Changes from plenary report to adopted text

Article 70 – paragraph 2 – introductory part: 2. Without prejudice to paragraphs 1 and 1a, information exchanged on a confidential basis between the national competent authorities and between national competent authorities and the Commission shall not be disclosed without the prior consultation of the originating national competent authority and the deployer when high-risk AI systems referred to in points 1, 6 and 7 of Annex III are used by law enforcement, immigration or asylum authorities, when such disclosure would jeopardise public or national security.

Article 70 – paragraph 3: 3. Paragraphs 1, 1a and 2 shall not affect the rights and obligations of the Commission, Member States and notified bodies with regard to the exchange of information and the dissemination of warnings, nor the obligations of the parties concerned to provide information under criminal law of the Member States;

Article 70 – paragraph 4: 4. The Commission and Member States may exchange, where strictly necessary and in accordance with relevant provisions of international and trade agreements, confidential information with regulatory authorities of third countries with which they have concluded bilateral or multilateral confidentiality arrangements guaranteeing an adequate level of confidentiality.

Article 71 – title: Penalties

Article 71 – paragraph 1: 1. In compliance with the terms and conditions laid down in this Regulation, Member States shall lay down the rules on penalties, applicable to infringements of this Regulation by any operator, and shall take all measures necessary to ensure that they are properly and effectively implemented and aligned with the guidelines issued by the Commission and the AI Office pursuant to Article 82b. The penalties provided for shall be effective, proportionate, and dissuasive. They shall take into account the interests of SMEs and start-ups and their economic viability;

Article 71 – paragraph 2: 2. The Member States shall notify the Commission and the Office by [ 12 months after the date of entry into force of this Regulation] of those rules and of those measures and shall notify them, without delay, of any subsequent amendment affecting them.

Article 71 – paragraph 3 – introductory part: 3. Non compliance with the prohibition of the artificial intelligence practices referred to in Article 5 shall be subject to administrative fines of up to 40 000 000 EUR or, if the offender is a company, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher:

Article 71 – paragraph 3 – point a: deleted

Article 71 – paragraph 3 – point b: deleted

Article 71 – paragraph 3 a (new): 3 a. Non-compliance of the AI system with the requirements laid down in Article 10 and 13 shall be subject to administrative fines of up to EUR 20 000 000 or, if the offender is a company, up to 4% of its total worldwide annual turnover for the preceding financial year, whichever is the higher.

Article 71 – paragraph 4: 4. Non-compliance of the AI system or foundation model with any requirements or obligations under this Regulation, other than those laid down in Articles 5, 10 and 13, shall be subject to administrative fines of up to EUR 10 000 000 or, if the offender is a company, up to 2% of its total worldwide annual turnover for the preceding financial year, whichever is higher;

Article 71 – paragraph 5: 5. The supply of incorrect, incomplete or misleading information to notified bodies and national competent authorities in reply to a request shall be subject to administrative fines of up to 5 000 000 EUR or, if the offender is a company, up to 1 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.

Article 71 – paragraph 6 – introductory part: 6. Fines may be imposed in addition to or instead of non-monetary measures such as orders or warnings. When deciding on the amount of the administrative fine in each individual case, all relevant circumstances of the specific situation shall be taken into account and due regard shall be given to the following;

Article 71 – paragraph 6 – point a: (a) the nature, gravity and duration of the infringement and of its consequences, taking into account the purpose of the AI system, as well as, where appropriate, the number of affected persons and the level of damage suffered by them;

Article 71 – paragraph 6 – point b: (b) whether administrative fines have been already applied by other national supervisory authorities of one or more Member States to the same operator for the same infringement;

Article 71 – paragraph 6 – point c: (c) the size and annual turnover of the operator committing the infringement;

Article 71 – paragraph 6 – point c a (new): (c a) any action taken by the operator to mitigate the harm of damage suffered by the affected persons;

Article 71 – paragraph 6 – point c b (new): (c b) the intentional or negligent character of the infringement;

Article 71 – paragraph 6 – point c c (new): (c c) the degree of cooperation with the national competent authorities, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;

Article 71 – paragraph 6 – point c d (new): (c d) the degree of responsibility of the operator taking into account the technical and organisational measures implemented by them;

Article 71 – paragraph 6 – point c e (new): (c e) the manner in which the infringement became known to the national competent authorities, in particular whether, and if so to what extent, the operator notified the infringement;

Article 71 – paragraph 6 – point c f (new): (c f) adherence to approved codes of conduct or approved certification mechanisms;

Article 71 – paragraph 6 – point c g (new): (c g) any relevant previous infringements by the operator;

Article 71 – paragraph 6 – point c h (new): (c h) any other aggravating or mitigating factor applicable to the circumstances of the case.

