listed in Section B of Annex I, only Article 6(1), Article 60a
and Articles 102 to ▌ 112 shall apply. Articles 57, 58 and 59 shall apply
only in so far as the requirements for high-risk AI systems under this
Regulation have been integrated in that Union harmonisation
legislation.’;
(b) paragraph 7 is replaced by the following:
‘7. Union law on the protection of personal data, privacy and the
confidentiality of communications applies to personal data processed
in connection with the rights and obligations laid down in this
Regulation. Without prejudice to Articles 4a and 59 of this Regulation,
this Regulation shall not affect Regulation (EU) 2016/679 or (EU)
2018/1725, or Directive 2002/58/EC or (EU) 2016/680.’;
(3) in Article 2, the following paragraph is added:
‘13. For high-risk AI systems referred to in Article 6(1), the application of
specific requirements or obligations laid down in Articles 9 to 15 and 17 to
25 may be limited, where and to the extent that:
(a) Union harmonisation legislation listed in Section A of Annex I lays
down requirements or obligations providing an equivalent or higher
level of protection of health, safety or fundamental rights as the
requirement or obligation concerned; and
(b) such limitation does not reduce the overall level of protection provided
for by this Regulation.
By 2 August 2027, the Commission shall adopt delegated acts in accordance
with Article 97 in order to supplement this Regulation by specifying the high-
risk AI systems concerned, the requirements or obligations that may be
limited, the conditions under which such limitation applies, and the scope of
the limitation.’;
(4) Article 3 is amended as follows:
(a) point (14) is amended as follows:
‘(14) ‘safety component’ means a component of a product or of an AI system
which fulfils a safety function for that product or AI system, or the
failure or malfunctioning of which endangers the health and safety of
persons or property; for the purposes of this definition, a component
fulfils a safety function where its intended purpose is to prevent or
mitigate risks to health and safety of persons or property;’;
(b) the following points are inserted:
‘(14a) ‘micro, small and medium-sized enterprise’ or ‘SME’ means a micro,
small or medium-sized enterprise as defined in Article 2 of the Annex to
Recommendation 2003/361/EC;
(14b) ‘small mid-cap enterprise’ or ‘SMC’ means a small mid-cap enterprise as
defined in point (2) of the Annex to Recommendation (EU)
2025/1099;▌’;
(5) Article 4 is replaced by the following:
‘Article 4
AI literacy
1. ▌Providers and deployers of AI systems shall take measures to support the
development of AI literacy of their staff and other persons dealing with the
operation and use of AI systems on their behalf, taking into account their
technical knowledge, experience, ▌ education and training and the context the
AI systems are to be used in, and considering the persons or groups of persons
on whom the AI systems are to be used. This obligation does not require
providers or deployers to guarantee any specific level of AI literacy of any
individual.
▌
2. The Commission and the Member States shall support and facilitate the
efforts of providers and deployers of AI systems, in particular SMEs, in
fulfilling their obligation under paragraph 1 of this Article. For that purpose,
the Commission shall publish practical examples of how to comply with that
obligation on the single information platform referred to in Article 62(3),
point (b).
3. The Board shall adopt recommendations, taking into account European
competence frameworks, to support the Commission and Member States in
the promotion of AI literacy required under paragraph 1, including by
setting out common objectives.’;
(6) the following Article is inserted:
‘Article 4a
Processing of special categories of personal data for bias detection and correction
1. To the extent strictly necessary to ensure bias detection and correction in
relation to high-risk AI systems in accordance with Article 10(2), points (f) and
(g), of this Regulation, providers of such systems may exceptionally process
special categories of personal data, subject to appropriate safeguards for the
fundamental rights and freedoms of natural persons. In addition to the
provisions set out in Regulations (EU) 2016/679 and (EU) 2018/1725 and
Directive (EU) 2016/680, as applicable, all the following conditions shall be
met in order for such processing to occur:
(a) the bias detection and correction cannot be effectively fulfilled by
processing other data, including synthetic or anonymised data;
(b) the special categories of personal data are subject to technical limitations
on the re-use of personal data, and state-of-the-art security and privacy-
preserving measures, including pseudonymisation;
(c) the special categories of personal data are subject to measures to ensure
that the personal data processed are secured and protected, subject to
suitable safeguards, including strict controls and documentation of the
access, to avoid misuse and to ensure that only authorised persons have
access to those personal data with appropriate confidentiality obligations;
(d) the special categories of personal data are not transmitted, transferred or
otherwise accessed by other parties;
(e) the special categories of personal data are deleted once the bias has been
corrected or the personal data has reached the end of its retention period,
whichever comes first; and
(f) the records of processing activities pursuant to Regulations (EU)
2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680 include the
reasons why the processing of special categories of personal data was
strictly necessary to detect and correct biases, and why that objective
could not be achieved by processing other data.
2. ▌Providers and deployers of other AI systems and models and deployers of
high-risk AI systems may exceptionally process special categories of personal
data to the extent that:
(a) such processing is strictly necessary to ensure bias detection and
correction in view of possible biases that are likely to affect the health
and safety of persons, have a negative impact on fundamental rights or
lead to discrimination prohibited pursuant to Union law, especially
where data outputs influence inputs for future operations; and
(b) all of the conditions and safeguards set out in paragraph 1 are applied.
This paragraph does not create any obligation to conduct such bias detection
and correction.’;
▌
(7) Article 5 is amended as follows:
(a) in paragraph 1, the first subparagraph, the following points are inserted:
‘(ba) the placing on the market, the putting into service or the use of an AI
system that generates or manipulates realistic images, videos, audio or
similar material of an identifiable natural person’s intimate parts, or of
an identifiable natural person engaged in sexually explicit activities,
without that person’s freely-given, specific, informed, unambiguous
and explicit consent for that generation or manipulation;
(bb) the placing on the market, the putting into service or the use of an AI
system that generates or manipulates material or performance within
the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU,
except where a ‘without right’ defence applies under national law;’;
(b) the following paragraphs are inserted:
‘1a. For the purposes of paragraph 1, first subparagraph, points (ba) and
(bb):
(a) the placing on the market or putting into service of an AI system
that generates or manipulates the material or performance
referred to in paragraph 1, first subparagraph, point (ba) or (bb)
is only prohibited where:
(i) that generation or manipulation is the intended purpose of
the AI system; or
(ii) the system’s design, training, architecture, capabilities or
user-facing functionalities make that generation or
manipulation a reasonably foreseeable and reproducible
outcome, without requiring significant technical
modification, and the system does not have reasonable and
adequate technical safety measures and other safeguards to
reliably prevent that generation or manipulation, taking
into account reasonably foreseeable misuse, and to correct
observed or reported misuse;
(b) the use of an AI system that generates or manipulates the
material or performance referred to in paragraph 1, first
subparagraph, points (ba) and (bb) is only prohibited where the
deployer uses the system for the purpose of generating or
manipulating such material or performance.
1b. For the purposes of paragraph 1, first subparagraph, point (ba), an AI
system that manipulates material in a way that does not increase the
exposure of any depicted intimate parts or alter the nature of any
depicted sexually explicit activities shall not constitute manipulation.’;
(8) in Article 6, the following paragraphs are inserted:
‘1a. For the purposes of this Regulation, including paragraph 1 of this Article, AI
systems that are solely used for non-safety related aspects of user assistance,
performance optimisation, service efficiency, automation or convenience or
quality control shall not qualify as safety components.
1b. Notwithstanding paragraph 1a, AI systems the failure or malfunctioning of
which would endanger health and safety shall qualify as safety components.
1c. A product that is required to undergo a third-party conformity
assessment solely due to risks other than risks to health and safety , in
particular risks relating to the distribution of radio spectrum or
electromagnetic interference that do not affect health and safety, shall not be
considered as fulfilling the condition in paragraph 1, point (b).’;
(9) Article 10 is amended as follows:
(a) paragraph 1 is replaced by the following:
‘1. High-risk AI systems which make use of techniques involving the
training of AI models with data shall be developed on the basis of
training, validation and testing data sets that meet the quality criteria
referred to in paragraphs 2, 3 and 4 of this Article and in Article 4a(1)
whenever such data sets are used.’;
▌
(b) paragraph 5 is deleted;
(c) paragraph 6 is replaced by the following:
‘6. For the development of high-risk AI systems not using techniques
involving the training of AI models, paragraphs 2, 3 and 4 of this Article
and Article 4a(1) shall apply only to the testing data sets.’;
▌
(10) in Article 11(1), the second subparagraph is replaced by the following:
‘That technical documentation shall be drawn up in such a way as to demonstrate
that the high-risk AI system complies with the requirements set out in this Section
and to provide national competent authorities and notified bodies with the necessary
information in a clear and comprehensive form to assess the compliance of the AI
system with those requirements. It shall contain, at a minimum, the elements set out
in Annex IV. ▌ SMEs, including start-ups, and SMCs, may provide the elements of
the technical documentation specified in Annex IV in a simplified manner. To that
end, the Commission shall establish a simplified technical documentation form
targeted at the needs of ▌ SMEs, including start-ups, and SMCs. Where an ▌ SME,
including a start-up, or an SMC, opts to provide the information required in Annex
IV in a simplified manner, it shall use the form referred to in this paragraph. Notified
bodies shall accept the form for the purposes of the conformity assessment.’;
(11) in Article 17, paragraph 2 is replaced by the following:
‘2. The implementation of the aspects referred to in paragraph 1 shall be
proportionate to the size of the provider’s organisation, in particular, if the
provider is ▌ an SME, including a start-up, or an SMC. Providers shall, in any
event, respect the degree of rigour and the level of protection required to ensure
the compliance of their high-risk AI systems with this Regulation.’;
(12) Article 25 is amended as follows:
(a) paragraph 2 is replaced by the following:
‘2. Where the circumstances referred to in paragraph 1 occur, the provider
that initially placed the AI system on the market or put it into service
shall no longer be considered to be a provider of that specific AI system
for the purposes of this Regulation.
That initial provider shall closely cooperate with new providers and
shall make available the necessary information and provide the
reasonably expected technical access and other assistance that are
required for the fulfilment of the obligations set out in this Regulation,
in particular with regard to compliance with the conformity assessment
of high-risk AI systems.
In particular, the obligation laid down in the second subparagraph
shall include, where relevant for the purposes specified therein, the
following:
(a) making available of technical documentation sufficient to assess
compliance with the requirements laid down in Article 16;
(b) informing the new providers about known limitations and failure
modes; and
(c) providing the new providers with targeted technical access,
including for testing and validation.
