Article 3: Definitions

Official Statutory Text

Article 3 Definitions For the purposes of this Regulation, the following definitions apply: (1) ‘ AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deplo yment, and that, for explicitor implicitobjectives, inf ers, from the input it receives, how togenerate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments; (2) ‘risk’ means the combination of the probability of an occurrenceof harmand the severity of that harm; (3) ‘provider ’ means a natural or legal person, public authority , agencyor other bodythat develops an AI system or ageneral-purpose AI model or that has an AI system or ag eneral-purpose AI model developedand places iton the marketor puts the AI system into service under its own name or trademark, whether for pa ymentor freeof charg e; (4) ‘deplo yer ’ means a natural or legal person, public authority , agencyor other body using an AI system under its authority except where the AI system is used in the courseof a personal non-professional activity ; (5) ‘authorised representative ’ means a natural or legal person locatedor established in the Uni on who has receivedandaccepteda written mandate from a provider of an AI system or ag eneral-purpose AI model to, respectively , performand carry outon its behalf the obligations and procedures established bythis Regulation; (6) ‘importer ’ means a natural or legal person locatedor established in the Uni on that places on the market an AI system that bears the name or trademark of a natural or legal person established in a third country ; (7) ‘distr ibutor ’ means a natural or legal person in the supply chain, other than the provider or the importer , that makes an AI system available on the Union market ; (8) ‘operator ’ means a provider , product manufacturer , deployer , authorised representative, importer or distr ibutor; (9) ‘placing on the market ’ means the first making availableof an AI system or ageneral-purpo se AI model on the Uni on market ; (10) ‘making available on the market’ means the supply of an AI system or ag eneral-purpose AI model for distribution or use on the Uni on market in the courseof a commercial activity , whetherin return for pa ymentor freeof ch arg e; (11) ‘putting into service ’ means the supply of an AI system for first use directlyto the deployer or for own use in the Uni on for itsintended purpose; (12) ‘int ended purpose’ means the use for whichan AI system isintended bythe provider , including the specific context and conditions of use, as specified in the information supplied bythe providerin the instructions for use, promotional or sales materials and stat ements, as well asin thetechnical documentation; (13) ‘reasonably foreseeable misuse’ means the useof an AI system in awaythat is not in accordance with itsintended purpose, but which may result from reasonably foreseeable human behaviour or interaction with other systems, including other AI systems; (14) ‘safety component’ means a componentof a productor of an AI system which fulfils a safety function for that productor AI system, or the failure or malfunctioning of which endangers the healthand safety of persons or property ; (15) ‘instructions for use ’ means the information provided bythe provider to inform the deployer of, in particular , an AI system’sintended purpose and proper use; (16) ‘recall of an AI system’ means any measure aiming to achieve the return to the provider or taking outof service or disabling the useof an AI system made available to deplo yers; (17) ‘withdrawal of an AI system’ means any measure aiming to prevent an AI system in the supply chain being made available on the market ; (18) ‘performanceof an AI system’ means the ability of an AI system to achieve itsintended purpose; (19) ‘notifying authority’ means the national authority responsible for setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring; (20) ‘conformity assessment’ means the process of demonstrating whether the requirements setout in Chapter III, Section 2 relating to a high-risk AI system have been fulfilled; (21) ‘conformity assessment body’ means a bodythat performs third-par ty conformity assessment activities, including testing, certification and inspection; (22) ‘notified body’ means a conformity assessment body notified in accordance with this Regulation and other relevant Uni on harmonisation legislation; (23) ‘substantial modifi cation’ means achange to an AI system after its placing on the marketor putting into service which is not foreseen or planned in the initial conformity assessment carried outbythe provider andas aresultof which the complianceof the AI system with the requirements setout in Chapter III, Section 2 is affectedor resultsin a modification to the intended purpose for which the AI system has been assessed; (24) ‘CE marking’ means a marking by which a providerindicates that an AI system isinconformity with the requirements setout in Chapter III, Section 2 and other applicable Uni on harmonisation legislation providing for its affixing; (25) ‘post-market monitoring system’ means all activities carried out by providers of AI systems to collect and review experience gained from the useof AI systems they place on the marketor put into service for the purposeof identifying any need to immediately apply any necessary corrective or preventive actions; (26) ‘market surveillance authority’ means the national authority carrying out the activities and taking the measures