What changed between the adopted text of 14 Jun 2023 and the adopted text of 13 Mar 2024

Removed:Article 16 – paragraph 1 – point d: (d) when under their control, keep the logs automatically generated by their high-risk AI systems that are required for ensuring and demonstrating compliance with this Regulation, in accordance with Article 20;

Removed:Article 16 – paragraph 1 – point e: (e) ensure that the high-risk AI system undergoes the relevant conformity assessment procedure, prior to its placing on the market or putting into service, in accordance with Article 43;

Removed:Article 16 – paragraph 1 – point e a (new): (e a) draw up an EU declaration of conformity in accordance with Article 48;

Removed:Article 16 – paragraph 1 – point e b (new): (e b) affix the CE marking to the high-risk AI system to indicate conformity with this Regulation, in accordance with Article 49;

Removed:Article 16 – paragraph 1 – point g: (g) take the necessary corrective actions as referred to in Article 21 and provide information in that regard;

Removed:Article 16 – paragraph 1 – point h: deleted

Removed:Article 16 – paragraph 1 – point i: deleted

Removed:Article 16 – paragraph 1 – point j: (j) upon a reasoned request of a national supervisory authority, demonstrate the conformity of the high-risk AI system with the requirements set out in Chapter 2 of this Title.

Removed:Article 16 – paragraph 1 – point j a (new): (j a) ensure that the high-risk AI system complies with accessibility requirements.

Removed:Article 17 – paragraph 1 – introductory part: 1. Providers of high-risk AI systems shall have a quality management system in place that ensures compliance with this Regulation. It shall be documented in a systematic and orderly manner in the form of written policies, procedures or instructions, and can be incorporated into an existing quality management system under Union sectoral legislative acts. It shall include at least the following aspects:

Removed:Article 17 – paragraph 1 – point a: deleted

Removed:Article 17 – paragraph 1 – point e: (e) technical specifications, including standards, to be applied and, where the relevant harmonised standards are not applied in full, or do not cover all of the relevant requirements, the means to be used to ensure that the high-risk AI system complies with the requirements set out in Chapter 2 of this Title;

Removed:Article 17 – paragraph 1 – point f: (f) systems and procedures for data management, including data acquisition data collection, data analysis, data labelling, data storage, data filtration, data mining, data aggregation, data retention and any other operation regarding the data that is performed before and for the purposes of the placing on the market or putting into service of high-risk AI systems;

Removed:Article 17 – paragraph 1 – point j: (j) the handling of communication with relevant competent authorities, including sectoral ones;

Removed:Article 17 – paragraph 2: 2. The implementation of aspects referred to in paragraph 1 shall be proportionate to the size of the provider’s organisation. Providers shall in any event respect the degree of rigour and the level of protection required to ensure compliance of their AI systems with this Regulation.

Removed:Article 18 – title: deleted

Removed:Article 18 – paragraph 1: deleted

Removed:Article 18 – paragraph 2: deleted

Removed:Article 19: deleted / (deleted) / (deleted) / (deleted)

Removed:Article 20 – paragraph 1: 1. Providers of high-risk AI systems shall keep the logs automatically generated by their high-risk AI systems, to the extent such logs are under their control. Without prejudice to applicable Union or national law, the logs shall be kept for a period of at least 6 months. The retention period shall be in accordance with industry standards and appropriate to the intended purpose of high-risk AI system.

Removed:Article 21 – paragraph 1: Providers of high-risk AI systems which consider or have reason to consider that a high-risk AI system which they have placed on the market or put into service is not in conformity with this Regulation shall immediately take the necessary corrective actions to bring that system into conformity, to withdraw it, to disable it or to recall it, as appropriate. / In the cases referred to in the first paragraph, providers shall immediately inform: / a. the distributors; / b. the importers; / c. the national competent authorities of the Member States in which they made the AI system available or put it into service; and / d. where possible, the deployer.

Removed:Article 21 – paragraph 1 a (new): The providers shall also inform the authorised representative, if one was appointed in accordance with Article 25, and the notified body if the high-risk AI system had to undergo a third-party conformity assessment in accordance with Article 43. Where applicable, they shall also investigate the causes in collaboration with the deployer.

Removed:Article 22 – paragraph 1: Where the high-risk AI system presents a risk within the meaning of Article 65(1) and the provider of the system becomes aware of that risk, that provider shall immediately inform the national supervisory authorities of the Member States in which it made the system available and, where applicable, the notified body that issued a certificate for the high-risk AI system, in particular the nature of the non-compliance and of any relevant corrective actions taken.

Removed:Article 22 – paragraph 1 a (new): In the cases referred to inthe first paragraph, providers of the high-risk AI system shall immediately inform: / a) the distributors; / b) the importers; / c) the national competent authorities of the Member States in which they made the AI system available or put it into service; and / d) where possible, the deployers.

Removed:Article 22 – paragraph 1 b (new): The providers shall also inform the authorised representative, if one was appointed in accordance with Article 25.

