Regulators & Authorities's obligations

must notify the Commission and the other Member States of each conformity assessment body

must provide full details of the conformity assessment activities, the conformity assessment module or modules, the types of AI systems concerned, and the relevant attestation of competence

must provide documentary evidence which attests to the competence of the conformity assessment body and to the arrangements in place to ensure that that body will be monitored regularly and will continue to satisfy the requirements laid down in Article 31

must ensure that competent authorities allocate sufficient resources to comply with this Article effectively and in a timely manner.

must provide guidance, supervision and support within the AI regulatory sandbox.

must provide providers and prospective providers participating in the AI regulatory sandbox with guidance on regulatory expectations and how to fulfil the requirements and obligations set out in this Regulation.

must provide a written proof of the activities successfully carried out in the sandbox upon request.

must provide an exit report detailing the activities carried out in the sandbox and the related outcomes.

must ensure that national data protection authorities and other national or competent authorities are associated with the operation of the AI regulatory sandbox and involved in the supervision of those aspects to the extent of their respective tasks and powers.

must have the power to temporarily or permanently suspend the testing process, or the participation in the sandbox if no effective mitigation is possible, and inform the AI Office of such decision.

must inform the AI Office and the Board of the establishment of a sandbox.

must submit annual reports to the AI Office and to the Board.

Deadline: from one year after the establishment of the AI regulatory sandbox and every year thereafter until its termination

must make annual reports or abstracts thereof available to the public, online.

must approve the testing in real world conditions and the real-world testing plan.

Deadline: within 30 days

must provide SMEs, including start-ups, with priority access to the AI regulatory sandboxes.

must organise specific awareness raising and training activities on the application of this Regulation tailored to the needs of SMEs including start-ups, deployers and, as appropriate, local public authorities.

must utilise existing dedicated channels and where appropriate, establish new ones for communication with SMEs including start-ups, deployers, other innovators and, as appropriate, local public authorities to provide advice and respond to queries about the implementation of this Regulation.

must facilitate the participation of SMEs and other relevant stakeholders in the standardisation development process.

must establish or designate at least one notifying authority and at least one market surveillance authority as national competent authorities.

must communicate to the Commission the identity of the notifying authorities and the market surveillance authorities and the tasks of those authorities.

must make publicly available information on how competent authorities and single points of contact can be contacted through electronic communication means.

Deadline: by 2 August 2025

must designate a market surveillance authority to act as the single point of contact for this Regulation.

must notify the Commission of the identity of the single point of contact.

must ensure that their national competent authorities are provided with adequate technical, financial and human resources, and with infrastructure to fulfil their tasks effectively.

must assess and, if necessary, update competence and resource requirements on an annual basis.

must act in accordance with the confidentiality obligations set out in Article 78.

must report to the Commission by 2 August 2025, and once every two years thereafter.

Deadline: by 2 August 2025, and once every two years thereafter

must request and access any documentation created or maintained under this Regulation

must identify the public authorities or bodies and make a list of them publicly available

Deadline: by 2 November 2024

must notify the list to the Commission and to the other Member States

Deadline: by 2 November 2024

must make a reasoned request to the market surveillance authority to organise testing of the high-risk AI system

must organise the testing with the close involvement of the requesting public authority or body

Deadline: within a reasonable time following the request

must carry out an evaluation of the AI system concerned in respect of its compliance with all the requirements and obligations laid down in this Regulation

must require the relevant operator to take all appropriate corrective actions to bring the AI system into compliance, to withdraw the AI system from the market, or to recall it

Deadline: within the shorter of 15 working days, or as provided for in the relevant Union harmonisation legislation

must take all appropriate provisional measures to prohibit or restrict the AI system’s being made available on its national market or put into service, to withdraw the product or the standalone AI system from that market or to recall it.

must notify the Commission and the other Member States of those measures without undue delay.

Deadline: without undue delay

must provide all available details, in particular the information necessary for the identification of the non-compliant AI system, the origin of the AI system and the supply chain, the nature of the non-compliance alleged and the risk involved, the nature and duration of the national measures taken and the arguments put forward by the relevant operator.

must inform the Commission and the other Member States of any measures adopted and of any additional information at their disposal relating to the non-compliance of the AI system concerned, and, in the event of disagreement with the notified national measure, of their objections.

Deadline: without undue delay

must carry out an evaluation of the AI system concerned in respect of its classification as a high-risk AI system.

must require the relevant provider to take all necessary actions to bring the AI system into compliance with the requirements and obligations laid down in this Regulation.

Deadline: within a period the market surveillance authority may prescribe

must inform the Commission and the other Member States of the results of the evaluation and of the actions which it has required the provider to take.

Deadline: without undue delay