This paragraph shall not apply in cases where the initial provider has
clearly specified that its AI system is not to be changed into a high-risk
AI system and therefore does not fall under the obligation to cooperate
with the new providers and hand over the documentation.’;
(b) in paragraph 4, the first subparagraph is replaced by the following:
‘4. The provider of a high-risk AI system and the third party that supplies
an AI system, AI model, tools, services, components, or processes that
are used or integrated in a high-risk AI system shall, by written
agreement, specify the necessary information, capabilities, technical
access and other assistance based on the generally acknowledged state
of the art, in order to enable the provider of the high-risk AI system to
fully comply with the obligations set out in this Regulation. This
paragraph shall not apply to third parties making accessible to the
public tools, services, processes, or components, other than general-
purpose AI models, under a free and open-source licence.’;
(13) Article 27 is amended as follows:
(a) paragraph 4 is replaced by the following:
‘4. If any of the obligations laid down in this Article is already met
through the data protection impact assessment conducted pursuant to
Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU)
2016/680, the deployer may, when conducting the fundamental rights
impact assessment referred to in paragraph 1 of this Article, include
cross-references to the relevant sections of that data protection impact
assessment or include relevant parts thereof in the fundamental rights
impact assessment.’;
(b) paragraph 5 is replaced by the following:
‘5. The AI Office shall develop a template for a questionnaire, including
through an automated tool, to facilitate deployers in complying with
their obligations under this Article in a simplified manner. This
template shall, where relevant, give deployers the possibility to include
cross-references to the relevant sections of the data protection impact
assessment or include relevant parts thereof in the fundamental rights
impact assessment pursuant to paragraph 4.’;
(14) in Article 28, ▌ the following paragraphs are added:
‘8. Notifying authorities designated pursuant to this Regulation that are
responsible for AI systems covered by the Union harmonisation legislation
listed in Section A of Annex I shall ensure that the conformity assessment
body that applies for designation both pursuant to this Regulation and the
Union harmonisation legislation listed in Section A of Annex I is provided with
the possibility to submit a single application and undergoes a unified
assessment procedure to be designated pursuant to this Regulation and Union
harmonisation legislation listed in Section A of Annex I, where the relevant
Union harmonisation legislation provides for such single application and
unified assessment procedure. To that end, notifying authorities designated
pursuant to this Regulation and those designated pursuant to the Union
harmonisation legislation listed in Section A of Annex I shall cooperate in
their assessments.
The single application and the unified assessment procedure referred to in this
paragraph shall also be made available to notified bodies already designated
pursuant to the Union harmonisation legislation listed in Section A of Annex I,
when those notified bodies apply for designation pursuant to this Regulation,
provided that the relevant Union harmonisation legislation provides for such a
procedure.
A conformity assessment body that is designated pursuant to more than one
piece of Union harmonisation legislation listed in Section A of Annex I shall
have to apply only once to be designated pursuant to this Regulation. A
designation pursuant to this Regulation shall be applicable for all Union
harmonisation legislation listed in Section A of Annex I for which the
conformity assessment body is designated.
The single application and the unified assessment procedure shall avoid any
unnecessary duplications, build on the existing procedures for designation in
accordance with the Union harmonisation legislation listed in Section A of
Annex I and ensure compliance with the requirements relating to notified
bodies both in accordance with this Regulation and the relevant Union
harmonisation legislation.
9. A notifying authority that has been designated pursuant to the Union
harmonisation legislation listed in Section A of Annex I is also the notifying
authority for the application of the single application and unified assessment
procedure referred to in paragraph 8, unless the Member State designates
another notifying authority for this Regulation.’;
(15) in Article 29, paragraph 4 is replaced by the following:
‘4. For notified bodies which are designated pursuant to any other Union
harmonisation legislation, all documents and certificates linked to those
designations may be used to support and expedite their designation procedure
under this Regulation, as appropriate.
Notified bodies, which are designated pursuant to any of the Union
harmonisation legislation listed in Section A of Annex I and which undergo the
unified assessment procedure referred to in Article 28(8), shall submit the
single application for assessment to the notifying authority designated pursuant
to that Union harmonisation legislation.
The notified body shall update the documentation referred to in paragraphs 2
and 3 of this Article whenever relevant changes occur, in order to enable the
authority responsible for notified bodies to monitor and verify continuous
compliance with all the requirements laid down in Article 31.’;
(16) in Article 30, paragraph 2 is replaced by the following:
‘2. Notifying authorities shall notify the Commission and the other Member
States, based on the list of codes, categories, and corresponding types of AI
systems referred to in Annex XIV, and using the electronic notification tool
developed and managed by the Commission, of each conformity assessment
body referred to in paragraph 1.
The Commission is empowered to adopt delegated acts in accordance with
Article 97 in order to amend Annex XIV, in light of technical progress,
advances in knowledge or new scientific evidence by adding to the list of
codes, categories, and corresponding types of AI systems a new code, a
category or a type of AI system, withdrawing an existing code, category or a
type of AI system from that list or moving a code or type of AI system from
one category to another.’;
(17) In Article 40(2), the following subparagraph is added:
‘The Commission shall request, in accordance with Regulation (EU)
No 1025/2012 of the European Parliament and of the Council21 and without
undue delay, the European standardisation organisations to
develop standardisation deliverables, including, as appropriate, harmonised
standards, to facilitate the joint compliance and presumption of conformity
with the requirements or obligations set out in Chapter III, Sections 2 and 3
of this Regulation, and the relevant requirements and obligations laid down
in the Union harmonisation legislation listed in Annex I to this Regulation.’;
(18) In Article 42, the following paragraph is added:
‘3. Where high-risk AI systems fall within the scope of Regulation (EU)
2024/2847 and the conditions laid down in Article 12(1) of that Regulation
are fulfilled, such systems shall be deemed to comply with the cybersecurity
requirements set out in Article 15 of this Regulation.’;
21 Regulation (EU) No 1025/2012 of the European Parliament and of the Council of
25 October 2012 on European standardisation, amending Council Directives
89/686/EEC and 93/15/EEC and Directives 94/9/EC, 94/25/EC, 95/16/EC,
97/23/EC, 98/34/EC, 2004/22/EC, 2007/23/EC, 2009/23/EC and 2009/105/EC of
the European Parliament and of the Council and repealing Council Decision
87/95/EEC and Decision No 1673/2006/EC of the European Parliament and of the
Council (OJ L 316, 14.11.2012, p. 12,
ELI: http://data.europa.eu/eli/reg/2012/1025/oj).
http://data.europa.eu/eli/reg/2012/1025/oj
(19) in Article 43, paragraph 3 is replaced by the following:
‘3. For high-risk AI systems covered by the Union harmonisation legislation listed
in Section A of Annex I, the provider of the system shall follow the relevant
conformity assessment procedure as required in accordance with the relevant
Union harmonisation legislation. The requirements set out in Section 2 of this
Chapter shall apply to those high-risk AI systems and shall be part of that
assessment. Assessment of the quality management system set out in Article 17
▌ shall also be undertaken, and points 3, 4.3, 4.4. and 4.5, the fifth
paragraph of point 4.6 and point 5 of Annex VII shall apply.
For the purposes of that conformity assessment, notified bodies which have
been notified under the Union harmonisation legislation listed in Section A of
Annex I shall have the power to assess the conformity of high-risk AI systems
with the requirements set out in Section 2 of this Chapter, provided that the
compliance of those notified bodies with the requirements laid down in Article
31(4), (5), (10) and (11) has been assessed in the context of the notification
procedure in accordance with the relevant Union harmonisation legislation,
which is evidenced through the assessment as part of the existing
notification. Without prejudice to Article 28, such notified bodies which have
been notified under the Union harmonisation legislation in Section A of Annex
I, shall apply for designation in accordance with Section 4 of this Chapter by
… [18 months from the entry into force of this amending Regulation].
Where Union harmonisation legislation listed in Section A of Annex I provides
the product manufacturer with an option to rely on a conformity assessment
that does not involve a third-party, provided that that manufacturer has applied
harmonised standards to ensure compliance with all the relevant requirements,
that manufacturer may use that option only if it has also applied harmonised
standards or, where applicable, common specifications referred to in Article
41, covering all requirements set out in Section 2 of this Chapter. The
classification of a product as a high-risk AI system in accordance with
Article 6(1) does not affect the choice of the conformity assessment
procedure provided to the manufacturers of products covered by Union
harmonisation legislation listed in Section A of Annex I, including, where
applicable, an option to rely on harmonised standards. The manufacturers of
such products are not required to choose a conformity assessment procedure
involving third-party conformity assessment only because the product
includes a high-risk AI system as a safety component, if this is not required
by the Union harmonisation legislation listed in Section A of Annex I.
▌ Where a high-risk AI system is both covered by the Union harmonisation
legislation listed in Section A of Annex I and it falls within one of the
categories listed in Annex III, the provider of that system shall follow the
relevant conformity assessment procedure as required pursuant to the relevant
Union harmonisation legislation listed in Section A of Annex I.’;
▌
(20) in Article 50, paragraph 7 is replaced by the following:
‘7. The Commission shall encourage and facilitate the drawing up of codes of
practice at Union level to facilitate the effective implementation of the
obligations regarding the detection, marking and labelling of artificially
generated or manipulated content. The Commission, taking utmost account of
the opinion of the Board, shall assess whether adherence to those codes of
practice is adequate to ensure compliance with the obligations laid down in
paragraphs 2 and 4 of this Article, in accordance with the procedure laid down
in Article 56(6) ▌. If it deems the code of practice to be inadequate, the
Commission may adopt an implementing act specifying common rules for the
implementation of those obligations in accordance with the examination
procedure laid down in Article 98(2).’;
(21) in Article 56, paragraph 6 is replaced by the following:
‘6. The Commission and the Board shall regularly monitor and evaluate the
achievement of the objectives of the codes of practice by the participants and
their contribution to the proper application of this Regulation. The
Commission, taking utmost account of the opinion of the Board, shall assess
whether the codes of practice cover the obligations provided for in Articles 53
and 55, and shall regularly monitor and evaluate the achievement of their
objectives. The Commission shall publish its assessment of the adequacy of the
codes of practice ▌.’;
(22) Article 57 is amended as follows:
(a) in paragraph 1, the first subparagraph is replaced by the following:
‘1. Member States shall ensure that their competent authorities establish
at least one AI regulatory sandbox at national level, which shall be
operational by 2 August 2027. That sandbox may also be established
jointly with the competent authorities of other Member States. The
Commission may provide technical support, advice and tools for the
establishment and operation of AI regulatory sandboxes.’;
(b) paragraph 3 is replaced by the following:
‘3. The European Data Protection Supervisor may establish an AI
regulatory sandbox for Union institutions, bodies, offices and agencies.
