EU AI Act — All 113 Articles (Regulation 2024/1689)

Complete index of all 113 articles of the EU AI Act (Regulation 2024/1689), organized by Title and Chapter. Browse the full text structure with links to each article.

This page is the complete table of contents for the EU AI Act (Regulation (EU) 2024/1689). All 113 articles are listed under their official Title and Chapter headings, with a brief description of each article's subject matter. Use this index to navigate the full legislative structure or to locate a specific provision.

Title I — General Provisions

• Art. 1 — Subject matter — Establishes the purpose of the Regulation, which lays down harmonised rules for the placing on the market, putting into service, and use of AI systems in the Union.
• Art. 2 — Scope — Defines which providers, deployers, importers, distributors, and product manufacturers are subject to the Regulation, and lists the exclusions.
• Art. 3 — Definitions — Provides the official definitions of 68 key terms used throughout the Regulation, including "AI system", "provider", "deployer", "high-risk AI system", and "general-purpose AI model".
• Art. 4 — AI literacy — Requires providers and deployers to take measures to ensure a sufficient level of AI literacy in their staff and persons dealing with AI systems on their behalf.

Title II — Prohibited AI Practices

• Art. 5 — Prohibited AI practices — Lists AI practices that are prohibited outright in the Union as being contrary to Union values, including subliminal manipulation, social scoring, and most uses of real-time remote biometric identification in public spaces.

Title III — High-Risk AI Systems

Chapter 1 — Classification of High-Risk AI Systems

• Art. 6 — Classification rules for high-risk AI systems — Sets out the two-tier classification framework: Annex I product-safety AI and Annex III stand-alone high-risk AI systems, plus the self-assessment exception procedure.
• Art. 7 — Amendments to Annex III — Empowers the Commission to amend Annex III via delegated acts to add or remove high-risk use-case categories based on defined criteria.

Chapter 2 — Requirements for High-Risk AI Systems

• Art. 8 — Compliance with the requirements — Establishes that high-risk AI systems must comply with the requirements in this Chapter throughout their entire lifecycle.
• Art. 9 — Risk management system — Requires providers to establish, implement, document, and maintain a continuous risk management system for high-risk AI systems.
• Art. 10 — Data and data governance — Sets requirements for training, validation, and testing datasets, including relevance, representativeness, and freedom from errors and biases.
• Art. 11 — Technical documentation — Requires providers to draw up technical documentation before placing a high-risk AI system on the market, in accordance with Annex IV.
• Art. 12 — Record-keeping — Obliges providers to ensure high-risk AI systems are capable of automatically recording events (logs) throughout their lifetime.
• Art. 13 — Transparency and provision of information to deployers — Requires that high-risk AI systems are sufficiently transparent for deployers to interpret outputs and use the system appropriately, including via an instructions-for-use document.
• Art. 14 — Human oversight — Requires high-risk AI systems to be designed to allow effective human oversight and intervention during the period of use.
• Art. 15 — Accuracy, robustness, and cybersecurity — Specifies that high-risk AI systems must achieve appropriate levels of accuracy, be resilient to errors and faults, and be protected against cybersecurity threats.

Chapter 3 — Obligations of Providers and Deployers of High-Risk AI Systems and Other Parties

• Art. 16 — Obligations of providers of high-risk AI systems — Lists the core obligations of providers, including quality management, conformity assessment, registration, and corrective action.
• Art. 17 — Quality management system — Requires providers to put in place a quality management system covering strategies, design controls, testing, post-market monitoring, and documentation.
• Art. 18 — Documentation keeping — Specifies the types of documentation providers must keep and make available to national authorities for ten years after placing a system on the market.
• Art. 19 — Automatically generated logs — Obliges providers to keep the logs automatically generated by their high-risk AI systems to the extent they are under their control.
• Art. 20 — Corrective actions and duty of information — Requires providers to take immediate corrective actions when a high-risk AI system does not conform and to inform authorities and deployers accordingly.
• Art. 21 — Cooperation with competent authorities — Obliges providers to cooperate with national competent authorities and supply all requested information and documentation.
• Art. 22 — Authorised representatives of providers established outside the Union — Requires providers established outside the EU to designate an authorised representative in the Union before placing systems on the market.
• Art. 23 — Obligations of importers — Sets obligations for importers to verify conformity assessment, CE marking, and provider documentation before placing high-risk AI systems on the market.
• Art. 24 — Obligations of distributors — Requires distributors to verify CE marking and accompanying documentation before making a high-risk AI system available on the market.
• Art. 25 — Responsibilities along the AI value chain — Clarifies when importers, distributors, or other parties take on the full obligations of a provider, particularly when they modify or place systems under their own name.
• Art. 26 — Obligations of deployers of high-risk AI systems — Sets out deployer obligations including following instructions for use, ensuring human oversight, monitoring operation, and informing providers and authorities of risks.
• Art. 27 — Fundamental rights impact assessment for high-risk AI systems — Requires certain public bodies and private entities performing regulated tasks to conduct a fundamental rights impact assessment before deploying a high-risk AI system.

