(3)

Consequently, targeted amendments to Regulation (EU) 2024/1689 are necessary to address certain implementation challenges, with a view to the effective application of the relevant rules.

(3)

Consequently, targeted amendments to Regulation (EU) 2024/1689 are necessary to address certain implementation challenges, with a view to the effective , simple and uniform application of the relevant rules.

(3a)

Additionally, the Commission, the AI Office and Member States’ competent authorities should ensure that supervision, enforcement and monitoring of sectorial and national laws do not create overlaps, inconsistent interpretations or divergent enforcement in order to enable AI innovation in the private and public sector.

(4)

Enterprises outgrowing the micro, small and medium-sized enterprises (‘SME’) definition – the ‘small mid-cap enterprises’ (‘SMCs’) – play a vital role in the Union’s economy. Compared to SMEs, SMCs tend to demonstrate a higher pace of growth, and level of innovation and digitisation. Nevertheless, they face challenges similar to SMEs in relation to administrative burden, leading to a need for proportionality in the implementation of Regulation (EU) 2024/1689 and for targeted support. To enable the smooth transition of enterprises from SMEs into SMCs, it is important to address in a coherent manner the effect that regulation may have on their activity once those enterprises outgrow the segment of SMEs and are faced with rules that apply to large enterprises. Regulation (EU) 2024/1689 provides for several measures for small-scale providers, which should be extended to SMCs. In order to clarify the treatment of SMEs and SMCs in Regulation (EU) 2024/1689, it is necessary to introduce definitions for SMEs and SMCs, which should correspond to the definition set out in the Annex to Commission Recommendation 2003/361/EC (4)and Annex to Commission Recommendation (EU) 2025/3500 (5).

(4)

99,8 % of all Union companies are small and medium-sized enterprises, the majority of which are micro and small enterprises. (3a) Enterprises outgrowing the micro, small and medium-sized enterprises (‘SME’) definition – the ‘small mid-cap enterprises’ (‘SMCs’) – play a vital role in the Union’s economy. Compared to SMEs, SMCs tend to demonstrate a higher pace of growth, and level of innovation and digitisation. Nevertheless, they face challenges similar to SMEs in relation to administrative burden, leading to a need for proportionality in the implementation of Regulation (EU) 2024/1689 and for targeted support. To enable the smooth transition of enterprises from SMEs into SMCs, it is important to address in a coherent manner the effect that regulation may have on their activity once those enterprises outgrow the segment of SMEs and are faced with rules that apply to large enterprises. Regulation (EU) 2024/1689 provides for several measures for small-scale providers, which should be extended to SMCs where appropriate while safeguarding the overarching objectives and level of protection afforded under Regulation (EU) 2024/16893b . In order to clarify the treatment of SMEs and SMCs in Regulation (EU) 2024/1689, it is necessary to introduce definitions for SMEs and SMCs, which should correspond to the definition set out in the Annex to Commission Recommendation 2003/361/EC (4) and Annex to Commission Recommendation (EU) 2025/3500 (5).

(5)

Article 4 of Regulation (EU) 2024/1689 currently imposes an obligation on all providers and deployers of AI systems to ensure AI literacy of their staff. AI literacy development starting from education and training and continuing in a lifelong learning manner is crucial to equip providers, deployers and other affected persons with the necessary notions to make informed decisions regarding AI systems deployment. However, experience shared by stakeholders reveals that a one-size-fits-all solution is not suitable for all types of providers and deployers in relation to the promotion of AI literacy , rendering such a horizontal obligation ineffective in achieving the objective pursued by this provision. Moreover, data indicate that imposing such an obligation creates an additional compliance burden, particularly for smaller enterprises, whereas AI literacy should be a strategic priority, regardless of regulatory obligations and potential sanctions . In light of that, Article 4 of Regulation (EU) 2024/1689 should be amended to require the Member States and the Commission, without prejudice to their respective competences, to individually, collectively and in cooperation with relevant stakeholders encourage providers and deployers to provide a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf , including through offering training opportunities, providing informational resources, and allowing exchange of good practices and other non-legally binding initiatives . The European Artificial Intelligence Board (“Board”) will ensure recurrent exchange between the Commission and Member States on the topic, while the Apply AI Alliance will allow discussion with the wider community. This amendment is without prejudice to the broader measures taken by the Commission and the Member States to promote AI literacy and competences for the wider population, including learners, students, and citizens at different ages and in particular through education and training systems .