For this purpose, references to national competent authorities in this
Chapter shall be construed as references to the European Data
Protection Supervisor.’;
(c) the following paragraph is inserted:
‘3a. The AI Office may establish an AI regulatory sandbox at Union level for
AI systems covered by Article 75(1). For this purpose, references to
national competent authorities in this Chapter shall be construed,
where relevant, as references to the AI Office. That AI regulatory
sandbox shall be implemented in close cooperation with relevant
competent authorities, in particular where compliance with Union
legislation other than this Regulation is supervised in the AI regulatory
sandbox, and shall provide priority access to SMEs, including start-ups,
and SMCs. ▌
The establishment of a Union level AI regulatory sandbox by the AI
Office shall be without prejudice to the competences of Member States
to establish and supervise AI regulatory sandboxes for AI systems
under their supervision.’;
(d) paragraph 5 is replaced by the following:
‘5. AI regulatory sandboxes established under this Article shall provide for a
controlled environment that fosters innovation and facilitates the
development, training, testing and validation of innovative AI systems
for a limited time before their being placed on the market or put into
service pursuant to a specific sandbox plan agreed between the providers
or prospective providers and the competent authorities, ensuring that
appropriate safeguards are in place. Such sandboxes may include testing
in real world conditions supervised therein. Where applicable, the
sandbox plan shall incorporate the real-world testing plan referred to in
Articles 60 and 60a.’;
(e) in paragraph 9, point (e) is replaced by the following:
‘(e) facilitating and accelerating access to the Union market for AI systems,
in particular when provided by ▌ SMEs, including start-ups, and
SMCs.’;
(f) paragraph 10 is replaced by the following:
‘10. National competent authorities shall ensure that, to the extent the
innovative AI systems involve the processing of personal data or
otherwise fall under the supervisory remit of other national authorities
or competent authorities providing or supporting access to data, the
competent data protection authorities and those other national or
competent authorities are associated with the operation of the AI
regulatory sandbox and involved in the supervision of those aspects to
the extent of their respective tasks and powers.’;
(g) paragraph 14 is replaced by the following:
’14. National competent authorities, the European Data Protection
Supervisor and the AI Office, shall, as appropriate and within their
respective competences, coordinate their activities and cooperate within
the framework of the Board. They may support the joint establishment
and operation of AI regulatory sandboxes, including in different sectors,
and exchange best practices on related matters.’;
(23) in Article 58(1), the first subparagraph is amended as follows:
(a) the introductory part is replaced by the following:
‘1. In order to avoid fragmentation across the Union, the Commission shall
adopt implementing acts specifying the detailed arrangements for the
establishment, development, implementation, operation, governance, and
supervision of the AI regulatory sandboxes. Those implementing acts
shall include common principles on the following issues:’;
(b) the following point is added:
‘(d) the detailed rules applicable to the governance of AI regulatory
sandboxes covered pursuant to Article 57, including as regards the
involvement of and supervision by the competent data protection
authorities, where relevant, and the coordination and cooperation at
national and Union level.’;
(24) Article 60 is amended as follows:
(a) in paragraph 1, the first subparagraph is replaced by the following:
‘1. Testing of high-risk AI systems in real world conditions outside AI
regulatory sandboxes may be conducted by providers or prospective
providers of high-risk AI systems listed in Annex III or covered by
Union harmonisation legislation listed in Section A of Annex I, in
accordance with this Article and the real-world testing plan referred to in
this Article, without prejudice to the prohibitions under Article 5.’;
(b) paragraph 2 is replaced by the following:
‘2. Providers or prospective providers may conduct testing of high-risk AI
systems referred to in Annex III or covered by Union harmonisation
legislation listed in Section A of Annex I in real world conditions at any
time before the placing on the market or the putting into service of the
high-risk AI system on their own or in partnership with one or more
deployers or prospective deployers.’;
(25) the following Article is inserted:
‘Article 60a
Testing of high-risk AI systems covered by Union harmonisation legislation listed in
Section B of Annex I in real-world conditions outside AI regulatory sandboxes
1. Member States may allow, in accordance with this Article, the testing of high-
risk AI systems in real world conditions outside AI regulatory sandboxes ▌ by
providers or prospective providers of AI enabled products covered by the
Union harmonisation legislation listed in Section B of Annex I, with a view to
assessing and verifying the conformity of those systems with the
requirements laid down in Articles 8 to 15.
▌
2. Member States that choose to allow testing as referred to in paragraph 1
shall, individually or jointly, adopt frameworks for real-world testing.
3. Each Member State shall notify the Commission of any real-world testing
framework it adopts before implementing it. This shall not affect the
competences of the Commission under the Union harmonisation legislation
listed in Section B of Annex I.
4. Member States that have adopted real-world testing frameworks shall ensure
that the relevant national competent authorities, relevant authorities and
public authorities responsible for the management and operation of
infrastructure and products covered by Union harmonisation legislation listed
in Section B of Annex I ▌ cooperate closely with each other in good faith and
▌ remove any practical obstacles, including on procedural rules providing
access to physical public infrastructure, where this is necessary, to successfully
implement those real-world testing frameworks and test AI-enabled products
covered by Union harmonisation legislation listed in Section B of Annex I.
5. The frameworks for real-world testing ▌ shall lay down the requirements
under which testing in real-world conditions shall occur. Those frameworks
shall:
(a) include the provision of a mandatory real-world testing plan to be
agreed between the provider or prospective provider and the national
competent authority or relevant authority in accordance with the Union
harmonisation legislation listed in Section B of Annex I;
(b) ensure compliance with the requirements laid down in Article 60(2),
(3), (4)(d)-(j) and (5)-(9), where any reference to market surveillance
authorities in those provisions shall be read as a reference to the
national competent authority or relevant authority, as appropriate in
accordance with the Union harmonisation legislation listed in Section
B of Annex I;
(c) include effective governance and accountability arrangements;
(d) ensure a high level of protection of health safety and fundamental
rights.
6. The real-world testing shall comply with the applicable provisions laid down
in the Union harmonisation legislation listed in Section B of Annex I. Any
requirements laid down in those provisions shall not affect the application of
this Article to the extent necessary to enable the testing referred to in
paragraph 1.
▌ ’
(26) in Article 63, paragraph 1 is replaced by the following:
‘1. SMEs, including start-ups, may comply with certain elements of the quality
management system required by Article 17 in a simplified manner, provided
that they do not have partner enterprises or linked enterprises within the
meaning of Recommendation 2003/361/EC. For that purpose, the Commission
shall develop guidelines on the elements of the quality management system
which may be complied with in a simplified manner considering the needs of
SMEs, without affecting the level of protection or the need for compliance with
the requirements in respect of high-risk AI systems.’;
(27) In Article 64, the following paragraph is added:
‘3. Without prejudice to the budgetary procedure, the AI Office shall be
allocated adequate resources to effectively perform its duties and exercise its
powers in relation to the enforcement of this Regulation.’;
(28) In Article 69, paragraph 2 is replaced by the following:
‘2. The Member States may be required to pay fees for the advice and support
provided by the experts at a rate equivalent to the remuneration fees applicable
to the Commission pursuant to the implementing act referred to in Article
68(1).’;
▌
(29) in Article 70, paragraph 8 is replaced by the following:
‘8. National competent authorities may provide guidance and advice on the
implementation of this Regulation, in particular to ▌ SMEs, including start-
ups, and SMCs, taking into account the guidance and advice of the Board and
the Commission, as appropriate. Whenever national competent authorities
intend to provide guidance and advice with regard to an AI system in areas
covered by other Union law, the national competent authorities under that
Union law shall be consulted, as appropriate.’;
(30) in Article 72, paragraph 3 is replaced by the following:
‘3. The post-market monitoring system shall be based on a post-market monitoring
plan. The post-market monitoring plan shall be part of the technical
documentation referred to in Annex IV. The Commission, taking utmost
account of the opinion of the Board, shall adopt guidance, including a
template, on the post-market monitoring plan by 2 September 2027.’;
(31) Article 75 is amended as follows:
(a) the heading is replaced by the following:
‘Market surveillance and control of AI systems and mutual assistance’;
(b) paragraph 1 is replaced by the following:
‘1. The AI Office shall ▌ be exclusively competent for the supervision and
enforcement of the obligations under this Regulation in relation to the
following AI systems:
(a) AI systems based on general-purpose AI models where the model
and the system are developed by the same provider, or by
providers forming part of the same undertaking as that provider,
with the exception of:
(i) AI systems related to products covered by the Union
harmonisation legislation listed in Annex I;
(ii) AI systems referred to in point 2 of Annex III;
(iii) AI systems provided by law enforcement authorities, border
management authorities and financial institutions, insofar
as those AI systems fall under Article 74(6); and
(iv) AI systems referred to in point 8 of Annex III as regards the
administration of justice;
(b) AI systems that constitute or that are integrated into a very large
online platform or very large online search engine designated in
accordance with Regulation (EU) 2022/2065.
The exclusive competence referred to in the first subparagraph shall apply to
the providers of those systems. It shall apply to the deployers of those systems only
when they are also the provider or form part of the same undertaking as the
provider.’;
(c) the following paragraphs are inserted:
‘1a. By way of derogation from Article 73, providers of high-risk AI
systems subject to the competence of the AI Office pursuant to
paragraph 1 of this Article shall report any serious incidents to
the AI Office. Article 73 (2) to (9), shall apply mutatis mutandis.
The AI Office shall promptly transmit the relevant information to
the market surveillance authority of the Member State in the
territory of which the provider or its legal representative is
situated.
1b. The authorities involved in the application of this Regulation shall
cooperate actively with the AI Office and provide the AI Office
the necessary assistance for the exercise of its powers, including,
where necessary, in connection with inspections or other
enforcement measures carried out in the territory of a Member
State. To that end, those authorities shall enjoy the powers
provided for pursuant to this Regulation and Regulation (EU)
2019/1020, and where relevant and limited to what is necessary to
fulfil their tasks under this paragraph, in accordance with the
applicable national procedures.
1c. When taking investigatory or enforcement action in the territory
of a Member State that involves access to a public authority’s
data or AI system, the AI Office shall be assisted by the relevant
market surveillance authority.
1d. Before taking a decision that would have the effect of prohibiting
or restricting the AI system being made available or put into
service on a national market, or a decision to withdraw or recall
the AI system from such market, the AI Office shall, without
undue delay, notify the market surveillance authority competent
for that market of its intention to take such a decision. The AI
Office shall consult the authorities involved in the application of
this Regulation, where appropriate, on any matter relating to the
application and enforcement of this Regulation.