Removed:Article 23 – title: Cooperation with competent authorities, the Office and the Commission

Removed:Article 23 – paragraph 1: Providers and where applicable, deployers of high-risk AI systems shall, upon a reasoned request by a national competent authority or where applicable, by the AI Office or the Commission, provide them with all the information and documentation necessary to demonstrate the conformity of the high-risk AI system with the requirements set out in Chapter 2 of this Title, in an official Union language determined by the Member State concerned.

Removed:Article 23 – paragraph 1 a (new): Upon a reasoned request by a national competent authority or, where applicable, by the Commission, providers and, where applicable, deployers shall also give the requesting national competent authority or the Commission, as applicable, access to the logs automatically generated by the high-risk AI system, to the extent such logs are under their control.

Removed:Article 23 – paragraph 1 b (new): Any information obtained by a national competent authority or by the Commission pursuant to the provisions of this Article shall be considered a trade secret and be treated in compliance with the confidentiality obligations set out in Article 70.

Removed:Article 25 – paragraph 1: 1. Prior to making their systems available on the Union market, providers established outside the Union shall, by written mandate, appoint an authorised representative which is established in the Union.

Removed:Article 25 – paragraph 1 a (new): 1 a. The authorised representative shall reside or be established in one of the Member States where the activities pursuant to Article 2, paragraphs 1(cb) are taking place.

Removed:Article 25 – paragraph 1 b (new): 1 b. The provider shall provide its authorised representative with the necessary powers and resources to comply with its tasks under this Regulation.

Removed:Article 25 – paragraph 2 – introductory part: 2. The authorised representative shall perform the tasks specified in the mandate received from the provider. It shall provide a copy of the mandate to the market surveillance authorities upon request, in one of the official languages of the institution of the Union determined by the national competent authority. For the purpose of this Regulation, the mandate shall empower the authorised representative to carry out the following tasks:

Removed:Article 25 – paragraph 2 – point a: (a) ensure that the EU declaration of conformity and the technical documentation have been drawn up and that an appropriate conformity assessment procedure has been carried out by the provider;

Removed:Article 25 – paragraph 2 – point a a (new): (a a) keep at the disposal of the national competent authorities and national authorities referred to in Article 63(7), a copy of the EU declaration of conformity, the technical documentation and, if applicable, the certificate issued by the notified body;

Removed:Article 25 – paragraph 2 – point b: (b) provide a national competent authority, upon a reasoned request, with all the information and documentation necessary to demonstrate the conformity of a high-risk AI system with the requirements set out in Chapter 2 of this Title, including access to the logs automatically generated by the high-risk AI system to the extent such logs are under the control of the provider;

Removed:Article 25 – paragraph 2 – point c: (c) cooperate with national supervisory authorities, upon a reasoned request, on any action the authority takes to reduce and mitigate the risks posed by the high-risk AI system;

Removed:Article 25 – paragraph 2 – point c a (new): (c a) where applicable, comply with the registration obligations referred in Article 51, or, if the registration is carried out by the provider itself, ensure that the information referred to in point 3 of Annex VIII is correct.

Removed:Article 25 – paragraph 2 a (new): 2 a. The authorised representative shall be mandated to be addressed, in addition to or instead of the provider, by, in particular, the national supervisory authority or the national competent authorities, on all issues related to ensuring compliance with this Regulation.

Removed:Article 25 – paragraph 2 b (new): 2 b. The authorised representative shall terminate the mandate if it considers or has reason to consider that the provider acts contrary to its obligations under this Regulation. In such a case, it shall also immediately inform the national supervisory authority of the Member State in which it is established, as well as, where applicable, the relevant notified body, about the termination of the mandate and the reasons thereof.

Removed:Article 26 – paragraph 1 – introductory part: 1. Before placing a high-risk AI system on the market, importers of such system shall ensure that such a system is in conformity with this Regulation by ensuring that:

Removed:Article 26 – paragraph 1 – point a: (a) the relevant conformity assessment procedure referred to in Article 43 has been carried out by the provider of that AI system

Removed:Article 26 – paragraph 1 – point b: (b) the provider has drawn up the technical documentation in accordance with Article 11 and Annex IV;

Removed:Article 26 – paragraph 1 – point c a (new): (c a) where applicable, the provider has appointed an authorised representative in accordance with Article 25(1).

Removed:Article 26 – paragraph 2: 2. Where an importer considers or has reason to consider that a high-risk AI system is not in conformity with this Regulation, or is counterfeit, or accompanied by falsified documentation it shall not place that system on the market until that AI system has been brought into conformity. Where the high-risk AI system presents a risk within the meaning of Article 65(1), the importer shall inform the provider of the AI system and the market surveillance authorities to that effect.

Removed:Article 26 – paragraph 3: 3. Importers shall indicate their name, registered trade name or registered trade mark, and the address at which they can be contacted on the high-risk AI system and on its packaging or its accompanying documentation, where applicable.