(5)

Article 4 of Regulation (EU) 2024/1689 currently imposes an obligation on all providers and deployers of AI systems to ensure AI literacy of their staff. AI literacy development starting from education and training and continuing in a lifelong learning manner is crucial to equip providers, deployers and other affected persons with the necessary skills to make informed decisions regarding AI systems deployment. However, experience shared by stakeholders reveals that a solution imposing stringent obligations to ensure a sufficient level of AI literacy is not suitable for all types of providers and deployers in relation to the promotion of AI literacy. In light of that, Article 4 of Regulation (EU) 2024/1689 should be amended to require providers and deployers of AI systems to support AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf. The European Commission should promote AI literacy and competences for the wider population, and in order to support, facilitate and complement the efforts of providers, should be tasked to issue guidance on the practical implementation regarding the obligation on providers and deployers of AI systems, and should, together with the Member States, encourage and support AI literacy in society. This should include facilitating and complementing the efforts of providers and deployers of AI systems, in particular SMEs, as the implementation of the relevant obligations poses particular challenges for them . One possibility to facilitate AI literacy in the Union could be the creation of Public Private Partnerships (PPPs).

(5a)

AI systems that alter, manipulate or artificially generates realistic images or videos depicting sexually explicit activities, or the intimate parts of an identifiable natural person, without that person’s consent, cause harm to victims and violate fundamental rights to dignity and privacy. The proliferation of such technologies, often marketed as 'nudification’ applications, has created an urgent need for explicit regulatory prohibition. Regulation (EU) 2024/1689 establishes a framework for prohibited AI practices, which is to be kept under review. This is without prejudice towards the rights, freedoms and principles recognised by Article 6 TEU and the Charter of Fundamental Rights of the European Union, and the exercise of the rights guaranteed therein to freedom of expression and information and the freedom of the arts and sciences. This prohibition should not apply to providers or deployers of AI systems who have put in place effective safety measures, such as technical and organisational measures, to prevent the generation of such depictions and to avoid continuously misuse, after the system has been placed, on the market or put into service, despite the intention of the provider or deployer. Moreover, this prohibition should not prevent AI providers from developing their technical capabilities to alter, manipulate or artificially generate images or videos.

(6)

Bias detection and correction constitute a substantial public interest because they protect natural persons from biases’ adverse effects, including discrimination. Discrimination might result from the bias in AI models and AI systems other than high-risk AI systems for which of Regulation (EU) 2024/1689 already provides a legal basis authorising the processing of special categories of personal data under Article 9(2), point (g), of Regulation (EU) 2016/679 of the European Parliament and of the Council (6). Given that discrimination might result also from those other AI systems and models , it is therefore appropriate that Regulation (EU) 2024/1689 should provide for a legal basis for the processing of special categories of personal data also by providers and deployers of other AI systems and AI models as well as deployers of high-risk AI systems. The legal basis is established in compliance with Article 9(2), point (g) of Regulation (EU) 2016/679 Article 10(2), point (g) of Regulation (EU) 2018/1725 of the European Parliament and of the Council  (7) and Article 10, point (a) of Directive (EU) 2016/680 of the European Parliament and of the Council  (8) provides a legal basis allowing, where necessary for the detection and removal of bias, the processing of special categories of personal data by providers and deployers of all AI systems and models, subject to appropriate safeguards that complement Regulations (EU) 2016/679, Regulation (EU) 2018/1725 and Directive (EU) 2016/680, as applicable .

(6)

Bias detection and correction constitute a substantial public interest because they protect natural persons from biases’ adverse effects, including discrimination. For that reason, Regulation (EU) 2024/1689 already provides a legal basis authorising the providers of high-risk AI systems to process special categories of personal data in certain exceptional cases and subject to strict safeguards. This legal basis is linked to those providers’ obligation to establish practices concerning the detection, prevention and mitigation of biases likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited under Union law. Accordingly , a substantial public interest exists to permit, where strictly necessary, the processing of special categories of personal data for the purposes of bias detection and correction. It is therefore necessary to extend the legal basis established under Regulation (EU) 2024/1689 so that it also applies to the also by providers and deployers of other AI systems and AI models . That legal basis should be subject to the same conditions and safeguards as apply under the existing Article 10(5), thereby ensuring compliance with Article 9(2), point (g) of Regulation (EU) 2016/679 Article 10(2), point (g) of Regulation (EU) 2018/1725 of the European Parliament and of the Council and Article 10, point (a) of Directive (EU) 2016/680 of the European Parliament and of the Council.

