1Recital 36 and Article 5(4): Receive and register each notification about the use of a ‘real-time’ remote biometric identification system in publicly accessible spaces for law enforcement purposes on national level.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.2Recital 53 and Article 6(3-8): Request and receive the documentation and assessment from a provider, who considers that his or her AI system is not high-risk based on the conditions referred to in Article 6(3).General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.3Recital 81 and Article 20(2): Receive and register a notification from a provider that becomes aware that the high-risk AI system presents a risk within the meaning of Article 79(1).General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.4Recital 82 and Article 22: Request and register a copy of the mandate from the authorised representative.
Receive as well notifications from the authorised representative that the mandate was terminated because he or she considered or had reason to consider that the provider was acting contrary to its obligations pursuant to the AI Act.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.5Recital 83 and Article 23: Receive notifications from the importer, who has sufficient reason to consider that a high-risk AI system is not in conformity with the AI Act, is falsified, or accompanied by falsified documentation and where the high-risk AI system presents a risk within the meaning of Article 79(1).General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.6Recital 91 – 95 and Article 26(5): Receive and register a notification from the deployer, where he or she has the reason to consider that the use of the high-risk AI system in accordance with the instructions may result in a situation, in which the AI system presents a risk within the meaning of Article 79(1) or where the deployer has identified a serious incident.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.7Recital 91 – 95 and Article 26(10): Request and register a notification in the relevant police file from the deployer about uses of a high-risk AI system for post-remote biometric identification.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.8Recital 96 and Article 27(3): Receive and register notification from deployers with regard to their fundamental rights impact assessment.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.9Recital 126 and Article 29–31: Receive and assess an application for notification from a conformity assessment body. Only notify those conformity assessment bodies that are meeting the requirements of Article 31.
Provide the required documentation and inform the Commission and the other Member States, using the electronic notification tool if it was decided to notify the conformity assessment body. Other Member States can object to the notification procedure according to Article 30(4/5).Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.10Recital 126 and Article 33(4): Receive and assess the relevant documents concerning the assessment of the qualifications of the subcontractor or the subsidiary and the work carried out by them under the AI Act.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.11Recital 126 and Article 34(3): Receive and assess the relevant documentation, including the providers’ documentation, to allow conducting an assessment, designation, notification and monitoring activities, and to facilitate the assessment outlined in Art 29-39.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.12Recital 126 and Article 36: Notify the Commission and the other Member States of any relevant changes to the notification of a notified body via the electronic notification tool referred to in Article 30(2).
Withdraw the designation where the notified body has ceased its activity or investigate where there is sufficient reason to consider that the notified body no longer meets the requirements laid down in Article 31, or that it is failing to fulfil its obligations. Where it is concluded that the notified body no longer meets the requirements laid down in Article 31 or that it is failing to fulfil its obligations, the designation should be restricted, suspended or withdrawn as appropriate, depending on the seriousness of the failure to meet the requirements or fulfil the obligations.
In that case, assess the impact on issued certificates and submit a report to the Commission and other Member States. Require the suspension of certificates and inform the Commission and other Member States, providing documentation.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.13Recital 126 and Article 37: Provide the Commission, on request, with all relevant information relating to the notification or the maintenance of the competence of the notified body concerned.
Receive and assess the findings of the Commission on the notified body that does not meet the requirements for notification. Take the necessary corrective measures, including the suspension or withdrawal of the notification if necessary.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.14Recital 126 and Article 38: Ensure that the bodies that have been notified, participate in the work of the group referred to in Article 38(1), directly or through designated representatives.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.15Recital 121 and Article 41(6): Inform the Commission with a detailed explanation if it was assessed that the common specification does not meet the requirements of section 2 and 3 of the high-risk chapter.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.16Article 45(1): Request and assess the information provided by notified bodies based on Article 45(1).General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.17Recital 130 and Article 46: Authorize the placing on the market or the putting into service of AI systems, which have not undergone a conformity assessment, but only if exceptional reasons apply (e.g. public security or protection of life and health of natural persons, environmental protection and the protection of key industrial and infrastructural assets). Inform the Commission and the other Member States of any authorization that has been issued. Withdraw the derogation if the Commission considers the authorization unjustified.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.18Article 47(1): Receive and register the copy of the EU declaration of conformity submitted by providers.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.19Recital 101 and Article 53(1a): Request the technical documentation from the provider of a GPAI model.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.20Recital 115 and Article 55(1c): Receive the notification from the provider of a systemic GPAI model if the development or use of the model causes a serious incident, including information on the incident and on possible corrective measures.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.21Recital 137 / 138 and Article 57(6): Provide, as appropriate, guidance, supervision and support within the AI regulatory sandbox with a view to identifying risks, in particular to fundamental rights, health and safety, testing, mitigation measures, and their effectiveness in relation to the obligations and requirements of this Regulation and, where relevant, other Union and national law supervised within the sandbox.