1e. The AI Office shall be responsible for conformity assessments
and tests of AI systems referred to in paragraph 1 of this Article
that are classified as high-risk and subject to a third-party
conformity assessment pursuant to Article 43 before such AI
systems are placed on the market or put into service. Those tests
and assessments shall verify that the systems comply with the
relevant requirements of this Regulation and may be placed on
the market or put into service in the Union in accordance with
this Regulation. The Commission shall entrust the performance
of those tests or assessments to notified bodies designated in
accordance with this Regulation, in which case the notified body
shall act on behalf of the Commission. If a notified body to which
the Commission has delegated tasks under this paragraph does
not perform those tasks adequately, the Commission may
withdraw the delegation with immediate effect.
The fees for testing and assessment activities shall be levied on the
provider of a high-risk AI system who has applied for a third-party
conformity assessment to the Commission. The provider shall pay
the costs related to the services entrusted by the Commission to the
notified bodies in accordance with this Article directly to the
notified body.’;
(d) the following paragraph is inserted:
2a. Where a market surveillance authority has well-founded and sufficient
reasons to suspect that a provider or a deployer of an AI system
referred to in paragraph 1 of this Article has infringed this Regulation,
it may request, through the relevant single point of contact designated
in accordance with Article 70(2), the AI Office to assess the matter in
order to take the necessary supervisory and enforcement measures to
ensure prompt compliance with this Regulation. Such a request shall
be duly reasoned and shall include at least:
(a) the name of the provider or the deployer concerned;
(b) a description of the relevant facts, the provisions of this
Regulation that have allegedly been infringed, and any
well-founded and sufficient reasons for suspecting an
infringement, including, where applicable, the description
of the negative effects of the alleged infringement;
(c) the market surveillance authority making the request.
The AI Office shall take utmost account of the request and the market
surveillance authority shall cooperate actively and provide the AI Office the
necessary assistance for the exercise of its powers in accordance with
paragraph 1a.
The AI Office shall, without undue delay and in any event no later
than four months following receipt of the request, inform the single point of
contact of its intention to exercise its powers in accordance with Article 75a
or of its reasons for not exercising its powers. If the AI Office decides to
exercise its powers in accordance with Article 75a, it shall periodically
inform that single point of contact about major developments in the
proceedings and the outcome of such proceedings, without disclosing any
confidential information.’;
(32) the following articles are inserted:
‘Article 75a
Supervisory and enforcement powers of the AI Office
1. When exercising its tasks of supervision and enforcement laid down in
Article 75(1) of this Regulation, the AI Office shall have all the powers of a
market surveillance authority provided for in this Section and in Article
14(4) and Article 16(3) of Regulation (EU) 2019/1020. The AI Office shall be
authorised to fully reclaim from the relevant operator the totality of the costs
of its supervision and enforcement activities with respect to instances of non-
compliance, including costs for human and technical resources, in
accordance with Article 15 of Regulation (EU) 2019/1020. Article 17 of
Regulation (EU) 2019/1020 shall apply mutatis mutandis.
2. Where the AI Office has reasonable grounds to suspect non-compliance with
this Regulation by a provider or a deployer of an AI system referred to in
Article 75(1) of this Regulation, it may adopt a decision to start an
investigation into that non-compliance in accordance with Article 14(4),
point (f) of Regulation (EU) 2019/1020. Upon starting such an investigation,
the AI Office shall notify the operator of the AI system concerned. The AI
Office may exercise the powers referred to in paragraph 1 of this Article on
its own initiative or following a complaint received pursuant to Article 85 of
this Regulation, even before starting an investigation pursuant to Article
14(4), point (f) of Regulation (EU) 2019/1020.
Where a market surveillance authority has reason to suspect non-compliance
with this Regulation by a provider or a deployer of an AI system referred to
in Article 75(1), it may send a request to the AI Office to assess the matter.
3. The AI Office may exercise the powers listed in Article 14(4), points (a), (b)
and (c) of Regulation (EU) 2019/1020 and Article 74(12) and (13) of this
Regulation by simple request or by decision.
When requesting information, the AI Office shall state the legal basis and
the purpose of the request, specify what information is required, and set the
period within which the information is to be provided. Where the request is a
simple request, the AI Office shall additionally indicate that although there is
no obligation to provide the information requested, in the case of a voluntary
reply, the information must be correct and not misleading, and indicate the
potential fines provided for in Article 99(5) for supplying incorrect or
misleading information. Where the request is made by decision, the AI Office
shall additionally indicate the fines provided for in Article 99(5) for
supplying incorrect, incomplete or misleading information and indicate the
right to have the decision reviewed by the Court of Justice of
the European Union. The AI Office shall send a copy of the request to the
market surveillance authority of the Member State in the territory of which
the operator or its legal representative is situated.
4. In order to carry out the tasks assigned to it under this Section, the AI Office
may conduct all necessary remote or on-site inspections pursuant to the
powers laid down in Article 14(4), points (d) and (e) of Regulation (EU)
2019/1020 and Article 74(5) of this Regulation. When conducting an
inspection, the AI Office shall inform the provider concerned of the subject
matter and purpose of the investigation, the relevant fines referred to in
Article 99(5) of this Regulation, and the right to have the decision reviewed
by the Court of Justice of the European Union. Prior to conducting an
inspection, the AI Office shall inform the market surveillance authority of
the Member State in the territory of which the operator or its legal
representative is situated.
During such an inspection, the officials of the AI Office shall be empowered
to:
(a) enter any of the business premises, land or property located in the
Union of the operator concerned;
(b) examine the books, data and other material relevant to the execution of
their tasks, irrespective of the medium on which they are stored;
(c) take or obtain in any form copies of or extracts from books, data and
other records;
(d) ask any of the persons subject to the inspection, or their
representatives, or staff, for oral or written explanations on factors or
documents relating to the subject matter and purpose of the inspection,
and to record the answers;
(e) seal any business premises and books or records for the duration of,
and to the extent necessary for, the inspection.
Where the AI Office finds that a natural or legal person opposes or obstructs
an inspection, the national competent authority of the Member State
concerned shall afford it the necessary assistance, requesting, where
appropriate, the assistance of the police or an equivalent enforcement
authority, to enable it to conduct its on-site inspection.
Where an on-site inspection of business premises, land or property requires
authorisation by a judicial authority in accordance with national law, the AI
Office shall apply for such an authorisation. The AI Office may also apply
for such authorisation as a precautionary measure. Where such an
authorisation is applied for, the national judicial authority shall promptly
verify that the coercive measures envisaged are neither arbitrary nor
excessive having regard to the subject matter of the investigation or
inspection and the documents provided by the AI Office with the decision. In
its verification of the proportionality of coercive measures, the national
judicial authority may ask the AI Office for detailed explanations, in
particular relating to the grounds the AI Office has for suspecting that an
infringement of this Regulation has taken place and the seriousness of the
suspected infringement and, where relevant, the nature of the involvement of
the person subject to the coercive measures. The national judicial authority
shall not review the necessity of the investigation or inspection nor demand
information from the case file of the AI Office. In accordance with the
Treaties, the legality of the decision of the AI Office is subject to review only
by the Court of Justice of the European Union.
5. At the request of the AI Office, the competent market surveillance authority
of a Member State may in its own territory carry out any investigation,
inspection or other fact-finding measure on behalf and for the account of the
AI Office in order to establish whether there has been an infringement of
this Regulation. The officials of the competent authorities of the Member
States who are responsible for conducting such investigations, inspections, or
fact-finding measures, as well as those authorised or appointed by them,
shall exercise their powers in accordance with their national law.
6. In addition to the powers set out in paragraph 1 of this Article, the AI Office,
in the exercise of its competences referred to in Article 75(1), may:
(a) order operators to provide access to, and explanations relating to, their
AI systems;
(b) impose an obligation on an operator to retain all data and documents
deemed to be necessary to assess the implementation of and compliance
with the obligations under this Regulation.
7. To assist it in monitoring the effective implementation and compliance with
the relevant provisions of this Regulation and to provide it with specific
expertise or knowledge in the exercise of its competences under Article 75(1),
the AI Office may appoint independent external experts and auditors, as well
as experts, investigative teams and auditors from the Member State’s
competent authorities with the agreement of the authority concerned,.
Information obtained as a result of such monitoring actions shall be shared
with the relevant competent authorities of the Member States.
8. Information collected pursuant to this Article shall be used only for the
purpose of this Regulation.
Article 75b
Commitments
If, during proceedings under Article 75a(2), the operator concerned offers
commitments to ensure compliance with the relevant provisions of this Regulation,
the AI Office may, by decision, make those commitments binding on the operator
concerned and declare that there are no further grounds for action. The AI Office
may, upon request or on its own initiative, reopen the proceedings where:
(a) there has been a material change in any of the facts on which the decision
was based;
(b) the operator acts contrary to its commitments; or
(c) the decision was based on incomplete, incorrect or misleading information
provided by the operator concerned.
Where the AI Office considers that the commitments offered by the operator
concerned are unable to ensure effective compliance with the relevant provisions
of this Regulation, it shall reject those commitments in a reasoned decision when
concluding the proceedings.
Article 75c
Non-compliance, fines and periodic penalty payments
1. Where the AI Office finds that an operator falling within the scope of Article
75(1) does not comply with the relevant provisions of this Regulation or with
commitments made binding pursuant to Article 75b, it shall adopt a decision
establishing such non-compliance.
2. Before adopting a decision pursuant to paragraph 1, the AI Office shall
communicate its preliminary findings to the operator concerned. In the
preliminary findings, the AI Office shall explain the measures that it is
considering taking, or that it considers that the operator concerned should
take, in order to effectively address the preliminary findings.
3. In the decision pursuant to paragraph 1 of this Article, the AI Office shall,
where relevant, order the operator concerned to take the necessary measures
to ensure compliance with the relevant provisions of this Regulation within a
reasonable period specified therein and to provide information on the
measures that that operator intends to take to comply with the decision. The
operator concerned shall provide the AI Office with a description of the
measures it has taken to ensure compliance with the decision upon their
implementation. Prior to requesting any measure, the AI Office may engage
in a structured dialogue with the operator of the AI system in question.
During this dialogue, the operator may propose commitments in accordance
with Article 75b.
4. A decision adopted pursuant to paragraph 1 of this Article may be
accompanied by the imposition of penalties in accordance with Article 99(3)
to (7), which provisions shall apply mutatis mutandis to the AI Office in the
execution of its supervision and enforcement tasks referred to in Article
75(1).
In particular, the following shall be subject to administrative fines as
referred to in Article 99(4):
(a) infringement of any applicable provision of this Regulation, including
those not listed in Article 99(4);
(b) failure to comply with decisions or measures adopted pursuant to the
powers listed in Article 14(4) or Article 16(3) of Regulation (EU)
2019/1020, as well as those specified in Article 75a of this Regulation;
(c) failure to comply with a commitment made binding by a decision
pursuant to Article 75b.