(7)

In order to ensure consistency, avoid duplication and minimise administrative burdens in relation to the procedure for designating notified bodies under Regulation (EU) 2024/1689, while maintaining the same level of scrutiny, a single application and a single assessment procedure should be available for new conformity assessment bodies and notified bodies which are designated under the Union harmonisation legislation listed in Section A of Annex I to Regulation (EU) 2024/1689, such as under Regulations (EU) 2017/745 (9) and (EU) 2017/746 (10) of the European Parliament and of the Council, where such a procedure is established under that Union harmonisation legislation. The single application and assessment procedure aims at facilitating, supporting and expediting the designation procedure under Regulation (EU) 2024/1689, while ensuring compliance with the requirements applicable to notified bodies under that Regulation and the Union harmonisation legislation listed in Section A of Annex I thereto.

(8)

With a view to ensuring the smooth application and consistency of Regulation ( EU ) 2024/1689, amendments should be made to it. A technical correction to Article 43(3), first subparagraph, of Regulation (EU) 2024/1689 should be added to align the conformity assessment requirements with the requirements of providers of high-risk AI systems in Article 16 of that Regulation. Moreover, it should be clarified that where a provider of a high-risk AI system is subject to the conformity assessment procedure under Union harmonisation legislation listed in Section A of Annex I to Regulation (EU) 2024/1689, and the conformity assessment extends to compliance of the quality management system of that Regulation and of such Union harmonisation legislation, the provider should be able to include aspects related to quality management systems under that Regulation as part of the quality management systems under such Union harmonisation legislation, in line with Article 17(3) of Regulation (EU) 2024/1689. Article 43(3), second subparagraph, should be amended to clarify that notified bodies which have been notified under the Union harmonisation legislation listed in Section A of Annex I to Regulation (EU) 2024/1689 and which aim to assess high-risk AI systems covered by the Union harmonisation legislation listed in Section A of Annex I to that Regulation, should apply for the designation as a notified body under that Regulation within 18 months from [the entry into application of this Regulation]. This amendment is without prejudice to Article 28 of Regulation (EU) 2024/1689. Moreover, Regulation (EU) 2024/1689 should be amended to clarify that where a high-risk AI system is both covered by the Union harmonisation legislation listed in Section A of Annex I to Regulation (EU) 2024/1689 and falls within one of the use-cases listed in Annex III to that Regulation, the provider should follow the relevant conformity assessment procedure as required under that relevant harmonisation legislation.

(8)

deleted

(8a)

Regulation (EU) 2024/1689 and Regulation (EU) 2024/2847 complement each other so that the safety and cybersecurity of products with digital elements is ensured. It is necessary to ensure the alignment of Regulation (EU) 2024/1689 and Regulation (EU) 2024/2847, to allow for their smooth implementation. Where high-risk AI systems fulfil the essential cybersecurity requirements set out in Regulation (EU) 2024/2847, they should be deemed to comply with the cybersecurity requirements set out in Article 15 of Regulation (EU) 2024/1689 in so far as those requirements are covered by the EU declaration of conformity or parts thereof issued pursuant to Regulation (EU) 2024/2847.

(8b)

For the purposes of this Regulation, the fact that an AI system is integrated into, or operates within, a product subject to Union harmonisation legislation on product safety should not, in itself, imply that the AI system performs a safety function. An AI system should be regarded as performing a safety function only where its functioning is necessary to ensure that the product or the AI system complies with applicable Union safety requirements. By contrast, functionalities intended solely for user assistance, performance optimisation, service efficiency, automation, convenience, or quality control of non-safety-related aspects should not be regarded as safety functions under this Regulation, where their failure would not directly create risks to health or safety.

(9)

To streamline compliance and reduce the associated costs, providers of AI systems should not be required to register AI systems referred to in Article 6(3) of Regulation (EU) 2024/1689 in the EU database pursuant to Article 49(2) of that Regulation . Given that such systems are not considered high-risk under certain conditions where they do not pose significant risk of harm to the health, safety or fundamental rights of persons , imposing registration requirements would constitute a disproportionate compliance burden. Nevertheless , a provider who considers that an AI system falls under Article 6(3) remains obligated to document its assessment before that system is placed on the market or put into service. This assessment may be requested by national competent authorities.

(9)

To streamline compliance and reduce the associated costs, the registration of AI systems referred to in Article 6(3) of Regulation (EU) 2024/1689 in the EU database pursuant to Article 49(2) of that Regulation should be simplified by streamlining the required content in Section B of Annex VIII to that Regulation. While it remains crucial for effective market surveillance and public accountability that such AI systems are registered in the EU database, the registration requirements should be simplified and made more proportionate. This simplification will strike a better balance without undermining the protection laid down by Regulation (EU) 2024/1689. Such systems are not considered high-risk under certain conditions where they do not pose significant risk of harm to the health, safety or fundamental rights of persons . Furthermore , a provider applying Article 6(3) remains obligated to document its assessment before that system is placed on the market or put into service. This assessment may be requested by national competent authorities.