Removed:Article 26 – paragraph 5: 5. Importers shall provide national competent authorities, upon a reasoned request, with all the necessary information and documentation to demonstrate the conformity of a high-risk AI system with the requirements set out in Chapter 2 of this Title in a language which can be easily understood by them, including access to the logs automatically generated by the high-risk AI system to the extent such logs are under the control of the provider in accordance with Article 20.

Removed:Article 26 – paragraph 5 a (new): 5 a. Importers shall cooperate with national competent authorities on any action those authorities take to reduce and mitigate the risks posed by the high-risk AI system.

Removed:Article 27 – paragraph 1: 1. Before making a high-risk AI system available on the market, distributors shall verify that the high-risk AI system bears the required CE conformity marking, that it is accompanied by the required documentation and instruction of use, and that the provider and the importer of the system, as applicable, have complied with their obligations set out in this Regulation in Articles 16 and 26 respectively.

Removed:Article 27 – paragraph 2: 2. Where a distributor considers or has reason to consider, on the basis of the information in its possession that a high-risk AI system is not in conformity with the requirements set out in Chapter 2 of this Title, it shall not make the high-risk AI system available on the market until that system has been brought into conformity with those requirements. Furthermore, where the system presents a risk within the meaning of Article 65(1), the distributor shall inform the provider or the importer of the system, the relevant national competent authority, as applicable, to that effect.

Removed:Article 27 – paragraph 4: 4. A distributor that considers or has reason to consider, on the basis of the information in its possession, that a high-risk AI system which it has made available on the market is not in conformity with the requirements set out in Chapter 2 of this Title shall take the corrective actions necessary to bring that system into conformity with those requirements, to withdraw it or recall it or shall ensure that the provider, the importer or any relevant operator, as appropriate, takes those corrective actions. Where the high-risk AI system presents a risk within the meaning of Article 65(1), the distributor shall immediately inform the provider or importer of the system and the national competent authorities of the Member States in which it has made the product available to that effect, giving details, in particular, of the non-compliance and of any corrective actions taken.

Removed:Article 27 – paragraph 5: 5. Upon a reasoned request from a national competent authority, distributors of the high-risk AI system shall provide that authority with all the information and documentation in their possession or available to them, in accordance with the obligations of distributors as outlined in paragraph 1, that are necessary to demonstrate the conformity of a high-risk system with the requirements set out in Chapter 2 of this Title.

Removed:Article 27 – paragraph 5 a (new): 5 a. Distributors shall cooperate with national competent authorities on any action those authorities take to reduce and mitigate the risks posed by the high-risk AI system.

Removed:Article 28 – title: Responsibilities along the AI value chain of providers, distributors, importers, deployers or other third parties

Removed:Article 28 – paragraph 1 – introductory part: 1. Any distributor, importer, deployer or other third-party shall be considered a provider of a high-risk AI system for the purposes of this Regulation and shall be subject to the obligations of the provider under Article 16, in any of the following circumstances:

Removed:Article 28 – paragraph 1 – point a: (a) they put their name or trademarkt on a high-risk AI system already placed on the market or put into service;

Removed:Article 28 – paragraph 1 – point b: (b) they make a substantial modification to a high-risk AI system that has already been placed on the market or has already been put into service and in a way that it remains a high-risk AI system in accordance with Article 6;

Removed:Article 28 – paragraph 1 – point b a (new): (b a) they make a substantial modification to an AI system, including a general purpose AI system, which has not been classified as high-risk and has already been placed on the market or put into service in such manner that the AI system becomes a high risk AI system in accordance with Article 6

Removed:Article 28 – paragraph 2: 2. Where the circumstances referred to in paragraph 1, point (a) to (ba) occur, the provider that initially placed the AI system on the market or put it into service shall no longer be considered a provider of that specific AI system for the purposes of this Regulation. This former provider shall provide the new provider with the technical documentation and all other relevant and reasonably expected information capabilities of the AI system, technical access or other assistance based on the generally acknowledged state of the art that are required for the fulfilment of the obligations set out in this Regulation. / This paragraph shall also apply to providers of foundation models as defined in Article 3 when the foundation model is directly integrated in an high-risk AI system.

Removed:Article 28 – paragraph 2 a (new): 2 a. The provider of a high risk AI system and the third party that supplies tools, services, components or processes that are used or integrated in the high risk AI system shall, by written agreement specify the information, capabilities, technical access, and or other assistance, based on the generally acknowledged state of the art, that the third party is required to provide in order to enable the provider of the high risk AI system to fully comply with the obligations under this Regulation. / The Commission shall develop and recommend non-binding model contractual terms between providers of high-risk AI systems and third parties that supply tools, services, components or processes that are used or integrated in high-risk AI systems in order to assist both parties in drafting and negotiating contracts with balanced contractual rights and obligations, consistent with each party’s level of control. When developing non-binding model contractual terms, the Commission shall take into account possible contractual requirements applicable in specific sectors or business cases. The non-binding contractual terms shall be published and be available free of charge in an easily usable electronic format on the AI Office’s website.