Provide guidance on regulatory expectations and how to fulfil the requirements and obligations set out in the AI Act to providers and prospective providers that are participating in the AI regulatory sandbox.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.22Recital 137 / 138 and Article 57(7): Provide to the provider a written proof of the activities successfully carried out in the sandbox. Provide also exit reports (detailing the activities carried out in the sandbox and the related results and learning outcomes). If both the provider or prospective provider and the national competent authority explicitly agree, the exit report may be made publicly available through the single information platform referred to in Article 57.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.23Recital 137 / 138 and Article 57(10): Ensure that, to the extent the innovative AI systems involve the processing of personal data or otherwise fall under the supervisory remit of other national authorities or competent authorities providing or supporting access to data, the national data protection authorities and those other national or competent authorities are associated with the operation of the AI regulatory sandbox and involved in the supervision of those aspects to the extent of their respective tasks and powers.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.24Recital 137 / 138 and Article 57(11): React on significant risks identified during the development and testing of AI systems by requesting adequate mitigation and, failing that, initiate the suspension of the development and testing process, temporarily or permanently. Inform the AI Office of such decision.
Exercise the supervisory powers within the limits of the relevant law, using the discretionary powers when implementing legal provisions in respect of a specific AI regulatory sandbox project, with the objective of supporting innovation in AI in the Union.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.25Recital 137 / 138 and Article 57(14): Coordinate the activities and cooperate within the framework of the Board with other Member States.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.26Recital 139 and Article 58(4): Specifically agree the terms and conditions of real-world testing and, in particular, the appropriate safeguards with the participants, with a view to protecting fundamental rights, health and safety, before authorising it under supervised conditions within the framework of an AI regulatory sandbox. Cooperate with other national competent authorities with a view to ensuring consistent practices across the Union.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.27Recital 140 and Article 59: Assess the safeguards and cooperate with providers and prospective providers in the AI regulatory sandbox that want to use personal data, including by issuing guidance and monitoring the mitigation of any identified significant risks to safety, health, and fundamental rights that may arise during the development, testing and experimentation in that sandbox.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.28Recital 141 and Article 60(4): Require from providers and prospective providers to provide information including their real-world testing plans before the activities by the provider are conducted. If adequate, approve the testing in real world conditions and the real- world testing plan. Decide on extending the testing under real world conditions after six months for maximum an additional period of six months, subject to prior notification by the provider or prospective provider, accompanied by an explanation of the need for such an extension.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.29Recital 141 and Article 60(6): Carry out unannounced remote or on-site inspections, and perform checks on the conduct of the testing in real world conditions and the related high-risk AI systems. Use those powers to ensure the safe development of testing in real world conditions.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.30Recital 141 and Article 60(7/8): Receive and access notifications on serious incident identified in the course of the testing in real world conditions by the provider. Receive and assess the notification on the suspension or termination and of the final outcome of the testing in real world conditions by providers or prospective providers.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.31Recital 143 and Article 62(1a): Provide SMEs, including start-ups, that have a registered office or a branch in the Union, with priority access to the AI regulatory sandboxes provided that they fulfil the eligibility conditions and selection criteria and without precluding other providers and prospective providers to access the sandboxes provided the same conditions and criteria are fulfilled.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.32Recital 143 and Article 62(1b/c): Organise specific awareness raising and training activities on the application of the AI Act tailored to the needs of SMEs including start-ups, deployers and, as appropriate, local public authorities.
Utilise existing channels and where appropriate, establish new dedicated channels for communication with SMEs, including start-ups, deployers, other innovators and, as appropriate, local public authorities, to support SMEs throughout their development path by providing guidance and responding to queries about the implementation of this Regulation. Where appropriate, these channels should work together to create synergies and ensure homogeneity in their guidance to SMEs, including start-ups, and deployers.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.33Recital 143 and Article 62(1d): Facilitate the participation of SMEs and other relevant stakeholders in the standardisation development processes.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.34Recital 149 and Article 66(o): Send opinions to the AI Board on qualified alerts regarding GPAI models, and on national experiences and practices on the monitoring and enforcement of AI systems, in particular systems integrating the general-purpose AI models.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.35Recital 151 and Article 68 / 69: Request support from the pool of experts constituting the scientific panel for the enforcement activitiesRule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.36Recital 153 / 54 and Article 70(5): Act in accordance with the confidentiality obligations set out in Article 78, when performing its tasks.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.37Recital 153 / 154 and 70(8): Provide guidance and advice on the implementation of the AI Act, in particular to SMEs including start-ups, taking into account the guidance and advice of the AI Board and the Commission, as appropriate. Whenever guidance and advice with regard to an AI system in areas covered by other Union law is provided, the national competent authorities under that Union law shall be consulted, as appropriate.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.38Recital 155 and Article 73: Receive the reports on serious incidents from providers of high-risk AI systems. Inform the national public authorities or bodies referred to in Article 77(1), when receiving a notification related to a serious incident referred to in Article 3, point (49)(c).
Take appropriate measures, as provided for in Article 19 of Regulation (EU) 2019/1020, within seven days from the date of receiving the notification referred to in Article 73(1) and follow the notification procedures as provided in that Regulation.