(10)

Articles 57, 58 and 60 of Regulation (EU) 2024/1689 should be amended to strengthen further cooperation at Union level of AI regulatory sandboxes, foster clarity and consistency in the governance of AI regulatory sandboxes, and to extend the scope of real-world testing outside AI regulatory sandboxes to high-risk AI systems covered by the Union harmonisation legislation listed in Annex I to that Regulation. In particular, to allow procedural simplification, where applicable, in the projects supervised in the AI regulatory sandboxes that include also real-world testing, the real-world testing plan should be integrated in the sandbox plan agreed by the providers or prospective providers and the competent authority in a single document. In addition, it is appropriate to provide for the possibility of the AI Office to establish an AI regulatory sandbox at Union level for AI systems that are covered by Article 75(1) of Regulation (EU) 2024/1689. By leveraging these infrastructures and facilitating cross-border collaboration, coordination would be better streamlined and resources optimally utilised.

(10)

Articles 57, 58 and 60 of Regulation (EU) 2024/1689 should be amended to strengthen further cooperation at Union level of AI regulatory sandboxes, foster clarity and consistency in the governance of AI regulatory sandboxes, and to extend the scope of real-world testing outside AI regulatory sandboxes to high-risk AI systems covered by the Union harmonisation legislation listed in Annex I to that Regulation. In particular, to allow procedural simplification, where applicable, in the projects supervised in the AI regulatory sandboxes that include also real-world testing, the real-world testing plan should be integrated in the sandbox plan agreed by the providers or prospective providers and the competent authority in a single document. In addition, it is appropriate to provide for the possibility of the AI Office to establish an AI regulatory sandbox at Union level for AI systems that are covered by Article 75(1) of Regulation (EU) 2024/1689. When discussions are held within the framework of the Board, the European Data Protection Supervisor and the AI Office, as part of their roles within the board, should provide feedback and exchange best practices on matters related to the establishment and operation of AI regulatory sandboxes that were established under their respective competences. By leveraging these infrastructures and facilitating cross-border collaboration, coordination would be streamlined and resources optimally utilised. In order to foster innovation and facilitate the uptake of AI, SMEs, including startups, and SMCs should be provided with priority access to the AI regulatory sandboxes established by the AI Office.

(11)

To foster innovation, it is also appropriate to extend the scope of real-world testing outside AI regulatory sandboxes in Article 60 of Regulation (EU) 2024/1689, currently applicable to high-risk AI systems listed in Annex III to that Regulation, and allow providers and prospective providers of high-risk AI systems covered by the Union harmonisation legislation listed in Annex I to that Regulation to also test such systems in real-world conditions. This is without prejudice to other Union or national law on the testing in real-world conditions of high-risk AI systems related to products covered by that Union harmonisation legislation. To address the specific situation of high-risk AI systems covered the Union harmonisation legislation listed in Section B of Annex I to that Regulation, it is necessary to allow the conclusion of voluntary agreements between the Commission and Member States to enable testing of such high-risk AI systems in real-world conditions.

(11)

To foster innovation, it is also appropriate to extend the scope of real-world testing outside AI regulatory sandboxes in Article 60 of Regulation (EU) 2024/1689, currently applicable to high-risk AI systems listed in Annex III to that Regulation, and allow providers and prospective providers of high-risk AI systems covered by the Union harmonisation legislation listed in Annex I to that Regulation to also test such systems in real-world conditions. This is without prejudice to other Union or national law on the testing in real-world conditions of high-risk AI systems related to products covered by that Union harmonisation legislation. To address the specific situation of high-risk AI systems covered the Union harmonisation legislation listed in Section B of Annex I to that Regulation, it is necessary to allow the conclusion of voluntary agreements between the Commission and Member States to enable testing of such high-risk AI systems in real-world conditions , subject to sufficient safeguards .

(12a)

In order to allow the AI Office to effectively exercise its duties under Regulation (EU) 2024/1689 and in light of the new powers conferred on it by this Regulation, adequate human, financial and technical resources should be provided, without prejudice to the budgetary procedure and existing financial instruments. In particular, the AI Office should have a sufficient number of personnel whose expertise include an in-depth understanding of AI technologies.

(13)

Article 69 of Regulation (EU) 2024/1689 should be amended to simplify the fee structure of the scientific panel. If Member States call upon the panel’s expertise, the fees they may be required to pay the experts should be equivalent to the remuneration the Commission is obliged to pay in similar circumstances. Furthermore, to reduce the procedural complexity, Member States should be able to consult the experts of the scientific panel directly, without involvement of the Commission.

