Article 79: Procedure at National Level for Dealing with AI Systems Presenting a Risk
1.
AI systems presenting a risk shall be understood as a ‘product presenting a risk’ as defined in Article 3, point 19 of Regulation (EU) 2019/1020, in so far as they present risks to the health or safety, or to fundamental rightsfundamental rightsIncludes human dignity, right to life, prohibition of torture, protection of personal datapersonal dataAny information relating to an identified or identifiable natural person ('data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)An identified or identifiable natural person to whom personal data relateGDPR Art. 4(1)'). Includes name, ID number, location data, online identifiers, or factors specific to physical, physiological, genetic, mental, economic, cultural or social identityGDPR Art. 4(1), freedom of expression, non-discrimination, equality between women and men, rights of the child, right to an effective remedy and fair trialCharter of Fundamental Rights Art. 1–54, of persons.
2.
Where the market surveillance authoritymarket surveillance authorityAny national authority responsible for carrying out market surveillance on the territory of the Member State concernedRegulation (EU) 2019/1020 Art. 3(4) of a Member State has sufficient reason to consider an AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) to present a risk as referred to in paragraph 1 of this Article, it shall carry out an evaluation of the AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) concerned in respect of its compliance with all the requirements and obligations laid down in this Regulation. Particular attention shall be given to AI systems presenting a risk to vulnerable groups. Where risks to fundamental rightsfundamental rightsIncludes human dignity, right to life, prohibition of torture, protection of personal datapersonal dataAny information relating to an identified or identifiable natural person ('data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)An identified or identifiable natural person to whom personal data relateGDPR Art. 4(1)'). Includes name, ID number, location data, online identifiers, or factors specific to physical, physiological, genetic, mental, economic, cultural or social identityGDPR Art. 4(1), freedom of expression, non-discrimination, equality between women and men, rights of the child, right to an effective remedy and fair trialCharter of Fundamental Rights Art. 1–54 are identified, the market surveillance authoritymarket surveillance authorityAny national authority responsible for carrying out market surveillance on the territory of the Member State concernedRegulation (EU) 2019/1020 Art. 3(4) shall also inform and fully cooperate with the relevant national public authorities or bodies referred to in Article 77(1). The relevant operators shall cooperate as necessary with the market surveillance authoritymarket surveillance authorityAny national authority responsible for carrying out market surveillance on the territory of the Member State concernedRegulation (EU) 2019/1020 Art. 3(4) and with the other national public authorities or bodies referred to in Article 77(1).
Where, in the course of that evaluation, the market surveillance authoritymarket surveillance authorityAny national authority responsible for carrying out market surveillance on the territory of the Member State concernedRegulation (EU) 2019/1020 Art. 3(4) or, where applicable the market surveillance authoritymarket surveillance authorityAny national authority responsible for carrying out market surveillance on the territory of the Member State concernedRegulation (EU) 2019/1020 Art. 3(4) in cooperation with the national public authority referred to in Article 77(1), finds that the AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) does not comply with the requirements and obligations laid down in this Regulation, it shall without undue delay require the relevant operatoroperatormeans a provider, product manufacturer, deployer, authorised representative, importer or distributorArticle 3(8) to take all appropriate corrective actions to bring the AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) into compliance, to withdraw the AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) from the market, or to recall it within a period the market surveillance authoritymarket surveillance authorityAny national authority responsible for carrying out market surveillance on the territory of the Member State concernedRegulation (EU) 2019/1020 Art. 3(4) may prescribe, and in any event within the shorter of 15 working days, or as provided for in the relevant Union harmonisation legislation.
The market surveillance authoritymarket surveillance authorityAny national authority responsible for carrying out market surveillance on the territory of the Member State concernedRegulation (EU) 2019/1020 Art. 3(4) shall inform the relevant notified bodynotified bodymeans a conformity assessment body notified in accordance with this Regulation and other relevant Union harmonisation legislationArticle 3(22) accordingly. Article 18 of Regulation (EU) 2019/1020 shall apply to the measures referred to in the second subparagraph of this paragraph.