Chapter 4 — Notifying Authorities and Notified Bodies

• Art. 28 — Notifying authorities — Requires each Member State to designate a national notifying authority responsible for establishing and carrying out the procedures for assessment and notification of conformity assessment bodies.
• Art. 29 — Application of a conformity assessment body for notification — Sets out the procedure and information requirements for conformity assessment bodies applying to be notified.
• Art. 30 — Notification procedure — Describes the process through which Member States notify the Commission and other Member States of authorised conformity assessment bodies.
• Art. 31 — Requirements for notified bodies — Lists the organisational, independence, impartiality, and competence requirements a conformity assessment body must meet to be notified.
• Art. 32 — Presumption of conformity of notified bodies — Establishes that bodies accredited by a national accreditation authority in accordance with EU accreditation Regulation 765/2008 are presumed to meet the requirements for notified bodies.
• Art. 33 — Subsidiaries of and subcontracting by notified bodies — Permits notified bodies to subcontract or use subsidiaries provided that the client is informed and the notified body remains fully responsible.
• Art. 34 — Operational obligations of notified bodies — Requires notified bodies to carry out conformity assessments in a proportionate manner, document their procedures, and report to notifying authorities.
• Art. 35 — Identification numbers and lists of notified bodies — Provides for the Commission to assign identification numbers to notified bodies and publish an up-to-date list of all notified bodies.
• Art. 36 — Changes to notifications — Sets out the procedure for amending, suspending, or withdrawing a notification when a notified body no longer meets the requirements.
• Art. 37 — Challenge of the competence of notified bodies — Establishes the procedure by which the Commission may investigate whether a notified body continues to meet the requirements and require corrective action.
• Art. 38 — Coordination of notified bodies — Requires the Commission to ensure appropriate coordination and cooperation among notified bodies through a sectoral group of notified bodies.
• Art. 39 — Conformity assessment bodies of third countries — Permits conformity assessment bodies established in third countries to be notified under the Regulation only where a bilateral agreement between the Union and the third country so provides.

Chapter 5 — Standards, Conformity Assessment, Certificates, and Registration

• Art. 40 — Harmonised standards and common specifications — Provides that high-risk AI systems conforming to harmonised standards or common specifications shall be presumed to comply with the requirements of Chapter 2.
• Art. 41 — Common specifications — Empowers the Commission to adopt implementing acts establishing common specifications where harmonised standards do not exist or are insufficient.
• Art. 42 — Presumption of conformity with certain requirements — Creates a rebuttable presumption of conformity for high-risk AI systems trained and tested on data reflecting the specific geographic, contextual, and behavioural settings of intended use.
• Art. 43 — Conformity assessment — Specifies the conformity assessment procedures applicable to each category of high-risk AI system, including internal control and third-party assessment routes.
• Art. 44 — Certificates — Governs the EU technical documentation assessment certificates and quality management system certificates issued by notified bodies, including their validity and renewal.
• Art. 45 — Information obligations of notified bodies — Requires notified bodies to notify the notifying authority of certificates issued, modified, supplemented, suspended, withdrawn, or refused, and to maintain a register of certificates.
• Art. 46 — Derogation from conformity assessment procedure — Allows Member State authorities to authorise specific high-risk AI systems to be placed on the market without completing the standard conformity assessment procedure, in the interest of public security or safety.
• Art. 47 — EU declaration of conformity — Requires providers to draw up a written EU declaration of conformity for each high-risk AI system and keep it updated throughout the system's lifecycle.
• Art. 48 — CE marking — Provides that high-risk AI systems must bear the CE conformity marking before being placed on the market or put into service, in accordance with the rules in Annex V.
• Art. 49 — Registration — Requires providers of high-risk AI systems listed in Annex III (and certain GPAI model providers) to register in the EU database before placing those systems on the market.

Title IV — Transparency Obligations for Certain AI Systems

• Art. 50 — Transparency obligations for providers and deployers of certain AI systems — Requires providers to design certain AI systems (chatbots, deepfakes, emotion recognition, biometric categorisation) so that users are informed they are interacting with AI or that content is AI-generated.

Title V — General-Purpose AI Models

Chapter 1 — Classification of General-Purpose AI Models

• Art. 51 — Classification of general-purpose AI models as general-purpose AI models with systemic risk — Sets out the criteria and thresholds — notably training compute above 10^25 FLOPs — for classifying a GPAI model as posing systemic risk.