(13)

Article 69 of Regulation (EU) 2024/1689 should be amended to simplify the fee structure of the scientific panel. If Member States call upon the panel’s expertise, the fees they may be required to pay the experts should be equivalent to the remuneration the Commission is obliged to pay in similar circumstances.

(14)

In order to strengthen the governance system for AI systems based on general-purpose AI models, it is necessary to clarify the role of the AI Office in monitoring and supervising compliance of such AI systems with Regulation (EU) 2024/1689, while excluding AI systems related to products covered by the Union harmonisation legislation listed in Annex I to that Regulation. While sectoral authorities continue to remain responsible for the supervision of AI systems related to products covered by that Union harmonisation legislation, Article 75(1) Regulation (EU) 2024/1689 should be modified to bring all AI systems based on general-purpose AI models developed by the same provider within the scope of the AI Office's supervision. This does not include AI systems placed on the market, put into service or used by Union institutions, bodies, offices or agencies, which are under the supervision of the European Data Protection Supervisor pursuant to Article 74(9) of Regulation (EU) 2024/1689. To ensure effective supervision for those AI systems in accordance with the tasks and responsibilities assigned to market surveillance authorities under Regulation (EU) 2024/1689, the AI Office should be empowered to take the appropriate measures and decisions to adequately exercise its powers provided for in that Section and Regulation (EU) 2019/1020 of the European Parliament and of the Council (11). Article 14 of Regulation (EU) 2019/1020 should apply mutatis mutandis. Furthermore, to ensure effective enforcement, the authorities involved in the application of Regulation (EU) 2024/1689 should cooperate actively in the exercise of those powers, in particular where enforcement actions need to be taken in the territory of a Member State.

(14)

In order to strengthen the governance system for AI systems based on general-purpose AI models, it is necessary to clarify the role of the AI Office in monitoring and supervising compliance of such AI systems with Regulation (EU) 2024/1689, while excluding AI systems related to products covered by the Union harmonisation legislation listed in Annex I and AI systems referred to in Annex III, point 2 to that Regulation. While sectoral authorities continue to remain responsible for the supervision of AI systems related to products covered by that Union harmonisation legislation, Article 75(1) Regulation (EU) 2024/1689 should be modified to bring all AI systems based on general-purpose AI models developed by the same provider within the scope of the AI Office's supervision. This does not include AI systems placed on the market, put into service or used by Union institutions, bodies, offices or agencies, which are under the supervision of the European Data Protection Supervisor pursuant to Article 74(9) of Regulation (EU) 2024/1689. To ensure effective supervision for those AI systems in accordance with the tasks and responsibilities assigned to market surveillance authorities under Regulation (EU) 2024/1689, the AI Office should take the appropriate measures and decisions to adequately exercise its powers provided for in that Section and Regulation (EU) 2019/1020 of the European Parliament and of the Council (11). Article 14 of Regulation (EU) 2019/1020 should apply mutatis mutandis. Furthermore, to ensure effective enforcement, the authorities involved in the application of Regulation (EU) 2024/1689 should cooperate actively in the exercise of those powers, in particular where enforcement actions need to be taken in the territory of a Member State.

(16)

To further operationalise the AI Office’s supervision and enforcement set out in Article 75(1) of Regulation (EU) 2024/1689, it is necessary to further define the which of the powers listed in Article 14 of Regulation (EU) 2019/1020 should be conferred upon the AI Office. The Commission should therefore be empowered to adopt implementing acts to specify those powers, including the ability to impose penalties, such as fines or other administrative sanctions, in accordance with the conditions and ceilings referred to in Article 99, and applicable procedures. This should ensure that the AI Office has the necessary tools to effectively monitor and supervise compliance with Regulation (EU) 2024/1689.

(16)

To further operationalise the AI Office’s supervision and enforcement set out in Article 75(1) of Regulation (EU) 2024/1689, it is necessary to further define which of the powers listed in Article 14 of Regulation (EU) 2019/1020 should be conferred upon the AI Office. The Commission should therefore be empowered to adopt implementing acts to specify those powers, including the ability to impose penalties, such as fines or other administrative sanctions, in accordance with the conditions and ceilings referred to in Article 99, and applicable procedures. This should ensure that the AI Office has the necessary tools to effectively monitor and supervise compliance with Regulation (EU) 2024/1689.