The supply of incorrect, incomplete or misleading information to the
AI Office in reply to a request shall be subject to administrative fines as
referred to in Article 99(5).
5. The AI Office may adopt a decision imposing periodic penalty payments to
compel the operators subject to its competence pursuant to Article 75(1) to
the following:
(a) to submit to an investigation;
(b) to comply with an information request ordered by a decision adopted
under Article 75a(3);
(c) to submit to an inspection ordered by a decision pursuant to Article
75a(4);
(d) to provide correct or complete answers or explanations in the context of
an inspection ordered by a decision pursuant to Article 75a(4);
(e) to comply with corrective actions ordered pursuant to the power listed
in Article 16 of Regulation (EU) 2019/1020;
(f) to comply with commitments made legally binding by a decision
pursuant to Article 75b; or
(g) to comply with a decision pursuant to the paragraph (1) of this Article.
Those penalty payments shall be effective and proportionate, and,
where applicable, shall not exceed 5% of the average daily income or
worldwide annual turnover in the preceding financial year per day,
calculated from the date appointed by the decision.
6. The Court of Justice of the European Union shall have unlimited
jurisdiction to review decisions of the AI Office fixing a fine or periodic
penalty payment pursuant to this Article. It may cancel, reduce or increase
the fine or periodic penalty payment imposed.
7. Funds collected through the imposition of fines or periodic penalty payments
pursuant to this Article shall contribute to the general budget of the Union.
8. The powers conferred on the AI Office by this Article shall be subject to a
limitation period of five years. The limitation period shall begin to run on the
day on which the infringement is committed. However, in the case of
continuing or repeated infringements, the limitation period shall begin to run
on the day on which the infringement ceases.
The power of the AI Office to enforce decisions taken pursuant to this Article
shall be subject to a limitation period of five years. The limitation period
shall begin to run on the day on which the decision becomes final.
The implementing act referred to in Article 75d(3) shall specify the first and
second subparagraphs of this paragraph, including the circumstances in
which the limitation periods shall be interrupted.
9. Where the AI Office determines that there are no grounds to adopt a decision
of non-compliance, it shall close the proceeding by a decision. That decision
shall apply with immediate effect.
Article 75d
Safeguards and further specification
1. Article 18 of Regulation (EU) 2019/1020 shall apply mutatis mutandis to
operators subject to the AI Office’s competence pursuant to Article 75(1) of
this Regulation, without prejudice to more specific procedural rights
provided for in this Regulation.
2. The rights of defence and of access to the file of operators falling within the
scope of Article 75(1) shall be fully respected in proceedings. In view of the
possible adoption of decisions on the basis of Article 75c(1), those operators
shall be entitled to have access to the AI Office file under the terms of a
negotiated disclosure, subject to the legitimate interest of the operator or
other person concerned in the protection of their business secrets. The AI
Office shall have the power to adopt decisions setting out such terms of
disclosure in the case of disagreement between the parties. The right of
access to the file shall not extend to confidential information and internal
documents of the AI Office, the Board, competent market surveillance
authorities or other public authorities of the Member States. In particular,
the right of access shall not extend to correspondence between the AI Office
and those authorities. Nothing in this paragraph shall prevent the AI Office
from disclosing and using information necessary to prove an infringement.
3. The Commission may adopt implementing acts concerning the practical
arrangements for access to the file and the negotiated disclosure of
information provided for in paragraph 2.
4. The AI Office shall publish the decisions it adopts pursuant to Articles 75b
and 75c. Such publication shall state the names of the parties and the main
content of the decision, including any penalties imposed. The publication
shall have regard to the rights and legitimate interests of any person
concerned in the protection of their confidential information.’;
(33) in Article 76(1), the following subparagraph is added:
‘Where testing in real world conditions is based on Article 60a, any reference to a
market surveillance authority in this Article shall be construed as a reference to
the national competent authority or appropriate authority under the Union
harmonisation legislation listed in Section B of Annex I, and references to Article
60 shall be construed as references to Article 60a, as appropriate.’;
(34) Article 77 is amended as follows:
▌
(a) the heading is replaced by the following:
‘Powers of authorities protecting fundamental rights and cooperation with
market surveillance authorities’;
(b) paragraph 1 is replaced by the following:
‘1. National public authorities or bodies which supervise or enforce the
respect of obligations under Union law protecting fundamental rights,
including the right to non-discrimination, shall have the power to request
and access any information or documentation created or maintained from
the relevant market surveillance authority pursuant to this Regulation in
accessible language and machine-readable format by electronic means
where access to that information or documentation is necessary for
effectively fulfilling their mandates within the limits of their jurisdiction.
This Article is without prejudice to the competences, tasks, powers and
independence of the relevant national public authorities or bodies
under their mandates.’;
(c) the following paragraphs are inserted:
‘1a. Subject to the conditions specified in this Article, the market surveillance
authority shall grant the relevant public authority or body referred to in
paragraph 1 access to such information or documentation, including by
requesting such information or documentation from the provider or the
deployer, where necessary and without undue delay.
1b. Market surveillance authorities and public authorities or bodies referred
to in paragraph 1 shall cooperate closely and provide each other with the
mutual assistance necessary to fulfil their respective mandates, with a
view to ensuring the coherent application of this Regulation and Union
law protecting fundamental rights and streamlining procedures, while
respecting their respective competences, tasks, powers and
independence. This shall include, in particular, exchange of information
where necessary for the effective supervision or enforcement of this
Regulation and the respective other Union legislation.
▌ ’;
(35) in Article 95, paragraph 4 is replaced by the following:
‘4. The AI Office and the Member States shall take into account the specific
interests and needs of ▌ SMEs, including start-ups, and SMCs, when
encouraging and facilitating the drawing up of codes of conduct.’;
(36) in Article 96, paragraph 1 is amended as follows:
(a) in the first subparagraph, point (a) is replaced by the following:
‘(a) the application of the requirements and obligations referred to in
Articles 8 to 15 and in Articles 25 and 26;’;
(b) in the first subparagraph, the following point is added:
‘(g) the practical implementation of Article 8(2), Article 9(10) and Article
17(3) in accordance with the principle of complementarity and
proportionality, with a view to ensuring consistency, avoiding
duplication and minimising additional burdens when complying with
the requirements of this Regulation and the requirements of the Union
harmonisation legislation listed in Section A of Annex I; such
guidelines shall be published by 1 August 2027.’;
(c) the second subparagraph is replaced by the following:
‘When issuing such guidelines, the Commission shall involve the Board and
pay particular attention to the needs of ▌ SMEs, including start-ups, and
SMCs, of local public authorities and of the sectors most likely to be affected
by this Regulation.’;
(37) Article 97 is amended as follows:
(a) paragraphs 2 and 3 are replaced by the following:
‘2. The power to adopt delegated acts referred to in Article 6(6) and (7),
Article 7(1) and (3), Article 11(3), Article 43(5) and (6), Article 47(5),
Article 51(3), Article 52(4) and Article 53(5) and (6) shall be
conferred on the Commission for a period of five years from 1 August
2024. The power to adopt delegated acts referred to in Article 2(13)
and Article 30(2) shall be conferred on the Commission for a period
of five years from … [the date of entry into force of this amending
Regulation]. The Commission shall draw up a report in respect of the
delegation of power not later than nine months before the end of the
five-year period. The delegation of power shall be tacitly extended for
periods of an identical duration, unless the European Parliament or
the Council opposes such extension no later than three months before
the end of each period.
3. The delegation of power referred to in Article 2(13), Article 6(6) and
(7), Article 7(1) and (3), Article 11(3), Article 30(2), Article 43(5) and
(6), Article 47(5), Article 51(3), Article 52(4) and Article 53(5) and (6)
may be revoked at any time by the European Parliament or by the
Council. A decision of revocation shall put an end to the delegation
of power specified in that decision. It shall take effect the day
following that of its publication in the Official Journal of the
European Union or at a later date specified therein. It shall not affect
the validity of any delegated acts already in force.’;
(b) paragraph 6 is replaced by the following:
‘6. Any delegated act adopted pursuant to Article 2(13), Article 6(6) or
(7), Article 7(1) or (3), Article 11(3), Article 30(2), Article 43(5) or
(6), Article 47(5), Article 51(3), Article 52(4) or Article 53(5) or (6)
shall enter into force only if no objection has been expressed by either
the European Parliament or the Council within a period of three
months of notification of that act to the European Parliament and the
Council or if, before the expiry of that period, the European
Parliament and the Council have both informed the Commission that
they will not object. That period shall be extended by three months at
the initiative of the European Parliament or of the Council.’;
(38) Article 99 is amended as follows:
▌
(a) paragraph 1 is replaced by the following:
‘1. In accordance with the terms and conditions laid down in this Regulation,
Member States shall lay down the rules on penalties and other
enforcement measures, which may also include administrative fines,
warnings and non-monetary measures, applicable to any infringement of
this Regulation by operators, and shall take all measures necessary to
ensure that they are properly and effectively implemented, thereby taking
into account the guidelines issued by the Commission pursuant to Article
96. The penalties provided for shall be effective, proportionate and
dissuasive. The Member States shall take into account the interests of ▌
SMEs, including start-ups, and SMCs, and their economic viability when
imposing penalties.’;
(b) in paragraph 4, the following point is inserted:
‘(da) obligations of providers and operators pursuant to Article 25(2) and
(4)’;
(c) the following paragraph is inserted:
‘6a. In the case of SMCs, each fine referred to in paragraphs 4 and 5 shall
be up to the percentages or amount referred therein, whichever is
lower.’;
▌
(39) Article 111 is amended as follows:
(a) paragraph 2 is replaced by the following:
‘2. Without prejudice to the application of Article 5 as referred to in Article
113, third paragraph, point (a), this Regulation shall apply to operators of
high-risk AI systems, other than the systems referred to in paragraph 1 of
this Article, that have been placed on the market or put into service
before the date of application of Chapter III referred to in Article 113,
only if, as from that date, those systems are subject to significant changes
in their designs. In any case, the providers and deployers of high-risk AI
systems intended to be used by public authorities shall take the necessary
steps to comply with the requirements and obligations laid down in this
Regulation by 2 August 2030.’;
(b) the following paragraph is added:
‘4. Providers of AI systems, including general-purpose AI systems,
generating synthetic audio, image, video or text content, that have been
placed on the market before 2 August 2026 shall take the necessary
steps in order to comply with Article 50(2) by 2 December 2026. ▌’;
(40) in Article 113, the third paragraph is amended as follows:
(a) point (a) is replaced by the following:
‘(a) Chapters I and II shall apply from 2 February 2025, with the exception
of Article 5(1), first subparagraph, points (ba) and (bb), and Article
5(1a) and (1b) which shall apply from 2 December 2026;’;
(b) point (c) is replaced by the following:
‘(c) Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall
apply from:
▌
(i) 2 December 2027 as regards AI systems classified as high-risk
pursuant to Article 6(2) and Annex III; and
(ii) 2 August 2028 as regards AI systems classified as high-risk
pursuant to Article 6(1) and Annex I;’;
(c) the following point is added:
‘(d) Articles 102 to 110 shall apply from … [the date of entry into force of
this amending Regulation].’;
(41) Annex I is amended as follows:
(a) in Section A, point 1 is deleted;
(b) in Section B, the following point is added:
‘21. Regulation (EU) 2023/1230 of the European Parliament and of the
Council of 14 June 2023 on machinery and repealing Directive
2006/42/EC of the European Parliament and of the Council and
Council Directive 73/361/EEC (OJ L 165, 29.6.2023, p. 1).’;
(42) in Annex VIII, section B, points 7 and 9 are deleted;
(43) the following Annex is added:
‘Annex XIV
The list of codes, categories and corresponding types of AI systems for the purpose
of the notification procedure referred to in Article 30 specifying the scope of the
designation as notified bodies
1. Introduction
Conformity assessment of high-risk AI systems pursuant to this Regulation
may require the involvement of conformity assessment bodies. Only
conformity assessment bodies that have been designated in accordance with
this Regulation may carry out conformity assessments and only for the
activities related to the types of AI systems concerned. The list of codes,
categories, and corresponding types of AI systems sets the scope of the
designation of conformity assessment bodies notified under Article 30.