Immediately notify the Commission of any serious incident, whether or not they have taken action on it, in accordance with Article 20 of Regulation (EU) 2019/1020.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.39Recital 156 / 160 and Article 74(11-14): Propose joint activities, including joint investigations, to be conducted by market surveillance authorities or market surveillance authorities jointly with the Commission, that have the aim of promoting compliance, identifying non- compliance, raising awareness and providing guidance in relation to this Regulation with respect to specific categories of high-risk AI systems that are found to present a serious risk across two or more Member States. Joint activities to promote compliance should be carried out in accordance with Article 9 of Regulation (EU) 2019/1020.
If necessary, request full access by providers to the documentation as well as the training, validation and testing data sets used for the development of high-risk AI systems, including, where appropriate and subject to security safeguards, through application programming interfaces (API) or other relevant technical means and tools enabling remote access. Request to access the source code of the high-risk AI system if the access to source code is necessary to assess the conformity of a high-risk AI system with the requirements set out in Chapter III, Section 2 and testing or auditing procedures and verifications based on the data and documentation provided by the provider have been exhausted or proved insufficient.
Treat any information or documentation obtained in accordance with the confidentiality obligations set out in Article 78.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.40Recital 161 and Article 75(2/3): Cooperate with the AI Office to carry out evaluations of compliance and inform the Board and other market surveillance authorities accordingly in case there is a GPAI system that can be used directly by deployers for at least one purpose that is classified as high-risk and there are sufficient reasons to consider that it is non-compliant.
Request assistance from the AI Office where the national level is unable to conclude an investigation on a high-risk AI system because of its inability to access certain information related to the GPAI model on which the high-risk AI system is built. In such cases, the procedure regarding mutual assistance in cross-border cases in Chapter VI of Regulation (EU) 2019/1020 should apply mutatis mutandis.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.41Article 76: Ensure that testing in real world conditions is in accordance with the AI Act. Verify that the testing in real world conditions is conducted in compliance with Article 60. Option to allow the testing in real world conditions to be conducted by the provider or prospective provider, in derogation from the conditions set out in Article 60(4), points (f) and (g).
Suspend or terminate the testing or require modifications if informed of a serious incident or there are other grounds for considering that the conditions set out in Articles 60 and 61 are not met.
Indicate the grounds for a decision or rejection and how the provider or prospective provider can challenge the decision or objection. Communicate the grounds therefor to the market surveillance authorities of other Member States in which the AI system has been tested in accordance with the testing plan.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.42Recital 157 and Article 77: Request and access any documentation created or maintained under the AI Act in accessible language and format when access to that documentation is necessary for effectively fulfilling the mandates within the limits of their jurisdiction. The relevant public authority or body shall inform the market surveillance authority of the Member State concerned of any such request. Organise testing of the high-risk AI system through technical means, where the documentation referred to in Article 77(1) is insufficient to ascertain whether an infringement of obligations under Union law protecting fundamental rights has occurred. Organise the testing with the close involvement of the requesting public authority or body within a reasonable time following the request.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.43Recital 167 and Article 78(3): Exchange, where necessary and in accordance with relevant provisions of international and trade agreements, confidential information with regulatory authorities of third countries with which the Member State has concluded bilateral or multilateral confidentiality arrangements guaranteeing an adequate level of confidentiality.
Ensure that the market surveillance authorities referred to in Article 74(8) and (9), as applicable, can, upon request, immediately access the documentation or obtain a copy thereof.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.44Article 79: Carry out an evaluation of the AI system concerned in respect of its compliance with all the requirements and obligations laid down in the AI Act, where there is sufficient reason to consider an AI system to present a risk as referred to in Article 79(1). Particular attention shall be given to AI systems presenting a risk to vulnerable groups. Inform and fully cooperate with the relevant national public authorities or bodies referred to in Article 77(1), where risks to fundamental rights are identified. Take all appropriate corrective actions to bring the AI system into compliance, to withdraw the AI system from the market, or to recall it in any event, where, in the course of that evaluation, the market surveillance authority or, where applicable the market surveillance authority in cooperation with the national public authority referred to in Article 77(1), finds that the AI system does not comply with the requirements and obligations laid down in this Regulation.
Inform the relevant notified body accordingly and the Commission and the other Member States of the results of the evaluation and of the actions which it has required the operator to take, where the market surveillance authority considers that the non-compliance is not restricted to its national territory. Inform the Commission and the other Member States of any measures adopted and of any additional information at their disposal relating to the non-compliance of the AI system concerned, and, in the event of disagreement with the notified national measure, of their objections.
Take all appropriate provisional measures to prohibit or restrict the AI system’s being made available on its national market or put into service, to withdraw the product or the standalone AI system from that market or to recall it, where the operator of an AI system does not take adequate corrective action. Notify the Commission and the other Member States of those measures and describe the background as indicated in Article 79(6).
Inform the Commission and the other Member States of any measures adopted and of any additional information at their disposal relating to the non-compliance of the AI system concerned, and, in the event of disagreement with the notified national measure, of their objections.