Chapter 2 — Obligations for Providers of General-Purpose AI Models

• Article 52 — Systemic-risk classification procedure — Systemic-risk classification procedure.
• Article 53 — Obligations for all providers of general-purpose AI models — Obligations for all providers of general-purpose AI models.
• Art. 54 — Authorised representative of providers of general-purpose AI models established outside the Union — Requires providers of GPAI models established outside the EU to designate an authorised representative in the Union.
• Article 55 — Obligations for providers of general-purpose AI models with systemic risk — Obligations for providers of general-purpose AI models with systemic risk.

Chapter 3 — Codes of Practice

• Article 56 — Codes of practice — Codes of practice.

Title VI — Measures in Support of Innovation

Chapter 1 — AI Regulatory Sandboxes

• Art. 57 — AI regulatory sandboxes — Requires Member States to establish AI regulatory sandboxes providing controlled environments for developing, testing, and validating innovative AI systems before market placement.
• Art. 58 — Detailed arrangements for AI regulatory sandboxes and their functioning — Empowers the Commission to adopt implementing acts specifying uniform conditions for establishing and operating AI regulatory sandboxes.
• Art. 59 — Further processing of personal data for developing certain AI systems in the public interest in the AI regulatory sandbox — Sets out the limited conditions under which personal data lawfully collected for other purposes may be further processed in an AI regulatory sandbox.

Chapter 2 — Measures for Providers and Deployers, in Particular SMEs, Including Start-Ups

• Art. 60 — Testing of high-risk AI systems in real world conditions outside AI regulatory sandboxes — Allows testing of high-risk AI systems in real-world conditions outside a regulatory sandbox, subject to a specific plan and safeguards including informed consent.
• Article 61 — Informed consent in real-world testing — Informed consent in real-world testing.
• Art. 62 — Measures for providers and deployers, in particular SMEs, including start-ups — Requires national competent authorities and the AI Office to take specific measures to reduce the regulatory burden on SMEs and start-ups, including priority access to sandboxes and reduced fees.

Title VII — Governance

Chapter 1 — EU-Level Governance

• Art. 63 — AI Office — Establishes the AI Office within the Commission as the body responsible for overseeing GPAI models, coordinating AI governance across the Union, and developing Union expertise in AI.
• Art. 64 — Tasks of the AI Office — Lists the tasks of the AI Office including monitoring GPAI model obligations, supporting the AI Board, conducting investigations, and fostering Union-wide AI governance coherence.
• Art. 65 — AI Board — Establishes the European Artificial Intelligence Board composed of one representative from each Member State and the European Data Protection Supervisor, with the AI Office providing its secretariat.
• Article 66 — Tasks of the Board — Tasks of the Board.
• Article 67 — Advisory forum — Advisory forum.
• Article 68 — Scientific panel of independent experts — Scientific panel of independent experts.

Chapter 2 — National Competent Authorities

• Article 69 — Access to the pool of experts by the Member States — Access to the pool of experts by the Member States.
• Article 70 — National competent authority — National competent authority.

Title VIII — EU Database for High-Risk AI Systems

• Art. 71 — EU database for high-risk AI systems — Requires the Commission to establish and maintain a publicly accessible EU database containing registration information for high-risk AI systems listed under Annex III.

Title IX — Post-Market Monitoring, Information Sharing, and Market Surveillance

Chapter 1 — Post-Market Monitoring

• Art. 72 — Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems — Requires providers to establish and document a post-market monitoring system to proactively collect and analyse data on high-risk AI system performance throughout their lifetime.

Chapter 2 — Sharing of Information on Serious Incidents

• Art. 73 — Reporting of serious incidents — Requires providers of high-risk AI systems placed on the Union market to report serious incidents to the market surveillance authorities of the Member States in which the incident occurred.

Chapter 3 — Market Surveillance and Control of AI Systems in the Union Market

• Art. 74 — Market surveillance and control of AI systems in the Union market — Designates national market surveillance authorities, specifies their powers and responsibilities, and establishes the framework for coordinated market surveillance of AI systems.
• Art. 75 — Mutual assistance, market surveillance and control of general-purpose AI models — Provides for mutual assistance between national market surveillance authorities and the AI Office for the market surveillance and control of GPAI models.
• Art. 76 — Supervision of testing in real world conditions by market surveillance authorities — Grants market surveillance authorities the power to supervise and inspect real-world testing of high-risk AI systems and to require modifications or suspension of testing.
• Art. 77 — Powers of authorities protecting fundamental rights — Requires market surveillance authorities to cooperate with national authorities responsible for fundamental rights protection when assessing high-risk AI systems affecting individuals' rights.
• Art. 78 — Confidentiality — Obliges national competent authorities and the Commission to maintain the confidentiality of information and data obtained in carrying out their tasks, in line with applicable Union and national law.
• Article 79 — National procedure for AI systems presenting a risk — National procedure for AI systems presenting a risk.
• Article 80 — Procedure for systems misclassified as non-high-risk — Procedure for systems misclassified as non-high-risk.
• Article 81 — Union safeguard procedure — Union safeguard procedure.
• Article 82 — Compliant AI systems which present a risk — Compliant AI systems which present a risk.
• Article 83 — Formal non-compliance — Formal non-compliance.
• Article 84 — Union testing facilities — Union testing facilities.