2. List of Codes, categories, and corresponding AI systems
a. AI systems subject to Annex I
AIA Code
AIP 0102 AI systems subject to point 2 of Section A of Annex I
AIP 0103 AI systems subject to point 3 of Section A of Annex I
AIP 0104 AI systems subject to point 4 of Section A of Annex I
AIP 0105 AI systems subject to point 5 of Section A of Annex I
AIP 0106 AI systems subject to point 6 of Section A of Annex I
AIP 0107 AI systems subject to point 7 of Section A of Annex I
AIP 0108 AI systems subject to point 8 of Section A of Annex I
AIP 0109 AI systems subject to point 9 of Section A of Annex I
AIP 0110 AI systems subject to point 10 of Section A of Annex I
AIP 0111 AI systems subject to point 11 of Section A of Annex I
AIP 0112 AI systems subject to point 12 of Section A of Annex I
b. AI systems subject to point 1 of Annex III
AIA Code
AIB 0201 Remote biometric identification systems
AIB 0202 Biometric categorisation AI systems
AIB 0203 Emotion recognition AI systems
3. AI technology-specific codes
a. Symbolic AI and expert systems
AIA Code
AIH 0101 AI systems based on symbolic AI, expert and knowledge-based
systems, and AI systems based on search and optimisation
b. Machine learning, excluding generative AI and general-purpose AI systems
AIA Code
AIH 0201 AI systems that process structured data
AIH 0202 AI systems that process signal and audio data
AIH 0203 AI systems that process text data
AIH 0204 AI systems that process image and video
AIH 0205 AI systems that learn from their environment, excluding AI systems
covered under AIH 0401
c. AI systems based on general-purpose AI models or generative AI
AIA Code
AIH 0301 generative AI systems, including AI systems based on general-purpose
AI models
d. Emerging AI technologies
AIA Code
AIH 0401 AI systems based on other emerging AI technologies not covered by
other codes, including Agentic AI
3. Application for designation
Conformity assessment bodies shall use the lists of codes, categories and
corresponding types of AI systems set out in this Annex when specifying the
types of AI systems in the application for designation referred to in Article 29.
▌’
Article 2
Amendments to Regulation (EU) 2018/1139
Regulation (EU) 2018/1139 is amended as follows:
(1) in Article 27, the following paragraph is added:
‘3. Without prejudice to paragraph 2, when adopting implementing acts pursuant
to paragraph 1 concerning Artificial Intelligence (AI) systems which are safety
components within the meaning of Regulation (EU) 2024/1689 of the
European Parliament and of the Council* , the requirements set out in Chapter
III, Section 2, of that Regulation shall be taken into account.
__________________
* Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13
June 2024 laying down harmonised rules on artificial intelligence and amending
Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU)
2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU)
2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) (OJ L, 2024/1689,
12.7.2024, ELI: http://data.europa.eu/eli/reg/2024/1689/oj).’;
(2) in Article 31, the following paragraph is added:
‘3. Without prejudice to paragraph 2, when adopting implementing acts pursuant
to paragraph 1 concerning AI systems which are safety components within the
meaning of Regulation (EU) 2024/1689, the requirements set out in Chapter
III, Section 2, of that Regulation shall be taken into account.’;
http://data.europa.eu/eli/reg/2024/1689/oj
(3) in Article 32, the following paragraph is added:
‘3. When adopting delegated acts pursuant to paragraph 1 concerning AI systems
which are safety components within the meaning of Regulation (EU)
2024/1689, the requirements set out in Chapter III, Section 2, of that
Regulation shall be taken into account.’;
(4) in Article 36, the following paragraph is added:
‘3. Without prejudice to paragraph 2, when adopting implementing acts pursuant
to paragraph 1 concerning AI systems which are safety components within the
meaning of Regulation (EU) 2024/1689, the requirements set out in Chapter
III, Section 2, of that Regulation shall be taken into account.’;
(5) in Article 39 the following paragraph is added:
‘3. When adopting delegated acts pursuant to paragraph 1 concerning AI systems
which are safety components within the meaning of Regulation (EU)
2024/1689, the requirements set out in Chapter III, Section 2, of that
Regulation shall be taken into account.’;
(6) in Article 50, the following paragraph is added:
‘3. Without prejudice to paragraph 2, when adopting implementing acts pursuant
to paragraph 1 concerning AI systems which are safety components within the
meaning of Regulation (EU) 2024/1689, the requirements set out in Chapter
III, Section 2, of that Regulation shall be taken into account.’;
(7) in Article 53, the following paragraph is added:
‘3. Without prejudice to paragraph 2, when adopting implementing acts pursuant
to paragraph 1 concerning AI systems which are safety components within the
meaning of Regulation (EU) 2024/1689, the requirements set out in Chapter
III, Section 2, of that Regulation shall be taken into account. ▌’
Article 3
Amendments to Regulation (EU) 2023/1230
Regulation (EU) 2023/1230 is amended as follows:
(1) in Article 8, the following paragraphs are added:
‘The Commission shall adopt delegated acts in accordance with Article 47 of this
Regulation to amend Annex III to this Regulation by adding health and safety
requirements in respect of Artificial Intelligence (AI) systems that are classified as
high-risk pursuant to Article 6(1) of Regulation (EU) 2024/1689 of the European
Parliament and of the Council* due to the fact that they are a safety component in a
product covered by this Regulation, or they are themselves a product covered by
this Regulation. Those requirements shall ensure that the relevant requirements
set out in Chapter III, Section 2, and Articles 17, 19, 72 and 73 of Regulation (EU)
2024/1689 are reflected.
When adopting the delegated acts referred to in the third paragraph, the
Commission shall take into account the objectives of Regulation (EU) 2024/1689
and ensure a level of protection consistent with that Regulation. Those delegated
acts shall apply by 2 August 2028.
__________________
* Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13
June 2024 laying down harmonised rules on artificial intelligence and amending
Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU)
2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU)
2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) (OJ L, 2024/1689,
12.7.2024, ELI: http://data.europa.eu/eli/reg/2024/1689/oj).’;
http://data.europa.eu/eli/reg/2024/1689/oj
(2) in Article 20, the following paragraph is added:
‘10. Until harmonised standards or common specifications are referenced or
adopted pursuant to this Article as regards high-risk AI systems, high-risk AI
systems within the scope of this Regulation which comply with the relevant
harmonised standards referenced, or common specifications adopted
pursuant to Articles 40 and, respectively, 41 of Regulation (EU) 2024/1689
shall be presumed to be in conformity with the essential health and safety
requirements set out in Annex III to this Regulation as regards high-risk AI
systems.’;
(3) Article 47 is amended as follows:
(a) paragraphs 2 and 3 are replaced by the following:
‘2. The power to adopt delegated acts referred to in Article 6(2) and (11)
and Article 7(2) , shall be conferred on the Commission for a period
of five years from 19 July 2023. The power to adopt delegated acts
referred to in Article 8, third paragraph, shall be conferred on the
Commission for a period of five years from … [the date of entry into
force of this amending Regulation]. The Commission shall draw up a
report in respect of the delegation of power not later than nine
months before the end of the five-year period. The delegation of
power shall be tacitly extended for periods of an identical duration,
unless the European Parliament or the Council opposes such
extension no later than three months before the end of each period.
3. The delegation of power referred to in Article 6(2) and (11), Article
7(2) and Article 8, third paragraph, may be revoked at any time by the
European Parliament or by the Council. A decision to revoke shall
put an end to the delegation of the power specified in that decision. It
shall take effect the day following the publication of the decision in
the Official Journal of the European Union or at a later date
specified therein. It shall not affect the validity of any delegated acts
already in force.’;
(b) paragraph 6 is replaced by the following:
‘6. A delegated act adopted pursuant to Article 6(2) and (11), Article 7(2)
or Article 8, third paragraph, shall enter into force only if no
objection has been expressed either by the European Parliament or
by the Council within a period of two months of notification of that
act to the European Parliament and the Council or if, before the
expiry of that period, the European Parliament and the Council have
both informed the Commission that they will not object. That period
shall be extended by two months at the initiative of the European
Parliament or of the Council.’;
Article 4
Entry into force and application
This Regulation shall enter into force on the third day following that of its publication in the
Official Journal of the European Union.
This Regulation shall be binding in its entirety and directly applicable in all Member States.
Done at …,
For the European Parliament For the Council
The President The President
17.06.2026
Datei
PD
The European Association of
Medical devices Notified Bodies
Team-NB Position Paper
TEAM-NB Team-NB-PositionPaper-Micro-Small-Entreprise-Initiatives-V1-20260616.docx Page 1/9
Editor : Team-NB Adoption date 16/06/2026 Version 1
Micro and Small Enterprise Considerations.
Introduction
Micro and small medical device and in vitro diagnostic manufacturers form a critical component of the
European medical technology ecosystem. The Commission’s own estimate, page 1 of COM (2025) 1023
proposal, indicates that approximately 90% of manufacturers are SME’s, the majority of which are
micro and small enterprises. They are an important source of innovation, niche clinical solutions, and
patient access to specialised technologies. Many of these manufacturers operate with limited product
portfolios, often a single product line, and are highly dependent on predictable and timely market
access under the EU Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR)
frameworks for their commercial viability and survival.