Article 71 – paragraph 7: 7. each Member State shall lay down rules on administrative fines to be imposed on public authorities and bodies established in that Member State;

Article 71 – paragraph 8 a (new): 8 a. The penalties referred to in this article as well as the associated litigation costs and indemnification claims may not be the subject of contractual clauses or other form of burden-sharing agreements between providers and distributors, importers, deployers, or any other third parties;

Article 71 – paragraph 8 b (new): 8 b. National supervisory authorities shall, on an annual basis, report to the AI Office about the fines they have issued during that year, in accordance with this Article;

Article 71 – paragraph 8 c (new): 8 c. The exercise by competent authorities of their powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and national law, including judicial remedy and due process;

Article 72 – paragraph 1 – point a: (a) the nature, gravity and duration of the infringement and of its consequences;, taking into account the purpose of the AI system concerned as well as the number of affected persons and the level of damage suffered by them, and any relevant previous infringement;

Article 72 – paragraph 1 – point a a (new): (a a) any action taken by the Union institution, agency or body to mitigate the damage suffered by affected persons;

Article 72 – paragraph 1 – point a b (new): (a b) the degree of responsibility of the Union institution, agency or body, taking into account technical and organisational measures implemented by them;

Article 72 – paragraph 1 – point b: (b) the degree of cooperation with the European Data Protection Supervisor in order to remedy the infringement and mitigate the possible adverse effects of the infringement, including compliance with any of the measures previously ordered by the European Data Protection Supervisor against the Union institution or agency or body concerned with regard to the same subject matter;

Article 72 – paragraph 2 – introductory part: 2. Non compliance with the prohibition of the artificial intelligence practices referred to in Article 5 shall be subject to administrative fines of up to EUR 1 500 000.

Article 72 – paragraph 2 – point a: deleted

Article 72 – paragraph 2 a (new): 2 a. non-compliance of the AI system with the requirements laid down in Article 10 shall be subject to administrative fines of up to 1 000 000 EUR.

Article 72 – paragraph 3: 3. the non-compliance of the AI system with any requirements or obligations under this Regulation, other than those laid down in Articles 5 and 10, shall be subject to administrative fines of up to EUR 750 000.

Article 72 – paragraph 6: 6. Funds collected by imposition of fines in this Article shall contribute to the general budget of the Union. The fines shall not affect the effective operation of the Union institution, body or agency fined.

Article 72 – paragraph 6 a (new): 6 a. the European Data Protection Supervisor shall, on an annual basis, notify the AI Office of the fines it has imposed pursuant to this Article.

Article 73 – paragraph 2: 2. The power to adopt delegated acts referred to in Article 4, Article 7(1), Article 11(3), Article 43(5) and (6) and Article 48(5) shall be conferred on the Commission for a period of five years from … [the date of entry into force of the Regulation].The Commission shall draw up a report in respect of the delegation of power not later than 9 months before the end of the five-year period. The delegation of power shall be tacitly extended for periods of an identical duration, unless the European Parliament or the Council opposes such extension not later than three months before the end of each period.

Article 73 – paragraph 3 a (new): 3 a. Before adopting a delegated act, the Commission shall consult with the relevant institutions, the Office, the Advisory Forum and other relevant stakeholders in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making. / Once the Commission decides to draft a delegated act, it shall notify the European Parliament of this fact. This notification does not place an obligation on the Commission to adopt the said act.

Article 81 a (new): Article 81 a / Amendment to Regulation (EU) 2019/1020 / Regulation (EU) 2019/1020 is amended as follows: / in Article 14(4), the following paragraph is added: / “(l). the power to implement the powers provided for in this Article remotely, where applicable;”

Article 82 a (new): Article 82 a / Better Regulation / in taking into account the requirements of this Regulation pursuant to the Amendments in Articles 75, 76, 77, 78, 79, 80, 81, and 82, the Commission shall conduct an analysis and consult relevant stakeholders to determine potential gaps as well as overlaps between existing sectoral legislation and the provisions of this Regulation.