(18)

To enable access to Union market for AI systems which are under the supervision by the AI Office pursuant to Article 75 of Regulation (EU) 2024/1689 and subject to third party conformity assessment, the Commission should be enabled to carry out pre-market conformity assessments of those systems.

(18)

To enable access to Union market for AI systems which are under the supervision by the AI Office pursuant to Article 75 of Regulation (EU) 2024/1689 and subject to third party conformity assessment, the Commission should ensure that pre-market conformity assessments are carried out for those systems. Furthermore, the AI Office should maintain organised records of communications with providers and deployers of general-purpose AI models with systemic risk. Such records should be documented in a consistent manner.

(19)

Article 77 and related provisions of Regulation (EU) 2024/1689 constitute an important governance mechanism, as they aim to enable authorities or bodies responsible for enforcing or supervising Union law intended to protect fundamental rights to fulfil their mandate under specific conditions and to foster cooperation with market surveillance authorities responsible for the supervision and enforcement of that Regulation. It is necessary to clarify the scope of such cooperation, as well as to clarify which public authorities or bodies benefit from it. With a view to reinforcing the cooperation, it should be clarified that requests to access information and documentation should be made to the competent market surveillance authority, which should respond to such requests, and that the involved authorities or bodies should have a mutual obligation to cooperate.

(19)

Article 77 and related provisions of Regulation (EU) 2024/1689 constitute an important governance mechanism, as they aim to enable authorities or bodies responsible for enforcing or supervising Union law intended to protect fundamental rights to fulfil their mandate under specific conditions and to foster cooperation with market surveillance authorities responsible for the supervision and enforcement of that Regulation. It is necessary to clarify the scope of such cooperation, as well as to clarify which public authorities or bodies benefit from it. With a view to reinforcing the cooperation, it should be clarified that requests to access information and documentation should be made to the competent market surveillance authority, which should respond to such requests without undue delay , and that the involved authorities or bodies should have a mutual obligation to cooperate. It should be clarified that these provisions are without prejudice to the tasks, powers and independence of the relevant national public authorities or bodies under their mandates. In particular, those provisions do not limit any powers that those authorities and bodies have to request information pursuant to other Union or national law. Accordingly, those authorities and bodies retain any power they have to directly request information from operators pursuant to their mandate or other law.

(20)

To allow sufficient time for providers of generative AI systems subject to the marking obligations laid down in Article 50(2) of Regulation (EU) 2024/1689 to adapt their practices within a reasonable time without disrupting the market, it is appropriate to introduce a transitional period of 6 months for providers who have already placed their systems on the market before the 2 August 2026.

(20)

To allow sufficient time for providers of generative AI systems subject to the marking obligations laid down in Article 50(2) of Regulation (EU) 2024/1689 to adapt their practices within a reasonable time without disrupting the market, it is appropriate to introduce a transitional period of 3 months for providers who have already placed their systems on the market before the 2 August 2026.

(22)

Article 113 of Regulation (EU) 2024/1689 establishes the dates of entry into force and application of that Regulation, notably that the general date of application is 2 August 2026. For the obligations related to high-risk AI systems laid down in Sections 1, 2 and 3 of Chapter III of Regulation (EU) 2024/1689, the delayed availability of standards, common specifications, and alternative guidance and the delayed establishment of national competent authorities lead to challenges that jeopardise those obligation’s effective entry into application and that risk to significantly increase implementation costs in a way that does not justify maintaining their initial date of application, namely 2 August 2026. Building on experience, it is appropriate to put in place a mechanism that links the entry into application to the availability of measures in support of compliance with Chapter III, which may include harmonised standards, common specifications, and Commission guidelines. This should be confirmed by the Commission by decision, following which the rules obligations for high-risk AI systems should apply after 6 months as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III and after 12 months as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I to Regulation (EU) 2024/1689 . However, this flexibility should only be extended until 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III and until 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I to that Regulation , by which dates those rules should enter into application in any case . The distinction between the entry into application of the rules as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III and Article 6(1) and Annex I to that Regulation is consistent with the difference between the initial dates of application envisaged in Regulation (EU) 2024/1689 and aims to provide the necessary time for adaptation and implementation of the corresponding obligations.