Ensure that appropriate restrictive measures are taken in respect of the product or the AI system concerned, such as withdrawal of the product or the AI system from their market, without undue delay.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.45Recital 158: Report, without delay, to the European Central Bank any information identified in the course of the market surveillance activities that may be of potential interest for the European Central Bank’s prudential supervisory tasks as specified in Council Regulation (EU) No 1024/2013.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.46Recital 159: Use effective investigative and corrective powers, including at least the power to obtain access to all personal data that are being processed and to all information necessary for the performance of its tasks, with regard to high-risk AI systems in the area of biometrics, as listed in an annex to the AI Act insofar as those systems are used for the purposes of law enforcement, migration, asylum and border control management, or the administration of justice and democratic processes.
Exercise the powers by acting with complete independence. Any limitations of their access to sensitive operational data under this Regulation should be without prejudice to the powers conferred to them by Directive (EU) 2016/680. No exclusion on disclosing data to national data protection authorities under this Regulation should affect the current or future powers of those authorities beyond the scope of this Regulation.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.47Article 80: Carry out an evaluation of the AI system concerned in respect of its classification as a high-risk AI system based on the conditions set out in Article 6(3) and the Commission guidelines, where there is sufficient reason to consider that an AI system classified by the provider as non-high-risk pursuant to Article 6(3) is indeed high-risk.
Require the relevant provider to take all necessary actions to bring the AI system into compliance with the requirements and obligations laid down in the AI Act, as well as take appropriate corrective action, where, in the course of that evaluation, it is being assessed that the AI system concerned is high-risk.
Inform the Commission and the other Member States without undue delay of the results of the evaluation and of the actions which it has required the provider to take, where the market surveillance authority considers that the use of the AI system concerned is not restricted to its national territory.
Ensure that all necessary action is taken to bring the AI system into compliance with the requirements and obligations laid down in the AI Act. Where the provider of an AI system concerned does not bring the AI system into compliance with those requirements and obligations within the period referred to in Article 80(2), the provider shall be subject to fines in accordance with Article 99. Where, in the course of the evaluation pursuant to Article 80(1), it is being establishes that the AI system was misclassified by the provider as non-high- risk in order to circumvent the application of requirements in Chapter III, Section 2, the provider shall be subject to fines in accordance with Article 99.
Perform appropriate checks, taking into account in particular information stored in the EU database referred to in Article 71, when exercising the power to monitor the application of Article 80, and in accordance with Article 11 of Regulation (EU) 2019/1020.
General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.48Article 81(1/2): Raise an objection, within three months of receipt of the notification referred to in Article 79(5), or within 30 days in the case of non-compliance with the prohibition of the AI practices referred to in Article 5, to a measure taken by another market surveillance authority. Ensure taking appropriate restrictive measures in respect of the AI system concerned, such as requiring the withdrawal of the AI system from the market without undue delay and inform the Commission accordingly, where the Commission considers the measure taken by the relevant Member State to be justified and the objection to be not justified.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.49Article 81(2/2): Enter in consultation with the Commission after having received an objection by other Member States. Withdraw the measure and inform the Commission accordingly, where the Commission considers the national measure to be unjustified.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.50Article 82: Require the relevant operator to take all appropriate measures to ensure that the AI system concerned, when placed on the market or put into service, no longer presents that risk without undue delay, where, having performed an evaluation under Article 79, after consulting the relevant national public authority referred to in Article 77(1), it is being found that although a high-risk AI system complies with the AI Act, it nevertheless presents a risk to the health or safety of persons, to fundamental rights, or to other aspects of public interest protection.
Inform the Commission and the other Member States of a finding under Article 82(1). That information shall include all available details, in particular the data necessary for the identification of the AI system concerned, the origin and the supply chain of the AI system, the nature of the risk involved and the nature and duration of the national measures taken.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.51Article 83: Require the relevant provider to put an end to the non-compliance concerned, if it is assessed that:
(a) the CE marking has been affixed in violation of Article 48;
(b) the CE marking has not been affixed; the EU declaration of conformity referred to in Article 47 has not been drawn up;
(c) the EU declaration of conformity referred to in Article 47 has not been drawn up correctly;
(d) the registration in the EU database referred to in Article 71 has not been carried out;
(e) where applicable, no authorised representative has been appointed;
(f) technical documentation is not available.
Take appropriate and proportionate measures to restrict or prohibit the high-risk AI system being made available on the market or to ensure that it is recalled or withdrawn from the market without delay, where the non-compliance referred to in Article 83(1) persists.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.52Article 84: Request the support via the Union AI testing support structures, providing independent technical or scientific advice.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.53Article 85: Receive complaints from any natural or legal person that has grounds to consider that there has been an infringement of the provisions of the AI Act. Also take the complains systematically into account for the purpose of conducting market surveillance activities and handle them in line with the dedicated procedures established therefor.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.54Recital 162 and Article 88: Request from the AI Office to exercise the powers of enforcing against providers of GPAI models, where that is necessary and proportionate to assist with the fulfilment of their tasks under the AI Act.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.55Recital 168 and Article 99 / 100: Take all measures necessary to ensure that they fines are properly and effectively implemented, thereby taking into account the guidelines issued by the Commission pursuant to Article 96.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.
