‍Updated on April 10^th 2024 based on the version and article numbering approved by the EU Parliament on March 13^th 2024.

1. The Commission shall, in collaboration with the Member States, set up and maintain an EU database containing information referred to in paragraphs 2 and 3 of this Article concerning high-risk AI systems referred to in Article 6(2) which are registered in accordance with Articles 49 and 60. When setting the functional specifications of such database, the Commission shall consult the relevant experts, and when updating the functional specifications of such database, the Commission shall consult the Board.

2. The data listed in Section A of Annex VIII shall be entered into the EU database by the provider or, where applicable, by the authorised representative.

3. The data listed in Section C of Annex VIII shall be entered into the EU database by the deployer who is, or who acts on behalf of, a public authority, agency or body, in accordance with Articles 49(2) and (3).

4. With the exception of the section referred to in Article 49(4) and Article 60(5), the information contained in the EU database registered in accordance with Article 49 shall be accessible and publicly available in a user-friendly manner. The information should be easily navigable and machine-readable. The information registered in accordance with Article 60 shall be accessible only to market surveillance authorities and the Commission, unless the prospective provider or provider has given consent for also making the information accessible the public.

5. The EU database shall contain personal data only in so far as necessary for collecting and processing information in accordance with this Regulation. That information shall include the names and contact details of natural persons who are responsible for registering the system and have the legal authority to represent the provider or the deployer, as applicable.

6. The Commission shall be the controller of the EU database. It shall make available to providers, prospective providers and deployers adequate technical and administrative support. The EU database shall comply with the applicable accessibility requirements.

‍

[Previous version]

Updated on Feb 6^th 2024 based on the version endorsed by the Coreper I on Feb 2^nd

Penalties

1. In compliance with the terms and conditions laid down in this Regulation, Member States shall lay down the rules on penalties and other enforcement measures, which may also include warnings and non-monetary measures, applicable to infringements of this Regulation by operators, and shall take all measures necessary to ensure that they are properly and effectively implemented and taking into account the guidelines issued by the Commission pursuant to Article 82b. The penalties provided for shall be effective, proportionate, and dissuasive. They shall take into account the interests of SMEs including start-ups and their economic viability.

2. The Member States shall without delay notify the Commission and at the latest by the date of entry into application of those respective rules and of those respective measures and shall notify them, without delay, of any subsequent amendment affecting them.

3. Non-compliance with the prohibition of the artificial intelligence practices referred to in Article 5 shall be subject to administrative fines of up to 35 000 000 EUR or, if the offender is a company, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.

4. Non-compliance of an AI system with any of the following provisions related to operators or notified bodies, other than those laid down in Articles 5, shall be subject to administrative fines of up to 15 000 000 EUR or, if the offender is a company, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher:

b. obligations of providers pursuant to Article 16;

d. obligations of authorised representatives pursuant to Article 25;

e. obligations of importers pursuant to Article 26;

f. obligations of distributors pursuant to Article 27;

g. obligations of deployers pursuant to Article 29, paragraphs 1 to 6a;

h. requirements and obligations of notified bodies pursuant to Article 33, 34(1), 34(3), 34(4), 34a;

i. transparency obligations for providers and users pursuant to Article 52.

5. The supply of incorrect, incomplete or misleading information to notified bodies and national competent authorities in reply to a request shall be subject to administrative fines of up to 7 500 000 EUR or, if the offender is a company, up to 1 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.

5a. In case of SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to paragraphs 3, 4 and 5, whichever of the two is lower.

6. When deciding whether to impose an administrative fine and on the amount of the administrative fine in each individual case, all relevant circumstances of the specific situation shall be taken into account and, as appropriate, regard shall be given to the following:

a, the nature, gravity and duration of the infringement and of its consequences, taking into account the purpose of the AI system, as well as, where appropriate, the number of affected persons and the level of damage suffered by them;

b. whether administrative fines have been already applied by other market surveillance authorities of one or more Member States to the same operator for the same infringement;

ba. whether administrative fines have been already applied by other authorities to the same operator for infringements of other Union or national law, when such infringements result from the same activity or omission constituting a relevant infringement of this Act;

c. the size, the annual turnover and market share of the operator committing the infringement;

ca. any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement;

ca. the degree of cooperation with the national competent authorities, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;

cb. the degree of responsibility of the operator taking into account the technical and organisational measures implemented by them;

ce. the manner in which the infringement became known to the national competent authorities, in particular whether, and if so to what extent, the operator notified the infringement;

cf. the intentional or negligent character of the infringement;

cg. any action taken by the operator to mitigate the harm of damage suffered by the affected persons.

7. Each Member State shall lay down rules on to what extent administrative fines may be imposed on public authorities and bodies established in that Member State.

8. Depending on the legal system of the Member States, the rules on administrative fines may be applied in such a manner that the fines are imposed by competent national courts or other bodies as applicable in those Member States. The application of such rules in those Member States shall have an equivalent effect.

8a. The exercise by the market surveillance authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process.

8b. Member States shall, on an annual basis, report to the Commission about the administrative fines they have issued during that year, in accordance with this Article, and any related litigation or judicial proceedings;