3.
Where the market surveillance authoritymarket surveillance authorityAny national authority responsible for carrying out market surveillance on the territory of the Member State concernedRegulation (EU) 2019/1020 Art. 3(4) considers that the non-compliance is not restricted to its national territory, it shall inform the Commission and the other Member States without undue delay of the results of the evaluation and of the actions which it has required the operatoroperatormeans a provider, product manufacturer, deployer, authorised representative, importer or distributorArticle 3(8) to take.
4.
The operatoroperatormeans a provider, product manufacturer, deployer, authorised representative, importer or distributorArticle 3(8) shall ensure that all appropriate corrective action is taken in respect of all the AI systems concerned that it has made available on the Union market.
5.
Where the operatoroperatormeans a provider, product manufacturer, deployer, authorised representative, importer or distributorArticle 3(8) of an AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) does not take adequate corrective action within the period referred to in paragraph 2, the market surveillance authoritymarket surveillance authorityAny national authority responsible for carrying out market surveillance on the territory of the Member State concernedRegulation (EU) 2019/1020 Art. 3(4) shall take all appropriate provisional measures to prohibit or restrict the AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1)’s being made available on its national market or put into service, to withdraw the product or the standalone AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) from that market or to recall it. That authority shall without undue delay notify the Commission and the other Member States of those measures.
6.
The notification referred to in paragraph 5 shall include all available details, in particular the information necessary for the identification of the non-compliant AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1), the origin of the AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) and the supply chain, the nature of the non-compliance alleged and the risk involved, the nature and duration of the national measures taken and the arguments put forward by the relevant operatoroperatormeans a provider, product manufacturer, deployer, authorised representative, importer or distributorArticle 3(8). In particular, the market surveillance authorities shall indicate whether the non-compliance is due to one or more of the following:
(a)
non-compliance with the prohibition of the AI practices referred to in Article 5;
(b)
a failure of a high-risk AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) to meet requirements set out in Chapter III, Section 2;
(c)
shortcomings in the harmonised standards or common specifications referred to in Articles 40 and 41 conferring a presumption of conformity;
(d)
non-compliance with Article 50.
7.
The market surveillance authorities other than the market surveillance authoritymarket surveillance authorityAny national authority responsible for carrying out market surveillance on the territory of the Member State concernedRegulation (EU) 2019/1020 Art. 3(4) of the Member State initiating the procedure shall, without undue delay, inform the Commission and the other Member States of any measures adopted and of any additional information at their disposal relating to the non-compliance of the AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) concerned, and, in the event of disagreement with the notified national measure, of their objections.
8.
Where, within three months of receipt of the notification referred to in paragraph 5 of this Article, no objection has been raised by either a market surveillance authoritymarket surveillance authorityAny national authority responsible for carrying out market surveillance on the territory of the Member State concernedRegulation (EU) 2019/1020 Art. 3(4) of a Member State or by the Commission in respect of a provisional measure taken by a market surveillance authoritymarket surveillance authorityAny national authority responsible for carrying out market surveillance on the territory of the Member State concernedRegulation (EU) 2019/1020 Art. 3(4) of another Member State, that measure shall be deemed justified. This shall be without prejudice to the procedural rights of the concerned operatoroperatormeans a provider, product manufacturer, deployer, authorised representative, importer or distributorArticle 3(8) in accordance with Article 18 of Regulation (EU) 2019/1020. The three-month period referred to in this paragraph shall be reduced to 30 days in the event of non-compliance with the prohibition of the AI practices referred to in Article 5 of this Regulation.
9.
The market surveillance authorities shall ensure that appropriate restrictive measures are taken in respect of the product or the AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) concerned, such as withdrawal of the product or the AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) from their market, without undue delay.