(22)

Article 113 of Regulation (EU) 2024/1689 establishes the dates of entry into force and application of that Regulation, notably that the general date of application is 2 August 2026. For the obligations related to high-risk AI systems laid down in Sections 1, 2 and 3 of Chapter III of Regulation (EU) 2024/1689, the delayed availability of standards, common specifications, and alternative guidance and the delayed establishment of national competent authorities lead to challenges that jeopardise those obligation’s effective entry into application and that risk to significantly increase implementation costs in a way that does not justify maintaining their initial date of application, namely 2 August 2026. It is appropriate that the date of application of obligations on AI systems classified as high-risk pursuant to Article 6(2) and Annex III and on AI systems classified as high-risk pursuant to Article 6(1) and Annex I to Regulation (EU) 2024/1689 is postponed until 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III and until 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I to that Regulation. The distinction between the entry into application of the rules as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III and Article 6(1) and Annex I to that Regulation is consistent with the difference between the initial dates of application envisaged in Regulation (EU) 2024/1689 and aims to provide the necessary time for adaptation and implementation of the corresponding obligations.

(22a)

In order to ensure legal certainty and to avoid further delays in application of this Regulation, the Commission should ensure that measures in support of compliance with regard to Chapter III, Sections 1, 2, and 3 are in place in due time to ensure timely and effective implementation of the necessary provisions.

(23)

In light of the objective to reduce implementation challenges for citizens, businesses and public administrations, it is essential that harmonised conditions for the implementation of certain rules are adopted only where strictly necessary. For that purpose, it is appropriate to remove certain empowerments bestowed on the Commission to adopt such harmonised conditions by means of implementing acts in cases where those conditions are not met. Regulation (EU) 2024/1689 should therefore be amended to remove the empowerments conferred on the Commission in Article 50(7), Article 56(6), and Article 72(3) thereof to adopt implementing acts. The removal of the empowerment to adopt a harmonised template for a post-market monitoring plan in Article 72(3) of Regulation (EU) 2024/1689 has as an additional benefit that it will offer more flexibility for providers of high-risk AI systems to put in place a system for post-market monitoring that is tailored to their organisation. At the same time, recognising the need to offer clarity how providers of high-risk AI systems are required to comply, the Commission should be required to publish guidance.

(23)

In light of the objective to reduce implementation challenges for citizens, businesses and public administrations, it is essential that harmonised conditions for the implementation of certain rules are adopted only where strictly necessary. For that purpose, it is appropriate to remove certain empowerments bestowed on the Commission to adopt such harmonised conditions by means of implementing acts in cases where those conditions are not met. Regulation (EU) 2024/1689 should therefore be amended to remove the empowerments conferred on the Commission in Article 50(7), Article 56(6), and Article 72(3) thereof to adopt implementing acts. At the same time, recognising the need to offer clarity how providers of high-risk AI systems are required to comply with their monitoring obligations , the Commission should be required to publish guidance on the post-market monitoring plan, including a template with elements to be included therein, by 2 February 2027 .

(23a)

The parallel application of sectoral Union harmonisation legislation listed in Section A of Annex I to Regulation (EU) 2024/1689 of the European Parliament and of the Council and the requirements set out in that Regulation for high-risk artificial intelligence systems may lead to overlaps of requirements and unnecessary administrative burden for economic operators. Such overlaps could create legal uncertainty, increase compliance costs and potentially lead to competitive disadvantages, without providing additional benefits for the protection of health, safety or fundamental rights. In order to ensure a more coherent and proportionate regulatory framework and to simplify the application of requirements for artificial intelligence systems embedded in products regulated under Union harmonisation legislation, the references to the Union harmonisation legislation currently listed in Section A of Annex I to Regulation (EU) 2024/1689 should therefore be moved to Section B of that Annex. This approach clarifies that artificial intelligence systems integrated into products covered by those sectoral acts are subject to the requirements of this Regulation where relevant, while allowing the conformity assessment procedures and product safety requirements under the respective sectoral legislation to remain the primary framework. Any remaining gaps relating to artificial intelligence systems integrated into such products should be addressed within the relevant sectoral legislation.

(23b)

In order to safeguard the horizontal nature of this Regulation and ensure the proper functioning of the internal market, the relevant requirements laid down in Chapter III, Section 2 of this Regulation should be deemed to constitute essential health and safety requirements for high-risk AI systems covered by Union harmonisation legislation listed in Annex I and should be applied in a consistent and coherent manner across those sectoral frameworks. For this purpose, the Commission should be entitled to adopt delegated acts taking into account the requirements set out in Chapter III, Section 2 of this Regulation as regards their application to AI systems falling within its scope as well as relevant harmonised standards. In doing so, the Commission should not go beyond the requirements laid down in Regulation (EU) 2024/1689 for this purpose and should take into account the specific context of sectorial legislation. Before adopting the acts referred to in the first subparagraph, the Commission should conduct open and transparent consultations with relevant stakeholders, including competent authorities, notified bodies, civil society and industry.