Article 82 b (new): Article 82 b / Guidelines from the Commission on the implementation of this Regulation / 1. The Commission shall develop, in consultation with the AI office, guidelines on the practical implementation of this Regulation, and in particular on: / (a) the application of the requirements referred to in Articles 8 - 15 and Article 28 to 28b; / (b) the prohibited practices referred to in Article 5; / (c) the practical implementation of the provisions related to substantial modification; / (d) the practical circumstances where the output of an AI system referred to in Annex III would pose a significant risk of harm to the health, safety or fundamental rights of natural persons as referred to in Article 6, paragraph 2, including examples in relation to high risk AI systems referred to in Annex III; / (e) the practical implementation of transparency obligations laid down in Article 52; / (f) the development of codes of conduct referred to in Article 69; / (g) the relationship of this Regulation with other relevant Union law, including as regards consistency in their enforcement. / (h) the practical implementation of Article 12, Article 28b on environmental impact of foundation models and Annex IV 3(b), particularly the measurement and logging methods to enable calculations and reporting of the environmental impact of systems to comply with the obligations in this Regulation, including carbon footprint and energy efficiency, taking into account state-of-the-art methods and economies of…

Article 83 – paragraph 1 – introductory part: 1. Operators of the AI systems which are components of the large-scale IT systems established by the legal acts listed in Annex IX that have been placed on the market or put into service prior to ... [the date of entry into force of this Regulation] shall take the necessary steps to comply with the requirements laid down in this Regulation by … [four years after the date of entry into force of this Regulation].

Article 83 – paragraph 1 – subparagraph 1: The requirements laid down in this Regulation shall be taken into account in the evaluation of each large-scale IT systems established by the legal acts listed in Annex IX to be undertaken as provided for in those respective acts and whenever those legal acts are replaced or amended.

Article 83 – paragraph 2: 2. This Regulation shall apply to operators of high-risk AI systems, other than the ones referred to in paragraph 1, that have been placed on the market or put into service before [date of application of this Regulation referred to in Article 85(2)], only if, from that date, those systems are subject to substantial modifications as defined in Article 3(23). In the case of high-risk AI systems intended to be used by public authorities, providers and deployers of such systems shall take the necessary steps to comply with the requirements of the present Regulation [two years after the date of entry into force of this Regulation].

Article 84 – paragraph 2: 2. By … [two years after the date of application of this Regulation referred to in Article 85(2)] and every two years thereafter, the Commission, together with the AI office, shall submit a report on the evaluation and review of this Regulation to the European Parliament and to the Council. The reports shall be made public.

Article 84 – paragraph 3 – point a: (a) the status of the financial, technical and human resources of the national competent authorities in order to effectively perform the tasks assigned to them under this Regulation;

Article 84 – paragraph 3 – point b a (new): (b a) the level of the development of harmonised standards and common specifications for Artificial Intelligence;

Article 84 – paragraph 3 – point b b (new): (b b) the levels of investments in research, development and application of AI systems throughout the Union;

Article 84 – paragraph 3 – point b c (new): (b c) the competitiveness of the aggregated European AI sector compared to AI sectors in third countries;

Article 84 – paragraph 3 – point b d (new): (b d) the impact of the Regulation with regards to the resource and energy use, as well as waste production and other environmental impact;

Article 84 – paragraph 3 – point b e (new): (b e) the implementation of the coordinated plan on AI, taking into account the different level of progress among Member States and identifying existing barriers to innovation in AI;

Article 84 – paragraph 3 – point b f (new): (b f) the update of the specific requirements regarding the sustainability of AI systems and foundation models, building on the reporting and documentation requirement in Annex IV and in Article 28b;

Article 84 – paragraph 3 – point b g (new): (b g) the legal regime governing foundation models;

Article 84 – paragraph 3 – point b h (new): (b h) the list of unfair contractual terms within Article 28a taking into account new business practices if necessary;

Article 84 – paragraph 3 a (new): 3 a. By ... [two years after the date of entry into application of this Regulation referred to in Article 85(2)] the Commission shall evaluate the functioning of the AI office, whether the office has been given sufficient powers and competences to fulfil its tasks and whether it would be relevant and needed for the proper implementation and enforcement of this Regulation to upgrade the Office and its enforcement competences and to increase its resources. The Commission shall submit this evaluation report to the European Parliament and to the Council.