Receive as well notifications from the authorised representative that the mandate was terminated because he or she considered or had reason to consider that the provider was acting contrary to its obligations pursuant to the AI Act.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.5Recital 83 and Article 23: Receive notifications from the importer, who has sufficient reason to consider that a high-risk AI system is not in conformity with the AI Act, is falsified, or accompanied by falsified documentation and where the high-risk AI system presents a risk within the meaning of Article 79(1).General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.6Recital 91 – 95 and Article 26(5): Receive and register a notification from the deployer, where he or she has the reason to consider that the use of the high-risk AI system in accordance with the instructions may result in a situation, in which the AI system presents a risk within the meaning of Article 79(1) or where the deployer has identified a serious incident.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.7Recital 91 – 95 and Article 26(10): Request and register a notification in the relevant police file from the deployer about uses of a high-risk AI system for post-remote biometric identification.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.8Recital 96 and Article 27(3): Receive and register notification from deployers with regard to their fundamental rights impact assessment.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.9Recital 126 and Article 29–31: Receive and assess an application for notification from a conformity assessment body. Only notify those conformity assessment bodies that are meeting the requirements of Article 31.
Provide the required documentation and inform the Commission and the other Member States, using the electronic notification tool if it was decided to notify the conformity assessment body. Other Member States can object to the notification procedure according to Article 30(4/5).Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.10Recital 126 and Article 33(4): Receive and assess the relevant documents concerning the assessment of the qualifications of the subcontractor or the subsidiary and the work carried out by them under the AI Act.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.11Recital 126 and Article 34(3): Receive and assess the relevant documentation, including the providers’ documentation, to allow conducting an assessment, designation, notification and monitoring activities, and to facilitate the assessment outlined in Art 29-39.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.12Recital 126 and Article 36: Notify the Commission and the other Member States of any relevant changes to the notification of a notified body via the electronic notification tool referred to in Article 30(2).
Withdraw the designation where the notified body has ceased its activity or investigate where there is sufficient reason to consider that the notified body no longer meets the requirements laid down in Article 31, or that it is failing to fulfil its obligations. Where it is concluded that the notified body no longer meets the requirements laid down in Article 31 or that it is failing to fulfil its obligations, the designation should be restricted, suspended or withdrawn as appropriate, depending on the seriousness of the failure to meet the requirements or fulfil the obligations.
In that case, assess the impact on issued certificates and submit a report to the Commission and other Member States. Require the suspension of certificates and inform the Commission and other Member States, providing documentation.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.13Recital 126 and Article 37: Provide the Commission, on request, with all relevant information relating to the notification or the maintenance of the competence of the notified body concerned.
Receive and assess the findings of the Commission on the notified body that does not meet the requirements for notification. Take the necessary corrective measures, including the suspension or withdrawal of the notification if necessary.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.14Recital 126 and Article 38: Ensure that the bodies that have been notified, participate in the work of the group referred to in Article 38(1), directly or through designated representatives.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.15Recital 121 and Article 41(6): Inform the Commission with a detailed explanation if it was assessed that the common specification does not meet the requirements of section 2 and 3 of the high-risk chapter.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.16Article 45(1): Request and assess the information provided by notified bodies based on Article 45(1).General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.17Recital 130 and Article 46: Authorize the placing on the market or the putting into service of AI systems, which have not undergone a conformity assessment, but only if exceptional reasons apply (e.g. public security or protection of life and health of natural persons, environmental protection and the protection of key industrial and infrastructural assets). Inform the Commission and the other Member States of any authorization that has been issued. Withdraw the derogation if the Commission considers the authorization unjustified.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.18Article 47(1): Receive and register the copy of the EU declaration of conformity submitted by providers.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.19Recital 101 and Article 53(1a): Request the technical documentation from the provider of a GPAI model.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.20Recital 115 and Article 55(1c): Receive the notification from the provider of a systemic GPAI model if the development or use of the model causes a serious incident, including information on the incident and on possible corrective measures.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.21Recital 137 / 138 and Article 57(6): Provide, as appropriate, guidance, supervision and support within the AI regulatory sandbox with a view to identifying risks, in particular to fundamental rights, health and safety, testing, mitigation measures, and their effectiveness in relation to the obligations and requirements of this Regulation and, where relevant, other Union and national law supervised within the sandbox.