The ongoing revision of the European medical device regulatory framework reflects a shared policy
objective: to improve system efficiency, increase predictability, and better support smaller
manufacturers. Among the proposed measures is an expectation that notified bodies offer significantly
reduced conformity assessment fees, up to a 50% discount for micro and small enterprises.
This proposal risks unintended consequences. It does not sufficiently account for the practical realities
of conformity assessment activities, the actual resource burden involved in assessing less mature
regulatory systems, nor the financial constraints under which notified bodies themselves operate. A
sustainable regulatory ecosystem requires that support measures for small manufacturers are
carefully designed so that they address root causes of regulatory difficulty without transferring
disproportionate operational and financial risk to notified bodies, whose designation, competence,
and independence are fundamental to patient safety and system credibility.
Problem Statement
The proposal for mandatory or expected fee discounts by notified bodies for micro and small medical
device manufacturers (page 56, amendment to article 50. The proposal is 50% reduction for micro,
25% reduction for small and a deferment of fees until after conformity assessment is completed) raises
substantial concerns regarding fairness, feasibility, and system sustainability.
Evidence from conformity assessment practice consistently shows that micro and small manufacturers
often require significantly greater regulatory support and assessment effort than larger, more
established organisations. This is typically reflected in:
• Higher volumes of clarification questions and follow-up interactions during technical
documentation assessment,
• Increased numbers and complexity of non-conformities identified,
The European Association of
Medical devices Notified Bodies
Team-NB Position Paper
TEAM-NB Team-NB-PositionPaper-Micro-Small-Entreprise-Initiatives-V1-20260616.docx Page 2/9
• Repeated cycles of resubmission due to immature or incomplete quality management systems
and technical files.
These challenges are frequently attributable not to a lack of commitment by small manufacturers, but
to structural limitations and lacking experience. Many micro and small enterprises have limited
embedded regulatory affairs expertise. This situation is likely to be further exacerbated by the
proposed removal of the requirement in Article 15 for micro and small enterprises to have a PRRC
within the organisation, thereby reducing a critical mechanism intended to ensure regulatory
competence at source.
In addition, clinical investigation planning and execution represent one of the most resource-intensive
aspects of the conformity assessment process, both in terms of time and financial investment. For
micro and small manufacturers in particular, the associated costs are sometimes unachievable, placing
a disproportionate burden on organisations with limited financial and operational capacity. These costs
are further compounded by the extended duration over which clinical investigations are conducted, as
well as the specialised personnel and infrastructure required to design, manage, monitor, and analyse
such studies.
This challenge is exacerbated by a lack of early regulatory clarity. In many cases, micro and small
manufacturers must commit significant resources to clinical evidence generation without sufficient
certainty that the chosen study design or evidence strategy will ultimately meet the General Safety
and Performance Requirements set out in Annex I of the Medical Device Regulation. This uncertainty
is often linked to limited in-house regulatory expertise, making it difficult for smaller organisations to
confidently align their clinical strategies with regulatory expectations from the outset.
As a result, there is a substantial risk that costly and time-consuming clinical investigations may need
to be repeated, adapted, or supplemented, further increasing the financial and operational strain.
Addressing this issue is therefore critical, not only to alleviate the burden on smaller manufacturers,
but also to improve the overall efficiency, predictability, and accessibility of the regulatory system.
At the same time, notified bodies operate under highly constrained economic and regulatory
conditions. They face increasing designation and oversight requirements, rising liability exposure, and
obligations to recruit and retain scarce technical and clinical experts. The cost of conformity
assessment is fundamentally driven by expert time and procedural rigor, not the size of the economic
operator. Imposing substantial fee reductions in cases where assessment effort is demonstrably higher
risks undermining notified body capacity, incentivising risk, avoidant behaviour, or unintentionally
reducing access to assessment service, contrary to the goals of the MDR and IVDR.
For many micro and small manufacturers, operating with a single product or a very limited portfolio is
common. This model inherently increases financial vulnerability, as revenue is dependent on one
primary source. Within this context, the requirements set out in MDCG 2019-6 impose a
disproportionately high administrative and financial burden on them.
In particular, the expectation that notified bodies conduct annual sampling and repeated reviews of a
device that has already undergone thorough assessment at the point of certification creates a recurring
strain. This includes revisiting technical documentation even where only minimal updates, such as
routine post-market surveillance data, are available. In practice, this level of repeated scrutiny often
The European Association of
Medical devices Notified Bodies
Team-NB Position Paper
TEAM-NB Team-NB-PositionPaper-Micro-Small-Entreprise-Initiatives-V1-20260616.docx Page 3/9
provides limited additional value and results in an excessive regulatory burden for both manufacturers
and notified bodies.This approach is also inconsistent when compared to the treatment of higher-risk
devices covered under product certificates, where the depth and frequency of technical
documentation reassessment may be less intensive following initial certification. As a result,
manufacturers with a single device may be subject to more frequent and repetitive technical review
than those managing multiple or higher-risk devices, despite the latter being inherently more complex.
The cumulative effect is a misalignment between policy intent and operational reality. Measures
intended to support micro and small manufacturers risk destabilising notified bodies, increasing
bottlenecks, and ultimately impairing market access for the very entities they aim to help.
A more sustainable approach is required, one that targets structural capability gaps, improves
regulatory quality at source, fosters innovation, and enhances system efficiency without eroding the
independence or financial viability of notified bodies.
It is also important to recognise, that consistency of approach across the system is critical to
maintaining both regulatory integrity and a level playing field. Where individual notified bodies adopt
divergent practices, particularly in relation to fee structures or perceived concessions, these
approaches are quickly extrapolated by stakeholders and may create further issues across the wider
system.
In this context, the principle of “same service, same cost” reflects not only economic reality but also
the need to preserve fairness, independence, and confidence in conformity assessment activities. Any
deviation from this principle risks introducing competitive distortion, undermining the collective
position of notified bodies, and ultimately weakening the consistency that the European Commission
itself expects under a harmonised regulatory framework. This further reinforces the need for solutions
that are systemic, policy-driven, and implemented at EU or Member State level, rather than through
ad hoc operational measures at individual notified body level.
Pragmatic Alternative Solutions to Support Micro and Small Manufacturers.
1. Formalise structured dialogue throughout the conformity assessment process and beyond
Structured dialogue is explicitly highlighted in the proposed MDR/IVDR reforms as a mechanism to
improve predictability, proportionality, and mutual understanding in notified body engagement with
micro and small manufacturers.
To further enhance these objectives, it is proposed that a structured dialogue opportunity be
systematically offered to micro and small manufacturers each time a formal round of questions is
issued during conformity assessment, at no additional cost. This dialogue, without constituting
consultancy and with the clear option for the manufacturer to decline, would allow both parties to
align on the intent, scope, and regulatory basis of the questions raised during the assessment, so the
expectations of the notified body are clear from the start.
In practice, this would support early clarification of clinical, performance, and QMS expectations;
reduce the risk of misinterpretation and iterative question cycles; and enable more efficient planning
The European Association of
Medical devices Notified Bodies
Team-NB Position Paper
TEAM-NB Team-NB-PositionPaper-Micro-Small-Entreprise-Initiatives-V1-20260616.docx Page 4/9
of limited regulatory, financial, and personnel resources by small manufacturers. By ensuring that
responses directly address notified body concerns at first submission, this approach has the potential
to improve assessment efficiency, reduce avoidable delays, and enhance overall system effectiveness
without compromising notified body independence or regulatory rigor.
From the perspective of micro and small manufacturers, the introduction of a mechanism comparable
to the FDA’s Q-Submission programme could deliver substantial benefits. These organisations often
operate with limited regulatory experience and constrained resources, making early clarity on
regulatory expectations particularly critical.
While due regard must be given to the provisions of Section 1.2. 3, of the Medical Device Regulation,
specifically to safeguard the impartiality of notified bodies, it should nevertheless be possible to
establish a structured, non-binding pre-submission process. Within such a framework, manufacturers
could present proposed protocols, study designs, or testing strategies in advance of execution and
receive high-level feedback from the notified body on their suitability to demonstrate conformity with
relevant requirements.
Importantly, any feedback provided would not prejudice the notified body’s independence, nor
constitute a commitment to accept the final results. However, even non-binding input from a decision-
making body would introduce a meaningful degree of clarity and predictability into the conformity
assessment process.
For micro and smaller manufacturers in particular, this increased predictability would significantly
reduce the risk of investing limited financial and operational resources in inadequate or misaligned
evidence-generation activities. Ultimately, such an approach would support more efficient
development pathways, improve the quality of submissions, and enhance overall access to the
regulatory system for organisations with less established regulatory expertise.
2. Surveillance Requirements
A more proportionate and risk-based approach to post-certification sampling is essential, particularly
for micro and small manufacturers of Class IIa and IIb non-implantable devices who have single product
certificates. As currently reflected in MDCG 2019-6, notified bodies are expected to carry out regular
and structured surveillance activities, including technical documentation sampling, as part of the
certification lifecycle. However, in practice, this can lead to repetitive reassessment of devices that
have already undergone a comprehensive and robust evaluation at the point of initial certification.
Regulatory oversight should instead focus on areas of genuine risk, such as significant design changes,
emerging safety signals, or substantive updates to clinical or technical documentation that could
impact the safety and performance of the device. Where a device has been thoroughly assessed and
no meaningful changes or concerns have arisen, it should be possible for the notified body to justify a
more targeted approach to subsequent sampling activities.
Introducing greater flexibility within the current framework would allow notified bodies to apply
justified, risk-based discretion, avoiding unnecessary repetition of full technical documentation
reviews on an annual basis. This would not only reduce administrative burden, but also better align
The European Association of
Medical devices Notified Bodies
Team-NB Position Paper
TEAM-NB Team-NB-PositionPaper-Micro-Small-Entreprise-Initiatives-V1-20260616.docx Page 5/9
with the core principles of the Medical Device Regulation, which emphasise proportionality and risk-
based decision-making.
Importantly, addressing this issue would correct an unintended imbalance in the current system,
whereby micro and small manufacturers with single-device portfolios may be subject to more frequent
and intensive scrutiny than manufacturers of higher-risk devices managed under product certification
approaches. A revised, more targeted sampling methodology would ensure that regulatory effort is
directed where it delivers the greatest value, rather than being expended on low-risk, duplicative
activities. This would significantly improve efficiency across the conformity assessment system while
maintaining high standards of safety and performance.
3. EU, Level Regulatory Capability Support Programmes
There is a clear need to establish EU or Member State, funded initiatives focused on strengthening
regulatory capability among micro and small medical device manufacturers, particularly at the early
stages of their MDR and IVDR onboarding.