Chapter 4 — Remedies

• Article 85 — Right to lodge a complaint with a market surveillance authority — Right to lodge a complaint with a market surveillance authority.
• Article 86 — Right to explanation of individual decision-making — Right to explanation of individual decision-making.
• Article 87 — Whistleblowing — Whistleblowing.

Title X — Codes of Conduct and Guidelines

• Article 88 — Enforcement of the obligations of GPAI providers — Enforcement of the obligations of GPAI providers.
• Article 89 — Monitoring actions of the AI Office — Monitoring actions of the AI Office.

Title XI — Delegation of Power and Committee Procedure

• Article 90 — Alerts of systemic risks by the scientific panel — Alerts of systemic risks by the scientific panel.
• Article 91 — Power to request documentation and information — Power to request documentation and information.

Title XII — Penalties

• Article 92 — Power to conduct evaluations — Power to conduct evaluations.
• Art. 93 — Power to request measures — Empowers the Commission to require GPAI providers to restore compliance, implement mitigation measures after an Article 92 evaluation, or restrict, withdraw or recall the model.

Title XIII — Final Provisions

• Article 94 — Procedural rights of GPAI economic operators — Procedural rights of GPAI economic operators.
• Art. 95 — Evaluation and review — Requires the Commission to carry out a regular evaluation of the Regulation, reporting to the European Parliament and the Council on the functioning of the AI Office, penalties regime, and scope of Annex III.
• Art. 96 — Report on the implementation of the Regulation — Requires the Commission to submit a report to the European Parliament and the Council assessing progress with standardisation activities and the adequacy of resources for national competent authorities.
• Art. 97 — Repeal — Repeals Commission Recommendation (EU) 2021/C 136/01 and Council Recommendation on Artificial Intelligence, which are superseded by this Regulation.
• Art. 98 — Amendments to Regulation (EC) No 300/2008 — Amends the civil aviation security Regulation to incorporate references to the EU AI Act requirements for AI-based security equipment.
• Art. 99 — Amendments to Regulation (EU) No 167/2013 — Amends the agricultural and forestry vehicles Regulation to align product safety rules for AI systems used in those vehicles with the EU AI Act framework.
• Article 100 — Administrative fines on Union institutions and bodies — Administrative fines on Union institutions and bodies.
• Article 101 — Penalties applicable to providers of general-purpose AI models — Penalties applicable to providers of general-purpose AI models.
• Art. 102 — Amendments to Directive (EU) 2016/797 — Amends the Railway Interoperability Directive to align railway safety AI requirements with the EU AI Act framework.
• Art. 103 — Amendments to Regulation (EU) 2018/858 — Amends the Motor Vehicles Regulation to align vehicle type-approval rules for AI systems with the EU AI Act.
• Art. 104 — Amendments to Regulation (EU) 2018/1139 — Amends the Aviation Safety Regulation to integrate EU AI Act requirements for AI systems used in civil aviation.
• Art. 105 — Amendments to Regulation (EU) 2019/2144 — Amends the Vehicle Type-Approval Regulation for motor vehicles to incorporate the EU AI Act's safety requirements for AI systems in vehicles.
• Art. 106 — Amendments to Directive 2006/42/EC — Amends the Machinery Directive to align requirements for AI-enabled machinery with the EU AI Act framework.
• Art. 107 — Amendments to Directive 2009/138/EC — Amends the Solvency II Insurance Directive to incorporate considerations relating to AI systems used by insurance undertakings.
• Art. 108 — Amendments to Directive 2013/36/EU — Amends the Capital Requirements Directive to include references to AI system governance and risk management within the prudential framework for credit institutions.
• Art. 109 — Amendments to Directive (EU) 2016/97 — Amends the Insurance Distribution Directive to reflect AI Act requirements applicable to AI tools used in insurance distribution.
• Article 110 — Amendment to the Representative Actions Directive — Amendment to the Representative Actions Directive.
• Article 111 — Transitional provisions — Transitional provisions.
• Article 112 — Evaluation — Evaluation.
• Art. 113 — Entry into force and application — States that the Regulation entered into force on 1 August 2024 and specifies the phased application dates: February 2025 for prohibited practices, August 2025 for GPAI rules, August 2026 for most high-risk obligations, and December 2026 for Annex I high-risk product AI.