Provide guidance on regulatory expectations and how to fulfil the requirements and obligations set out in the AI Act to providers and prospective providers that are participating in the AI regulatory sandbox.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.22Recital 137 / 138 and Article 57(7): Provide to the provider a written proof of the activities successfully carried out in the sandbox. Provide also exit reports (detailing the activities carried out in the sandbox and the related results and learning outcomes). If both the provider or prospective provider and the national competent authority explicitly agree, the exit report may be made publicly available through the single information platform referred to in Article 57.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.23Recital 137 / 138 and Article 57(10): Ensure that, to the extent the innovative AI systems involve the processing of personal data or otherwise fall under the supervisory remit of other national authorities or competent authorities providing or supporting access to data, the national data protection authorities and those other national or competent authorities are associated with the operation of the AI regulatory sandbox and involved in the supervision of those aspects to the extent of their respective tasks and powers.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.24Recital 137 / 138 and Article 57(11): React on significant risks identified during the development and testing of AI systems by requesting adequate mitigation and, failing that, initiate the suspension of the development and testing process, temporarily or permanently. Inform the AI Office of such decision.
Exercise the supervisory powers within the limits of the relevant law, using the discretionary powers when implementing legal provisions in respect of a specific AI regulatory sandbox project, with the objective of supporting innovation in AI in the Union.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.25Recital 137 / 138 and Article 57(14): Coordinate the activities and cooperate within the framework of the Board with other Member States.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.26Recital 139 and Article 58(4): Specifically agree the terms and conditions of real-world testing and, in particular, the appropriate safeguards with the participants, with a view to protecting fundamental rights, health and safety, before authorising it under supervised conditions within the framework of an AI regulatory sandbox. Cooperate with other national competent authorities with a view to ensuring consistent practices across the Union.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.27Recital 140 and Article 59: Assess the safeguards and cooperate with providers and prospective providers in the AI regulatory sandbox that want to use personal data, including by issuing guidance and monitoring the mitigation of any identified significant risks to safety, health, and fundamental rights that may arise during the development, testing and experimentation in that sandbox.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.28Recital 141 and Article 60(4): Require from providers and prospective providers to provide information including their real-world testing plans before the activities by the provider are conducted. If adequate, approve the testing in real world conditions and the real- world testing plan. Decide on extending the testing under real world conditions after six months for maximum an additional period of six months, subject to prior notification by the provider or prospective provider, accompanied by an explanation of the need for such an extension.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.29Recital 141 and Article 60(6): Carry out unannounced remote or on-site inspections, and perform checks on the conduct of the testing in real world conditions and the related high-risk AI systems. Use those powers to ensure the safe development of testing in real world conditions.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.30Recital 141 and Article 60(7/8): Receive and access notifications on serious incident identified in the course of the testing in real world conditions by the provider. Receive and assess the notification on the suspension or termination and of the final outcome of the testing in real world conditions by providers or prospective providers.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.31Recital 143 and Article 62(1a): Provide SMEs, including start-ups, that have a registered office or a branch in the Union, with priority access to the AI regulatory sandboxes provided that they fulfil the eligibility conditions and selection criteria and without precluding other providers and prospective providers to access the sandboxes provided the same conditions and criteria are fulfilled.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.32Recital 143 and Article 62(1b/c): Organise specific awareness raising and training activities on the application of the AI Act tailored to the needs of SMEs including start-ups, deployers and, as appropriate, local public authorities.
Utilise existing channels and where appropriate, establish new dedicated channels for communication with SMEs, including start-ups, deployers, other innovators and, as appropriate, local public authorities, to support SMEs throughout their development path by providing guidance and responding to queries about the implementation of this Regulation. Where appropriate, these channels should work together to create synergies and ensure homogeneity in their guidance to SMEs, including start-ups, and deployers.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.33Recital 143 and Article 62(1d): Facilitate the participation of SMEs and other relevant stakeholders in the standardisation development processes.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.34Recital 149 and Article 66(o): Send opinions to the AI Board on qualified alerts regarding GPAI models, and on national experiences and practices on the monitoring and enforcement of AI systems, in particular systems integrating the general-purpose AI models.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.35Recital 151 and Article 68 / 69: Request support from the pool of experts constituting the scientific panel for the enforcement activitiesRule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.36Recital 153 / 54 and Article 70(5): Act in accordance with the confidentiality obligations set out in Article 78, when performing its tasks.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.37Recital 153 / 154 and 70(8): Provide guidance and advice on the implementation of the AI Act, in particular to SMEs including start-ups, taking into account the guidance and advice of the AI Board and the Commission, as appropriate. Whenever guidance and advice with regard to an AI system in areas covered by other Union law is provided, the national competent authorities under that Union law shall be consulted, as appropriate.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.38Recital 155 and Article 73: Receive the reports on serious incidents from providers of high-risk AI systems. Inform the national public authorities or bodies referred to in Article 77(1), when receiving a notification related to a serious incident referred to in Article 3, point (49)(c).
Take appropriate measures, as provided for in Article 19 of Regulation (EU) 2019/1020, within seven days from the date of receiving the notification referred to in Article 73(1) and follow the notification procedures as provided in that Regulation.
Immediately notify the Commission of any serious incident, whether or not they have taken action on it, in accordance with Article 20 of Regulation (EU) 2019/1020.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.39Recital 156 / 160 and Article 74(11-14): Propose joint activities, including joint investigations, to be conducted by market surveillance authorities or market surveillance authorities jointly with the Commission, that have the aim of promoting compliance, identifying non- compliance, raising awareness and providing guidance in relation to this Regulation with respect to specific categories of high-risk AI systems that are found to present a serious risk across two or more Member States. Joint activities to promote compliance should be carried out in accordance with Article 9 of Regulation (EU) 2019/1020.