pursuant to Regulation (EU) 2019/1020; (27) ‘harmonised standard’ means a harmonised standardas defined in Article 2(1), point (c), of Regulation (EU) No 1025/2012; (28) ‘common specification’ means a setof technical specifications as defined in Article 2, point (4) of Regulation (EU) No 1025/2012, providing means to comply with certain requirements established under this Regulation; (29) ‘training data’ means data used for training an AI system through fitting its learnable parameters; (30) ‘validation data’ means data used for providing an evaluation of the trained AI systemand for tuning its non-learnable parameters and its learning processin order , inter alia, to prevent underfitting or over fitting; (31) ‘validation data set’ means a separatedata setor par tof the training data set, either as a fixedor variable split ; (32) ‘testing data’ means data used for providing an independent evaluation of the AI system in order to confirm the expected performanceof that system before its placing on the marketor putting into service; (33) ‘in put data’ means data provided to or directly acquired by an AI system on the basis of which the system produces an output ; (34) ‘biometric data’ means personal dataresulting from specific technical processing relating to the physical , physiological or behavioural characteristics of a natural person, such as facial images or dactyloscopic data; (35) ‘biometric identification’ means the automated recognition of physical, physiological, behavioural, or psychological human features for the purposeof establishing the identity of a natural person by comparing biometric data of that individual to biometric data of individuals stored in a database; (36) ‘biometric ver ificati on’ means the automa ted, one-to-one ver ification, including authentication, of the identity of natural persons by comparing their biometric data to previously provided biometric data; (37) ‘special categories of personal data’ means the categories of personal datarefer red to in Article 9(1) of Regulation (EU) 2016/679, Article 10 of Directive (EU) 2016/680 and Article 10(1) of Regulation (EU) 2018/1725; (38) ‘sensitive operational data’ means operational datarelated to activities of prevention, detection, investigation or prosecution of criminal offences, the disclosureof which could jeopardise the integrity of criminal proceedings; (39) ‘emotion recognition system’ means an AI system for the purposeof identifying or inferring emotions or intentions of natural persons on the basis of their biometric data; (40) ‘biometric categorisation system’ means an AI system for the purposeof assigning natural persons to specific categories on the basis of their biometric data, unless it is ancillaryto another commercial service and strictly necessary for objective technical reasons; (41) ‘remote biometric identification system’ means an AI system for the purposeof identifying natural persons, without their active in volvement, typically at a distance through the comparison of a person’s biometric data with the biometric data contained in areference database; (42) ‘real-time remote biometric identification system’ means aremote biometric identification system, wherebythe capturing of biometric data, the comparison and the identification all occur without a significant delay , comprising notonly instant identification, but also limited short delaysin order to avoid circum vention; (43) ‘post-remote biometric identification system’ means aremote biometric identification system other than areal-time remote biometric identification system; (44) ‘publicly accessible space ’ means any publiclyor privately owned physical place accessible to an undetermined number of natural persons, regardless of whether certain conditions for access may apply , and regard less of the potential capacity restr ictions; (45) ‘law enforcement authority’ means: (a) any public authority competent for the prevention, invest igation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding againstand the prevention of threats to public security ; or (b) any other bodyor entity entrusted by Member State law to exercise public authority and public powers for the purposes of the prevention, investig ation, detect ion or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security ; (46) ‘law enforcement’ means activities carried out by law enforcement authorities or on their behalf for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security ; (47) ‘ AI Off ice’ means the Commission’s function of contributing to the im plementation, monitoring and super vision of AI systems and general-purpose AI models, and AI gover nance, provided for in Commission Decision of 24 January 2024; referencesin this Regulation to the AI Office shall be construedas references to the Commission; (48) ‘national competent authority’ means a notifying authorityor a market surveillance authority ; as regardsai systems put into service or used by Union institutions, agencies, offices and bodies, references to national competent authorities or market surveillance authoritiesin this Regulation shall be construedas references to the European Data Protection Supervisor ; (49) ‘seriousincident ’ means an incidentor malfunctioning of an AI system that directlyor indirectly leads to any of the following: (a) the death of a person, or serious harm to a person’s health; (b) a serious and irreversible disruption of the managem entor operation of critical infrastructure; (c) the