(25a)

When implementing and enforcing this Regulation, national competent authorities, the AI office and the Commission should take into account the objectives set out in Article 1(1) of Regulation (EU) 2024/1689 and follow the principles of necessity, proportionality, legal certainty and technological neutrality, while at the same time ensuring that unnecessary administrative and compliance burdens are minimised.

(1b)

The Commission and the Member States shall encourage and support AI literacy in society and among the general population and support, facilitate and complement the efforts of providers and deployers of AI systems, in particular SMEs, for example via the creation of Public Private Partnerships in fulfilling their obligation under paragraph 1.;

(a)

processing is necessary to ensure bias detection and correction in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited under Union law, especially where data outputs influence inputs for future operations; and

(b)

all of the conditions and safeguards set out in paragraph 1 are applied.

(5a)

in Article 5, paragraph 1, subparagraph 1 the following point is added:

(ha)

the placing on the market, the putting into service or the use of an AI system that alters, manipulates or artificially generates realistic images or videos so as to depict sexually explicit activities or the intimate parts of an identifiable natural person, without that person’s consent.

(5b)

Article 6(1) is amended as follows:

(a)

the AI system is intended to be used as a safety component of a product, or the AI system is itself a product, covered by the Union harmonisation legislation listed in Annex I;

(a)

the AI system is intended to be used as a safety component of a product and whose functioning is necessary to ensure that the product or AI system complies with applicable Union safety requirements , or the AI system is itself a product, covered by the Union harmonisation legislation listed in Annex I;

(b)

the product whose safety component pursuant to point (a) is the AI system, or the AI system itself as a product, is required to undergo a third-party conformity assessment, with a view to the placing on the market or the putting into service of that product pursuant to the Union harmonisation legislation listed in Annex I.

(b)

the product whose safety component pursuant to point (a) is the AI system, or the AI system itself as a product, is required to undergo a third-party conformity assessment, with a view to the placing on the market or the putting into service of that product pursuant to the Union harmonisation legislation listed in Annex I. "

(5c)

In Article 6, paragraph 1a is added:

(6)

in Article 6, paragraph 4 is replaced by the following:

(9a)

Article 25(2) is replaced by the following:

(a)

the provision of technical documentation sufficient to assess compliance with Article 16 requirements;

(b)

the disclosure of known limitations and failure modes that could affect high-risk applications;

(c)

the provision of reasonable technical access for testing and validation purposes.

(9b)

in Article 27, paragraph 4 is replaced by the following:

(10)

in Article 28, the following paragraph 8 is added:

(12a)

In Article 42, the following paragraph is inserted:

(13)

in Article 43, paragraph 3 is replaced by the following:

(14)

in Article 49, paragraph 2 is deleted;

(d)

the detailed rules applicable to the governance of AI regulatory sandboxes covered under Article 57, including as regards the exercise of the tasks of the competent authorities and the coordination and cooperation at national and EU level.;

(d)

the detailed rules applicable to the governance of AI regulatory sandboxes covered under Article 57, including as regards the exercise of the tasks of the competent authorities , the involvement and supervision by the competent data protection authorities and the coordination and cooperation at national and EU level.;

(21a)

In Article 64, paragraph 2a is added:

(b)

paragraph 3 is deleted.

(ba)

in Article 75, paragraph -1a is inserted:

(c)

the following paragraph 1a and 1b are inserted:

(c)

the following paragraph 1a , 1b and 1ba are inserted:

(28)

in Article 96(1), the second subparagraph is replaced by the following:

(28)

in Article 96(1), point (a) and the second subparagraph are replaced by the following:

(a)

the application of the requirements and obligations referred to in Articles 8 to 15 and in Article 25;

(a)

the application of the requirements and obligations referred to in Articles 8 to 15 and in Article s 25 and 26;

-1a.

in Article 96, paragraph 1, subparagraph 1, the following point is inserted:

‘(fa)

the application of the obligations referred to in Article 27, including the possibility to reference or include relevant sections or parts of the data protection impact assessment into the fundamental rights impact assessment pursuant to Article 27(4) of this Regulation, using, where relevant, standardised templates.’

(aa)

in paragraph 4 the following point (da) is inserted:

‘(da)

obligations of providers and third parties, including providers of general purpose AI models, pursuant to Article 25(2), (3) and (4);’

(29a)

The following articles: Article 110a – Article 110l are inserted:

(i)

6 months after the adoption of that decision as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III, and

(ii)

12 months after the adoption of the decision as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I.

(31 a)

In Annex I, Section A is deleted

(31b)

In Annex I, Section B, the following points are added:

(32)

in Annex VIII, section B is deleted;

(32)

in Annex VIII, section B , points 7 and 9 are deleted;