In practice, manufacturers of this size often engage with the conformity assessment process too late
in their development journey, which frequently results in significant challenges in generating adequate
technical documentation and clinical evidence once regulatory review has commenced.
A more structured and proactive education framework could address this gap through initiatives such
as formal MDR/IVDR onboarding programmes, non, binding and non, assessment, based pre,
submission technical documentation readiness reviews, and standardised guidance addressing
common non, conformities observed across assessments.
Supporting resources could include a series of structured webinars and educational materials that can
be replayed on demand, enabling manufacturers to better understand regulatory expectations and
allowing notified bodies to consistently direct stakeholders to authoritative reference materials when
questions arise.
Such a programme would also support greater alignment of expectations between notified bodies,
competent authorities, manufacturers, consultants, and other stakeholders, thereby improving overall
submission quality and reducing avoidable assessment iterations. While the development of a
coordinated education framework of this nature represents a significant undertaking and would
require dedicated EU, level funding, (potentially through mechanisms such as Horizon Europe,
NoBoCAP, or similar initiatives) notified bodies remain open to supporting and contributing their
technical expertise to the development of content, recognising the long-term benefits this would bring
to the efficiency, consistency, and sustainability of the regulatory system as a whole.
It is important to recognise that the challenges faced by micro and small manufacturers extend beyond
notified body fees alone and are rooted in a wider, interconnected regulatory ecosystem. While
reductions in notified body fees may provide some limited relief, such measures in isolation are
insufficient to address the structural cost burdens associated with conformity assessment.
In particular, the provision of dedicated, non-repayable funding mechanisms at both EU and national
levels are more meaningful to micro and small manufacturers. These funding programmes should
The European Association of
Medical devices Notified Bodies
Team-NB Position Paper
TEAM-NB Team-NB-PositionPaper-Micro-Small-Entreprise-Initiatives-V1-20260616.docx Page 6/9
explicitly cover not only regulatory activities, but also the substantial costs associated with laboratory
testing, clinical investigation, and contracted research organisations (CROs), which collectively
represent a significant proportion of the overall financial burden for micro and small manufacturers.
Strengthening and expanding such funding instruments across Member States is therefore essential to
achieving a more equitable and accessible regulatory environment.
Furthermore, it should be emphasised that reductions in notified body fees alone cannot constitute a
comprehensive solution. Notified bodies, the majority of which operate as private entities, must retain
the autonomy to determine whether and to what extent fee reductions can be applied, based on the
sustainability of their own operational and capital expenditure structures. As a result, any discounts
offered will necessarily vary between notified bodies and cannot be uniformly mandated at EU level
without risking impacts on capacity, quality, or independence.
Equally, it is critical that other key actors within the conformity assessment ecosystem, including
laboratories, CROs, and regulatory consultants are encouraged to adopt a similar approach. A
coordinated effort across all stakeholders is required to ensure that cost reductions are meaningful,
balanced, and sustainable. Without such a holistic approach, the cumulative financial barriers will
remain disproportionately high for micro and small manufacturers, limiting their ability to successfully
navigate the regulatory framework.
4. MDR/IVDR Consultants
Many micro and small medical device manufacturers rely heavily on external regulatory consultants to
navigate the complexities of the MDR/IVDR. However, these consultants are frequently selected based
on cost rather than demonstrated competence or relevant regulatory experience. This creates a
significant vulnerability within the system, as manufacturers, particularly those with limited in-house
regulatory expertise, are often not in a position to effectively assess or verify the quality and suitability
of the advice being provided.
As a result, there is a tangible risk that manufacturers receive guidance that is incomplete,
misinterpreted, or misaligned with regulatory expectations and notified body practices. This can lead
to poor-quality submissions, prolonged review timelines, avoidable non-conformities, and ultimately
increased costs and delays.
While highly experienced consultants, particularly those with prior notified body or equivalent
regulatory assessment experience, can provide robust and well-aligned guidance, such expertise is not
consistently accessible, nor easily identifiable by less experienced organisations.
This situation highlights a broader structural gap within the regulatory ecosystem. Unlike notified
bodies, which are subject to stringent requirements for competence, qualification, and ongoing
oversight, there are currently no equivalent, transparent mechanisms to ensure or demonstrate the
competency of regulatory consultants. For micro and small manufacturers, this creates a challenging
environment in which critical decisions rely on advice that may vary significantly in quality.
To address this, it would be beneficial to introduce mechanisms that provide an additional layer of
assurance for manufacturers without compromising the independence of notified bodies. Structured
The European Association of
Medical devices Notified Bodies
Team-NB Position Paper
TEAM-NB Team-NB-PositionPaper-Micro-Small-Entreprise-Initiatives-V1-20260616.docx Page 7/9
dialogue could be leveraged to allow notified bodies to review, at a high level, the adequacy and
correctness of approaches or interpretations proposed by consultants. Such interactions would remain
non-binding and focused on “what” is required rather than “how” to comply, thereby maintaining
impartiality while offering valuable validation to manufacturers.
This approach would provide micro and small enterprises with greater confidence that the advice they
are relying on is aligned with regulatory expectations, reducing the risk of costly missteps. This could
significantly improve the consistency and quality of regulatory submissions at source, strengthen trust
across the system, and deliver meaningful benefits for micro and small manufacturers.
5. Offer remote or hybrid audit options where appropriate
The broader and more systematic introduction of remote and hybrid audit models would deliver
significant benefits for micro and small medical device manufacturers, particularly those with limited
resources and have small or remote operational teams.
On-site audits often require substantial preparation, dedicated staff availability, and logistical
coordination, which can place a disproportionate burden on smaller enterprises that may lack spare
regulatory or quality personnel.
A risk-based and proportionate approach to remote or hybrid audits, considering factors such as device
technology, long, standing market history, organisational maturity, and demonstrated regulatory
compliance, would allow oversight activities to be tailored appropriately without compromising
regulatory rigor.
Manufacturers with stable product portfolios, consistent quality management system performance, a
strong compliance record, and no history of serious non, conformities, field safety corrective actions,
or unresolved post, market concerns could be well suited to partially or fully remote audits. Such an
approach would reduce travel and administrative costs, allow for more flexible scheduling, and better
accommodate organisations with limited on, site staff or distributed teams. By aligning audit modality
with actual risk and performance history, remote and hybrid audits can meaningfully reduce financial
and administrative burdens for smaller manufacturers while preserving effective regulatory oversight,
supporting predictability, and improving overall system efficiency.
6. Guidance and Template Harmonisation
A coherent and predictable regulatory system requires not only high, quality guidance, but also a clear
and consistent pathway for how such guidance is applied in practice across different device types and
regulatory stages.
The Medical Device Coordination Group (MDCG) has published an extensive and growing body of
guidance intended to harmonise MDR and IVDR implementation, covering areas such as classification,
borderline determinations, clinical evaluation, performance studies, and post, market requirements.
However, without structured support, micro and small manufacturers in particular often struggle to
identify which guidance is most relevant to their specific device or how multiple documents should be
applied in combination, leading to misclassification, incomplete evidence packages, and avoidable
assessment delays.
The European Association of
Medical devices Notified Bodies
Team-NB Position Paper
TEAM-NB Team-NB-PositionPaper-Micro-Small-Entreprise-Initiatives-V1-20260616.docx Page 8/9
Actively guiding manufacturers in the appropriate and proportionate use of MDCG guidance, for
example by mapping key documents to assessment stages and device categories, would significantly
reduce regulatory uncertainty and align submissions with EU expectations from the outset. In parallel,
closer collaboration between regulators, notified bodies, and industry stakeholders to develop
harmonised technical documentation templates, anonymised examples of high, quality submissions,
and clearer interpretations of commonly misunderstood requirements would further strengthen
consistency and efficiency. Embedding these elements within a unified, formalised, and ideally
digitised submission framework would represent a major step forward for the system as a whole,
driving harmonisation, improving first, pass success rates, and reducing administrative burden for
manufacturers of all sizes.
Importantly, while such measures would be particularly beneficial for micro and small enterprises with
limited regulatory capacity, the advantages of clarity, consistency, and predictability would extend
equally to larger manufacturers, notified bodies, and competent authorities, making this a
foundational enabler of a more effective and resilient EU regulatory ecosystem.
Conclusion
Notified bodies fully support the objective of strengthening the position of micro and small
manufacturers within the European regulatory framework and ensuring continued patient access to
safe and effective medical technologies. However, the challenges faced by these organisations are
structural and systemic in nature, extending far beyond notified body fees alone. Measures focused
solely on fee reductions risk addressing symptoms rather than root causes, and may unintentionally
undermine the capacity, independence, and sustainability of the conformity assessment system.
The analysis presented in this paper demonstrates that the primary barriers encountered by micro and
small manufacturers relate to limited regulatory experience, high costs associated with clinical
evidence generation and external services, variability in the quality of regulatory advice, and
inefficiencies arising from disproportionate or repetitive conformity assessment activities.
Addressing these challenges requires a more balanced and ecosystem-wide approach. The most
effective solutions lie in improving regulatory capability at source, increasing predictability of
requirements, and ensuring that oversight activities are applied in a proportionate and risk-based
manner. In this context, the measures proposed in this paper provide a targeted and practical path
forward, including:
• Strengthening and formalising structured dialogue, including pre-submission interactions, to
improve early alignment and reduce uncertainty;
• Introducing greater flexibility in post-certification surveillance and sampling, enabling notified
bodies to apply justified, risk-based approaches and avoid unnecessary duplication;
• Establishing EU and Member State-funded programmes to support regulatory capability
development and to offset the broader costs of clinical investigations, laboratory testing, and
associated services;
The European Association of
Medical devices Notified Bodies
Team-NB Position Paper
TEAM-NB Team-NB-PositionPaper-Micro-Small-Entreprise-Initiatives-V1-20260616.docx Page 9/9
• Improving transparency, consistency, and assurance in the use of regulatory consultants,
including mechanisms for validation of regulatory approaches through structured dialogue;
• Expanding the use of remote and hybrid audit models where appropriate, reducing operational
burden on smaller organisations;
• Advancing harmonisation of guidance, templates, and submission frameworks to improve
clarity, consistency, and first-time quality of submissions.
Collectively, these measures address the underlying drivers of inefficiency and cost, while preserving
the integrity, independence, and technical rigour of notified bodies. Importantly, they support a more
equitable and accessible regulatory environment without introducing distortions or unintended
consequences associated with mandatory fee reductions.
A sustainable and resilient regulatory system must be built on proportionality, predictability, and
shared responsibility across all actors in the ecosystem. By focusing on these principles, the European
framework can more effectively support innovation from micro and small manufacturers, while
continuing to uphold the highest standards of patient safety and public health.
18.06.2026
Datei
PD