If necessary, request full access by providers to the documentation as well as the training, validation and testing data sets used for the development of high-risk AI systems, including, where appropriate and subject to security safeguards, through application programming interfaces (API) or other relevant technical means and tools enabling remote access. Request to access the source code of the high-risk AI system if the access to source code is necessary to assess the conformity of a high-risk AI system with the requirements set out in Chapter III, Section 2 and testing or auditing procedures and verifications based on the data and documentation provided by the provider have been exhausted or proved insufficient.
Treat any information or documentation obtained in accordance with the confidentiality obligations set out in Article 78.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.40Recital 161 and Article 75(2/3): Cooperate with the AI Office to carry out evaluations of compliance and inform the Board and other market surveillance authorities accordingly in case there is a GPAI system that can be used directly by deployers for at least one purpose that is classified as high-risk and there are sufficient reasons to consider that it is non-compliant.
Request assistance from the AI Office where the national level is unable to conclude an investigation on a high-risk AI system because of its inability to access certain information related to the GPAI model on which the high-risk AI system is built. In such cases, the procedure regarding mutual assistance in cross-border cases in Chapter VI of Regulation (EU) 2019/1020 should apply mutatis mutandis.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.41Article 76: Ensure that testing in real world conditions is in accordance with the AI Act. Verify that the testing in real world conditions is conducted in compliance with Article 60. Option to allow the testing in real world conditions to be conducted by the provider or prospective provider, in derogation from the conditions set out in Article 60(4), points (f) and (g).
Suspend or terminate the testing or require modifications if informed of a serious incident or there are other grounds for considering that the conditions set out in Articles 60 and 61 are not met.
Indicate the grounds for a decision or rejection and how the provider or prospective provider can challenge the decision or objection. Communicate the grounds therefor to the market surveillance authorities of other Member States in which the AI system has been tested in accordance with the testing plan.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.42Recital 157 and Article 77: Request and access any documentation created or maintained under the AI Act in accessible language and format when access to that documentation is necessary for effectively fulfilling the mandates within the limits of their jurisdiction. The relevant public authority or body shall inform the market surveillance authority of the Member State concerned of any such request. Organise testing of the high-risk AI system through technical means, where the documentation referred to in Article 77(1) is insufficient to ascertain whether an infringement of obligations under Union law protecting fundamental rights has occurred. Organise the testing with the close involvement of the requesting public authority or body within a reasonable time following the request.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.43Recital 167 and Article 78(3): Exchange, where necessary and in accordance with relevant provisions of international and trade agreements, confidential information with regulatory authorities of third countries with which the Member State has concluded bilateral or multilateral confidentiality arrangements guaranteeing an adequate level of confidentiality.
Ensure that the market surveillance authorities referred to in Article 74(8) and (9), as applicable, can, upon request, immediately access the documentation or obtain a copy thereof.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.44Article 79: Carry out an evaluation of the AI system concerned in respect of its compliance with all the requirements and obligations laid down in the AI Act, where there is sufficient reason to consider an AI system to present a risk as referred to in Article 79(1). Particular attention shall be given to AI systems presenting a risk to vulnerable groups. Inform and fully cooperate with the relevant national public authorities or bodies referred to in Article 77(1), where risks to fundamental rights are identified. Take all appropriate corrective actions to bring the AI system into compliance, to withdraw the AI system from the market, or to recall it in any event, where, in the course of that evaluation, the market surveillance authority or, where applicable the market surveillance authority in cooperation with the national public authority referred to in Article 77(1), finds that the AI system does not comply with the requirements and obligations laid down in this Regulation.
Inform the relevant notified body accordingly and the Commission and the other Member States of the results of the evaluation and of the actions which it has required the operator to take, where the market surveillance authority considers that the non-compliance is not restricted to its national territory. Inform the Commission and the other Member States of any measures adopted and of any additional information at their disposal relating to the non-compliance of the AI system concerned, and, in the event of disagreement with the notified national measure, of their objections.
Take all appropriate provisional measures to prohibit or restrict the AI system’s being made available on its national market or put into service, to withdraw the product or the standalone AI system from that market or to recall it, where the operator of an AI system does not take adequate corrective action. Notify the Commission and the other Member States of those measures and describe the background as indicated in Article 79(6).
Inform the Commission and the other Member States of any measures adopted and of any additional information at their disposal relating to the non-compliance of the AI system concerned, and, in the event of disagreement with the notified national measure, of their objections.