infringementof obligations under Uni on law intended to protect fundamental rights; (d) serious harm to propertyor the environment ; (50) ‘personal data’ means personal data as defined in Article 4, point (1), of Regulation (EU) 2016/679; (51) ‘non-personal data’ means data other than personal data as defined in Article 4, point (1), of Regulation (EU) 2016/679; (52) ‘profiling’ means profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679; (53) ‘real-w orld testing plan’ means a document that describes the objectives, methodology , g eographical, population and temporal scope, monitoring, organisation and conductof testing in real-world conditions; (54) ‘sandbox plan’ means a document agreed between the participating provider and the competent authority describing the objectives, conditions, timeframe, methodology and requirements for the activities carried out within the sandbox; (55) ‘ AI regulatory sandbox’ means a controlled framework set up by a competent authority which offers providers or prospective providers of AI systems the possibilityto develop, train, validate and te st, where appropriate in real-wo rld conditions, an innovative AI system, pursuant to a sandbox plan for a limited time under regulatory super vision; (56) ‘ AI literacy’ means skills, knowledge and understanding that allow providers, deployers andaffected persons, taking into account their respective rights and obligationsin the contextof this Regulation, to make an informed deplo ymentof AI systems, as well as togain awareness about the opportunities and risks of AI and possible harmit can cause; (57) ‘testing in real-world conditions’ means thetemporarytesting of an AI system for itsintended purpose in real-wo rld conditions outside a laboratoryor other wise simulated envir onment, with a view togathering reliable and robust data and to assessing and verifying the conformity of the AI system with the requirements of this Regulation and it does not qualify as placing the AI system on the marketor putting it into service within the meaning of this Regulation, provided that all the conditions laid down in Article 57 or 60 are fulf illed; (58) ‘subject’, for the purposeof real-world testing, means a natural person who participatesin testing in real-wo rld conditions; (59) ‘informed consent’ means a subject’s freely given, specific, unambiguous and voluntary expression of his or her willingness to participate in a particular testing in real-world conditions, after having been informed of all aspects of thetesting that are relevant to the subject ’s decision to participate ; (60) ‘deep fake ’ meansai-generatedor manipulated imag e, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or tr uthful; (61) ‘widespread infringement’ means any actor omission contraryto Union law protecting the interestof individuals, which : (a) has harmedor is likelyto harm the collective interests of individuals residing in at least two Member States other than the Member State in which: (i) the actor omission originatedor took place; (ii) the provider concer ned, or , where applicable, its authorised representative is locatedor established; or (iii) the deployer is established, when the infringement is committed bythe deployer; (b) has caused, causes or is likelyto cause harm to the collective interests of individuals and has common features, including the same unlawful practice or the same interest being infringed, and is occurring concurrently , committed bythe same operator , in at least three Member States; (62) ‘critical infrastructure’ means critical infrastructure as defined in Article 2, point (4), of Directive (EU) 2022/2557; (63) ‘g eneral-purpose AI model’ means an AI model, including where suchan AI model is trained with alarge amountof data using self-super vision at scale, that displays significant generality and is capableof competently performing a wide rangeof distinct tasks regardless of the waythe model is placedon the market and that can be integrated into a variety of downstream systems or applications, except AI models that are used for research, developmentor prototyping activities before theyare placedon the market ; (64) ‘high-imp act capabilities ’ means capabilities that matchor exceed the capabilities recorded in the most advanced g eneral-purpose AI models; (65) ‘systemic risk’ means arisk that is specific to the high-im pact capabilities of g eneral-purpose AI models, having a significant im pacton the Uni on market due to their reac h, or due to actual or reasonably foreseeable negative effects on public health, safety , public security , fundamental rights, or the society as a whole, that can be propagatedat scale across the value chain; (66) ‘g eneral-purpose AI system’ means an AI system which is basedon ag eneral-purpose AI model and which has the capabilityto serve a variety of purposes, both for direct use as well as for integration in other AI systems; (67) ‘f loating-pointoperation’ means any mathematical operation or assignment involving f loating-point numbers, which are a subsetof the real numbers typically representedon computers by an integer of fixed precision scaled by an integer exponentof a fixed base; (68) ‘downstream provider ’ means a provider of an AI system, including ag eneral-purpose AI system, which integrates an AI model, regardless of whether the AI model is provided bythemselves and vertically integratedor provided by another entity basedon contractual relations.