Article 6
Classification Rules for High-Risk AI Systems
Defines which AI systems are considered high-risk based on their intended purpose and the potential harm they may cause.
Article 9
Risk Management System
Requires providers to establish, implement, document and maintain a risk management system throughout the entire lifecycle of a high-risk AI system. This includes identifying known and foreseeable risks, estimating and evaluating risks, and adopting suitable risk management measures.
Article 10
Data and Data Governance
Training, validation and testing data sets shall be subject to appropriate data governance practices. Data must be relevant, representative, free of errors, and complete. Requires examination for possible biases and appropriate measures to address them.
Article 12
Record-Keeping
High-risk AI systems shall technically allow for automatic recording of events ('logs') over the lifetime of the system. Logging must enable traceability of the AI system's functioning, including input data, reference databases used, and outputs produced.
Article 13
Transparency and Information to Users
High-risk AI systems shall be designed and developed to ensure their operation is sufficiently transparent. Users must be provided with clear information about the AI system's capabilities and limitations.
Article 14
Human Oversight
High-risk AI systems shall be designed to allow effective oversight by natural persons during use. Human oversight aims to prevent or minimise risks to health, safety, or fundamental rights. Includes ability to fully understand, interpret outputs, decide not to use, or intervene.
Article 15
Accuracy, Robustness and Cybersecurity
High-risk AI systems shall be designed to achieve appropriate levels of accuracy, robustness, and cybersecurity. Systems must be resilient against attempts by unauthorised third parties to exploit vulnerabilities.
Article 17
Quality Management System
Providers shall establish a quality management system ensuring compliance with the regulation. Includes strategies for regulatory compliance, techniques for design, development and examination of the AI system.
Article 20
Corrective Actions
Providers must take immediate corrective action if the AI system presents a risk. This includes withdrawal, disabling, recall, or informing relevant authorities about non-compliance and corrective actions taken.
Article 52
Transparency Obligations for Certain AI Systems
Users must be informed when interacting with an AI system (e.g., chatbots). AI-generated content must be marked as artificially generated or manipulated. Applies to emotion recognition and biometric categorisation systems.