Ensure that appropriate restrictive measures are taken in respect of the product or the AI system concerned, such as withdrawal of the product or the AI system from their market, without undue delay.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.45Recital 158: Report, without delay, to the European Central Bank any information identified in the course of the market surveillance activities that may be of potential interest for the European Central Bank’s prudential supervisory tasks as specified in Council Regulation (EU) No 1024/2013.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.46Recital 159: Use effective investigative and corrective powers, including at least the power to obtain access to all personal data that are being processed and to all information necessary for the performance of its tasks, with regard to high-risk AI systems in the area of biometrics, as listed in an annex to the AI Act insofar as those systems are used for the purposes of law enforcement, migration, asylum and border control management, or the administration of justice and democratic processes.
Exercise the powers by acting with complete independence. Any limitations of their access to sensitive operational data under this Regulation should be without prejudice to the powers conferred to them by Directive (EU) 2016/680. No exclusion on disclosing data to national data protection authorities under this Regulation should affect the current or future powers of those authorities beyond the scope of this Regulation.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.47Article 80: Carry out an evaluation of the AI system concerned in respect of its classification as a high-risk AI system based on the conditions set out in Article 6(3) and the Commission guidelines, where there is sufficient reason to consider that an AI system classified by the provider as non-high-risk pursuant to Article 6(3) is indeed high-risk.
Require the relevant provider to take all necessary actions to bring the AI system into compliance with the requirements and obligations laid down in the AI Act, as well as take appropriate corrective action, where, in the course of that evaluation, it is being assessed that the AI system concerned is high-risk.
Inform the Commission and the other Member States without undue delay of the results of the evaluation and of the actions which it has required the provider to take, where the market surveillance authority considers that the use of the AI system concerned is not restricted to its national territory.
Ensure that all necessary action is taken to bring the AI system into compliance with the requirements and obligations laid down in the AI Act. Where the provider of an AI system concerned does not bring the AI system into compliance with those requirements and obligations within the period referred to in Article 80(2), the provider shall be subject to fines in accordance with Article 99. Where, in the course of the evaluation pursuant to Article 80(1), it is being establishes that the AI system was misclassified by the provider as non-high- risk in order to circumvent the application of requirements in Chapter III, Section 2, the provider shall be subject to fines in accordance with Article 99.
Perform appropriate checks, taking into account in particular information stored in the EU database referred to in Article 71, when exercising the power to monitor the application of Article 80, and in accordance with Article 11 of Regulation (EU) 2019/1020.
General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.48Article 81(1/2): Raise an objection, within three months of receipt of the notification referred to in Article 79(5), or within 30 days in the case of non-compliance with the prohibition of the AI practices referred to in Article 5, to a measure taken by another market surveillance authority. Ensure taking appropriate restrictive measures in respect of the AI system concerned, such as requiring the withdrawal of the AI system from the market without undue delay and inform the Commission accordingly, where the Commission considers the measure taken by the relevant Member State to be justified and the objection to be not justified.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.49Article 81(2/2): Enter in consultation with the Commission after having received an objection by other Member States. Withdraw the measure and inform the Commission accordingly, where the Commission considers the national measure to be unjustified.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.50Article 82: Require the relevant operator to take all appropriate measures to ensure that the AI system concerned, when placed on the market or put into service, no longer presents that risk without undue delay, where, having performed an evaluation under Article 79, after consulting the relevant national public authority referred to in Article 77(1), it is being found that although a high-risk AI system complies with the AI Act, it nevertheless presents a risk to the health or safety of persons, to fundamental rights, or to other aspects of public interest protection.
Inform the Commission and the other Member States of a finding under Article 82(1). That information shall include all available details, in particular the data necessary for the identification of the AI system concerned, the origin and the supply chain of the AI system, the nature of the risk involved and the nature and duration of the national measures taken.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.51Article 83: Require the relevant provider to put an end to the non-compliance concerned, if it is assessed that:
(a) the CE marking has been affixed in violation of Article 48;
(b) the CE marking has not been affixed; the EU declaration of conformity referred to in Article 47 has not been drawn up;
(c) the EU declaration of conformity referred to in Article 47 has not been drawn up correctly;
(d) the registration in the EU database referred to in Article 71 has not been carried out;
(e) where applicable, no authorised representative has been appointed;
(f) technical documentation is not available.
Take appropriate and proportionate measures to restrict or prohibit the high-risk AI system being made available on the market or to ensure that it is recalled or withdrawn from the market without delay, where the non-compliance referred to in Article 83(1) persists.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.52Article 84: Request the support via the Union AI testing support structures, providing independent technical or scientific advice.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.53Article 85: Receive complaints from any natural or legal person that has grounds to consider that there has been an infringement of the provisions of the AI Act. Also take the complains systematically into account for the purpose of conducting market surveillance activities and handle them in line with the dedicated procedures established therefor.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.54Recital 162 and Article 88: Request from the AI Office to exercise the powers of enforcing against providers of GPAI models, where that is necessary and proportionate to assist with the fulfilment of their tasks under the AI Act.General rule of Art 113 applies, meaning that the related norms apply from 02 August 2026.55Recital 168 and Article 99 / 100: Take all measures necessary to ensure that they fines are properly and effectively implemented, thereby taking into account the guidelines issued by the Commission pursuant to Article 96.Rule of Art 113(b) applies, meaning that the related norms apply from 02 August 2025.