Source: OJ L, 2024/1689, 12.7.2024

Current language: EN

Article 41 Common specifications


Summary What does Article 41 of the AI act regulation say?

This article establishes a fallback mechanism that directly complements Article 40, which deals with harmonised standards.

Where the standard-setting process through European standardisation organisations breaks down — whether because a request goes unanswered, deadlines are missed, fundamental rights concerns are insufficiently addressed, or the resulting standard does not comply with the original request — the Commission is empowered to step in and adopt its own common specifications via implementing acts.

These common specifications serve the same compliance purpose as harmonised standards: AI systems or general-purpose AI models conforming to them are presumed to meet the relevant requirements.

The article also sets out what happens when a proper harmonised standard eventually arrives — the Commission must repeal any overlapping implementing acts — and gives providers a route to deviate from common specifications provided they can justify an equivalent level of compliance.

Important points:

  • The Commission is empowered to adopt common specifications only when the harmonised standardisation process under Article 40 has failed or produced inadequate results — it is a fallback, not a first resort.
  • Providers of high-risk AI systems or general-purpose AI models that do not comply with adopted common specifications must justify that their alternative technical solutions meet the underlying requirements to an equivalent level.
  • Member States can challenge a common specification by informing the Commission with a detailed explanation, which the Commission must assess and, where appropriate, act upon by amending the relevant implementing act.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

    1. The Commission may adopt, implementing acts establishing common specifications for the requirements set out in Section 2 of this Chapter or, as applicable, for the obligations set out in Sections 2 and 3 of Chapter V where the following conditions have been fulfilled:

      1. the Commission has requested, pursuant to Article 10(1) of Regulation (EU) No 1025/2012, one or more European standardisation organisations to draft a harmonised standard for the requirements set out in Section 2 of this Chapter, or, as applicable, for the obligations set out in Sections 2 and 3 of Chapter V, and:

        1. the request has not been accepted by any of the European standardisation organisations; or

        2. the harmonised standards addressing that request are not delivered within the deadline set in accordance with Article 10(1) of Regulation (EU) No 1025/2012; or

        3. the relevant harmonised standards insufficiently address fundamental rights concerns; or

        4. the harmonised standards do not comply with the request; and

      2. no reference to harmonised standards covering the requirements referred to in Section 2 of this Chapter or, as applicable, the obligations referred to in Sections 2 and 3 of Chapter V has been published in the Official Journal of the European Union in accordance with Regulation (EU) No 1025/2012, and no such reference is expected to be published within a reasonable period.

    2. When drafting the common specifications, the Commission shall consult the advisory forum referred to in Article 67.

    3. The implementing acts referred to in the first subparagraph of this paragraph shall be adopted in accordance with the examination procedure referred to in Article 98(2).

    1. Before preparing a draft implementing act, the Commission shall inform the committee referred to in Article 22 of Regulation (EU) No 1025/2012 that it considers the conditions laid down in paragraph 1 of this Article to be fulfilled.

    1. High-risk AI systems or general-purpose AI models which are in conformity with the common specifications referred to in paragraph 1, or parts of those specifications, shall be presumed to be in conformity with the requirements set out in Section 2 of this Chapter or, as applicable, to comply with the obligations referred to in Sections 2 and 3 of Chapter V, to the extent those common specifications cover those requirements or those obligations.

    1. Where a harmonised standard is adopted by a European standardisation organisation and proposed to the Commission for the publication of its reference in the Official Journal of the European Union, the Commission shall assess the harmonised standard in accordance with Regulation (EU) No 1025/2012. When reference to a harmonised standard is published in the Official Journal of the European Union, the Commission shall repeal the implementing acts referred to in paragraph 1, or parts thereof which cover the same requirements set out in Section 2 of this Chapter or, as applicable, the same obligations set out in Sections 2 and 3 of Chapter V.

    1. Where providers of high-risk AI systems or general-purpose AI models do not comply with the common specifications referred to in paragraph 1, they shall duly justify that they have adopted technical solutions that meet the requirements referred to in Section 2 of this Chapter or, as applicable, comply with the obligations set out in Sections 2 and 3 of Chapter V to a level at least equivalent thereto.

    1. Where a Member State considers that a common specification does not entirely meet the requirements set out in Section 2 or, as applicable, comply with obligations set out in Sections 2 and 3 of Chapter V, it shall inform the Commission thereof with a detailed explanation. The Commission shall assess that information and, if appropriate, amend the implementing act establishing the common specification concerned.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod