DORA, NIS 2, RGPD, CRA, AI Act : une conformité que vous pouvez démontrer.

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union . It shall apply from 17 January 2025.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

Without prejudice to paragraphs 3 and 4, this Regulation applies to the following entities:

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

credit institutions;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

investment firms;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

managers of alternative investment funds;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

management companies;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

insurance and reinsurance undertakings;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

ICT third-party service providers.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

This Regulation does not apply to:

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

Member States may exclude from the scope of this Regulation entities referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU that are located within their respective territories. Where a Member State makes use of such option, it shall inform the Commission thereof as well as of any subsequent changes thereto. The Commission shall make that information publicly available on its website or other easily accessible means.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework referred to in Article 6(1). For the purposes of the first subparagraph, the management body shall:

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively and to ensure a high level of digital operational resilience.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article. Where a financial entity is subject to supervision by more than one national competent authority referred to in Article 46, Member States shall designate a single competent authority as the relevant competent authority responsible for carrying out the functions and duties provided for in this Article. Credit institutions classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, shall report major ICT-related incidents to the relevant national competent authority designated in accordance with Article 4 of Directive 2013/36/EU, which shall immediately transmit that report to the ECB. For the purpose of the first subparagraph, financial entities shall produce, after collecting and analysing all relevant information, the initial notification and reports referred to in paragraph 4 of this Article using the templates referred to in Article 20 and submit them to the competent authority. In the event that a technical impossibility prevents the submission of the initial notification using the template, financial entities shall notify the competent authority about it via alternative means. The initial notification and reports referred to in paragraph 4 shall include all information necessary for the competent authority to determine the significance of the major ICT-related incident and assess possible cross-border impacts. Without prejudice to the reporting pursuant to the first subparagraph by the financial entity to the relevant competent authority, Member States may additionally determine that some or all financial entities shall also provide the initial notification and each report referred to in paragraph 4 of this Article using the templates referred to in Article 20 to the competent authorities or the computer security incident response teams (CSIRTs) designated or established in accordance with Directive (EU) 2022/2555.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures, financial entities, other than microenterprises, shall, taking into account the criteria set out in Article 4(2), establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk-management framework referred to in Article 6.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

Financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, which are identified in accordance with paragraph 8, third subparagraph, of this Article, shall carry out at least every 3 years advanced testing by means of TLPT. Based on the risk profile of the financial entity and taking into account operational circumstances, the competent authority may, where necessary, request the financial entity to reduce or increase this frequency.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

As part of their ICT risk management framework, financial entities shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers. The contractual arrangements referred to in the first subparagraph shall be appropriately documented, distinguishing between those that cover ICT services supporting critical or important functions and those that do not. Financial entities shall report at least yearly to the competent authorities on the number of new arrangements on the use of ICT services, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions which are being provided. Financial entities shall make available to the competent authority, upon its request, the full register of information or, as requested, specified sections thereof, along with any information deemed necessary to enable the effective supervision of the financial entity. Financial entities shall inform the competent authority in a timely manner about any planned contractual arrangement on the use of ICT services supporting critical or important functions as well as when a function has become critical or important.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

‘ICT third-party service provider’ means an undertaking providing ICT services;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

This Directive applies to public or private entities of a type referred to in Annex I or II which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article, and which provide their services or carry out their activities within the Union. Article 3(4) of the Annex to that Recommendation shall not apply for the purposes of this Directive.

Force normative

droit UE à transposer (directive) — non directement applicable, exige une transposition nationale

Source

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)

Version

CELEX 32022L2555 — ELI dir/2022/2555

Regardless of their size, this Directive also applies to entities of a type referred to in Annex I or II, where:

Force normative

droit UE à transposer (directive) — non directement applicable, exige une transposition nationale

Source

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)

Version

CELEX 32022L2555 — ELI dir/2022/2555

For the purposes of this Directive, the following entities shall be considered to be essential entities:

Force normative

droit UE à transposer (directive) — non directement applicable, exige une transposition nationale

Source

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)

Version

CELEX 32022L2555 — ELI dir/2022/2555

For the purposes of this Directive, entities of a type referred to in Annex I or II which do not qualify as essential entities pursuant to paragraph 1 of this Article shall be considered to be important entities. This includes entities identified by Member States as important entities pursuant to Article 2(2), points (b) to (e).

Force normative

droit UE à transposer (directive) — non directement applicable, exige une transposition nationale

Source

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)

Version

CELEX 32022L2555 — ELI dir/2022/2555

Les entités [importantes ou essentielles] réalisent et maintiennent à jour une liste de l’ensemble de leurs activités et services ainsi que des systèmes d’information y contribuant. Ces entités sont tenues d’appliquer les [objectifs de sécurité] sur l’ensemble de leurs systèmes d’information, à l’exception de ceux pour lesquels elles justifient, sur la base d’une analyse de risques, qu’ils ne sont pas exposés à l’un des risques suivants : 1. La dégradation ou l'interruption, directe ou indirecte, des activités ou services de l'entité ; 2. La divulgation à des personnes non autorisées d'informations sensibles traitées par les activités ou services de l'entité ; 3. L'altération des informations nécessaires aux activités ou services de l'entité. La mise en œuvre de mesures de sécurité sur ces systèmes d’information ne permet pas de justifier qu’ils ne sont exposés à aucun des risques précités. Pour ces systèmes d’information, le choix de ne pas appliquer les objectifs de sécurité ainsi que sa justification au regard des critères précédents doivent apparaître explicitement dans la liste mentionnée au premier alinéa.

Force normative

obligation (décret, PJL résilience)

Source

ReCyF — Référentiel Cyber France (NIS 2, transposition nationale)

Version

2.5 du 17/03/2026 (version de travail)

Statut

Version de travail : non opposable tant que la transposition n’est pas promulguée

Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article. The application of this paragraph shall be without prejudice to national law as regards the liability rules applicable to public institutions, as well as the liability of public servants and elected or appointed officials.

Force normative

droit UE à transposer (directive) — non directement applicable, exige une transposition nationale

Source

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)

Version

CELEX 32022L2555 — ELI dir/2022/2555

Les entités [importantes et essentielles] définissent un cadre de gouvernance de la sécurité numérique placé sous la responsabilité du dirigeant exécutif. Le cadre de gouvernance de la sécurité numérique consiste en la mise en place, au sein des entités [importantes et essentielles] : 1. D’une organisation ; 2. De rôles et responsabilités en matière de sécurité numérique ; 3. De processus de gestion de la conformité ; 4. D’une politique de sécurité des systèmes d’information et des politiques comprenant au minimum des dispositions en matière d’usage du chiffrement, de contrôle d’accès physique et logique et de revue de l’application des mesures de sécurité mises en œuvre. Les entités [importantes et essentielles] : - réalisent une analyse de leur conformité vis-à-vis des dispositions [pointer vers les dispositions du décret correspondant aux objectifs de sécurité], - identifient les éventuels écarts existants par rapport aux objectifs de sécurité et, - établissent et suivent dans la durée un plan d’action pour corriger chacun de ces écarts dans les meilleurs délais. Ce plan d’action est adapté à la structure de l’entité et à son environnement. La responsabilité de ce plan d’action est déterminée au regard du cadre de gouvernance de la sécurité numérique mis en place. Les entités essentielles établissent ce plan d’action en tenant compte de l’analyse de risques qu’elles sont tenues de réaliser en application de [l’objectif 16]. Ce plan d’action ne préjuge pas de l’appréciation du respect de ses obligations légales et règlementaires lors d’un contrôle par l’ANSSI.

Force normative

obligation (décret, PJL résilience)

Source

ReCyF — Référentiel Cyber France (NIS 2, transposition nationale)

Version

2.5 du 17/03/2026 (version de travail)

Statut

Version de travail : non opposable tant que la transposition n’est pas promulguée

Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services. Taking into account the state-of-the-art and, where applicable, relevant European and international standards, as well as the cost of implementation, the measures referred to in the first subparagraph shall ensure a level of security of network and information systems appropriate to the risks posed. When assessing the proportionality of those measures, due account shall be taken of the degree of the entity’s exposure to risks, the entity’s size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact.

Force normative

droit UE à transposer (directive) — non directement applicable, exige une transposition nationale

Source

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)

Version

CELEX 32022L2555 — ELI dir/2022/2555

policies on risk analysis and information system security;

Force normative

droit UE à transposer (directive) — non directement applicable, exige une transposition nationale

Source

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)

Version

CELEX 32022L2555 — ELI dir/2022/2555

Les entités [essentielles] mettent en œuvre une approche par les risques placée sous la responsabilité du dirigeant exécutif et leur permettant : 1. de prendre connaissance et de suivre l’évolution des risques pesant sur leurs systèmes d’information ; 2. de définir et suivre la mise en œuvre des mesures de sécurité pour maîtriser ces risques ; 3. d’accepter les risques résiduels.

Force normative

obligation (décret, PJL résilience)

Source

ReCyF — Référentiel Cyber France (NIS 2, transposition nationale)

Version

2.5 du 17/03/2026 (version de travail)

Statut

Version de travail : non opposable tant que la transposition n’est pas promulguée

human resources security, access control policies and asset management;

Force normative

droit UE à transposer (directive) — non directement applicable, exige une transposition nationale

Source

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)

Version

CELEX 32022L2555 — ELI dir/2022/2555

supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;

Force normative

droit UE à transposer (directive) — non directement applicable, exige une transposition nationale

Source

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)

Version

CELEX 32022L2555 — ELI dir/2022/2555

Les entités [importantes ou essentielles] réalisent et maintiennent à jour une liste des prestataires et fournisseurs informatiques intervenant dans la réalisation de leurs activités ou dans la fourniture de leurs services et avec lesquels il existe une relation de droit ou de fait ainsi que le périmètre et la nature de la prestation ou du service fourni. Les entités [importantes ou essentielles] mettent en place des processus visant à s’assurer, notamment par la voie contractuelle de la conformité des prestations informatiques dont elles bénéficient aux obligations auxquelles l’entité est assujettie notamment en matière de gestion des risques qui menacent la sécurité de leurs réseaux et systèmes d’information et de notification des incidents importants.

Force normative

obligation (décret, PJL résilience)

Source

ReCyF — Référentiel Cyber France (NIS 2, transposition nationale)

Version

2.5 du 17/03/2026 (version de travail)

Statut

Version de travail : non opposable tant que la transposition n’est pas promulguée

incident handling;

Force normative

droit UE à transposer (directive) — non directement applicable, exige une transposition nationale

Source

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)

Version

CELEX 32022L2555 — ELI dir/2022/2555

without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning, which, where applicable, shall indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;

Force normative

droit UE à transposer (directive) — non directement applicable, exige une transposition nationale

Source

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)

Version

CELEX 32022L2555 — ELI dir/2022/2555

without undue delay and in any event within 72 hours of becoming aware of the significant incident, an incident notification, which, where applicable, shall update the information referred to in point (a) and indicate an initial assessment of the significant incident, including its severity and impact, as well as, where available, the indicators of compromise;

Force normative

droit UE à transposer (directive) — non directement applicable, exige une transposition nationale

Source

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)

Version

CELEX 32022L2555 — ELI dir/2022/2555

a final report not later than one month after the submission of the incident notification under point (b), including the following:

Force normative

droit UE à transposer (directive) — non directement applicable, exige une transposition nationale

Source

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)

Version

CELEX 32022L2555 — ELI dir/2022/2555

Les entités [importantes ou essentielles] mettent en œuvre une organisation, des processus et des outils adaptés pour se préparer et réagir à des événements de sécurité susceptibles d’affecter la réalisation de leurs activités ou la fourniture de leurs services.

Force normative

obligation (décret, PJL résilience)

Source

ReCyF — Référentiel Cyber France (NIS 2, transposition nationale)

Version

2.5 du 17/03/2026 (version de travail)

Statut

Version de travail : non opposable tant que la transposition n’est pas promulguée

It shall apply from 25 May 2018.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Version

CELEX 32016R0679 — ELI reg/2016/679

This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Version

CELEX 32016R0679 — ELI reg/2016/679

This Regulation does not apply to the processing of personal data:

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Version

CELEX 32016R0679 — ELI reg/2016/679

This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Version

CELEX 32016R0679 — ELI reg/2016/679

This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Version

CELEX 32016R0679 — ELI reg/2016/679

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Version

CELEX 32016R0679 — ELI reg/2016/679

Mener une analyse de risques, même minimale, selon les trois étapes suivantes : 1. Recenser les traitements de données personnelles, automatisés ou non, les données traitées (ex. : fichiers clients, contrats) et les supports sur lesquels ces traitements reposent : les matériels (ex. : serveurs, ordinateurs portables, disques durs) ; les logiciels (ex. : systèmes d’exploitation, logiciels métier) ; les ressources d’informatique en nuage (cloud) utilisés (ex. : SaaS, PaaS, IaaS) ; les canaux de communication logiques ou physiques (ex. : fibre optique, Wi-Fi, Internet, échanges verbaux, coursiers) ; les supports papier (ex. : documents imprimés, photocopies) ; les locaux et installations physiques où se situent les éléments précédemment cités (ex. : locaux informatiques, bureaux). Cette étape mérite d’être menée indépendamment de toute analyse de risques (voir la fiche n°1 - Piloter la sécurité des données). 2. Apprécier les risques engendrés par chaque traitement : a. Identifier les impacts potentiels sur les droits et libertés des personnes concernées, pour les trois évènements redoutés suivants : accès illégitime à des données (ex. : usurpation d’identité consécutive à la divulgation des fiches de paie de l’ensemble des salariés d’une entreprise) ; modification non désirée de données (ex. : accusation à tort d’une personne d’une faute ou d’un délit suite à la modification de journaux d’accès) ; disparition temporaire ou définitive de données (ex. : non-détection d’une interaction médicamenteuse du fait de l’impossibilité d’accéder au dossier électronique du patient). b. Identifier les sources de risques (qui ou qu’est-ce qui pourrait être à l’origine de chaque évènement redouté ?), en prenant en compte des sources humaines internes et externes (ex. : administrateur informatique, utilisateur, attaquant externe, concurrent) ainsi que des sources non humaines internes et externes (ex. : eau, épidémie, matériaux dangereux, virus informatique non ciblé). c. Identifier les menaces (qu’est-ce qui pourrait permettre que chaque évènement redouté survienne ?). Ces menaces surviennent sur les supports identifiés précédemment (matériels, logiciels, canaux de communication, supports papier, etc.), qui peuvent être : utilisés de manière inadaptée (ex. : abus de droits, erreur de manipulation) ; modifiés (ex. : piégeage logiciel ou matériel ou « keylogger », installation d’un logiciel malveillant) ; perdus (ex. : vol d’un ordinateur portable, perte d’une clé USB) ; observés (ex. : observation d’un écran dans un train, géolocalisation d’un matériel) ; détériorés (ex. : vandalisme, dégradation du fait de l’usure naturelle) ; surchargés (ex. : unité de stockage pleine, attaque par déni de service). d. Déterminer les mesures existantes ou prévues qui permettent de réduire chaque risque (ex. : contrôle d’accès, sauvegardes, traçabilité, sécurité des locaux, chiffrement, anonymisation). e. Estimer la gravité (impact ou préjudice potentiel pour les personnes concernées) et la vraisemblance (probabilité qu’ils se réalisent) des risques, au regard des éléments précédents (exemple d’échelle utilisable pour l’estimation : négligeable, modérée, importante, maximale). Le tableau suivant peut être utilisé pour formaliser cette réflexion : 3. Mettre en œuvre et vérifier les mesures prévues. Si les mesures existantes et prévues sont jugées appropriées, il convient de s’assurer qu’elles soient appliquées et contrôlées (voir la fiche n°1 - Piloter la sécurité des données). Sinon, des mesures supplémentaires doivent être identifiées et mises en œuvre pour réduire la gravité et/ou la vraisemblance des risques associés.

Force normative

recommandation (droit souple)

Source

Guide pratique RGPD — Sécurité des données personnelles

Version

2024 (mise à jour 2026)

In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Version

CELEX 32016R0679 — ELI reg/2016/679

Revoir régulièrement l’analyse de risques et, en particulier, en cas de modification du système ou du contexte du traitement.

Force normative

recommandation (droit souple)

Source

Guide pratique RGPD — Sécurité des données personnelles

Version

2024 (mise à jour 2026)

the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Version

CELEX 32016R0679 — ELI reg/2016/679

Prévoir un système de journalisation (c’est-à-dire un enregistrement dans des fichiers journaux ou « logs ») des activités métier des utilisateurs (traces applicatives), des interventions techniques (y compris par les administrateurs), des anomalies et des évènements liés à la sécurité (traces techniques ou « système »).

Force normative

recommandation (droit souple)

Source

Guide pratique RGPD — Sécurité des données personnelles

Version

2024 (mise à jour 2026)

Protéger les équipements de journalisation et les informations journalisées pour empêcher les opérations non autorisées (ex. : en les rendant inaccessibles aux personnes dont l’activité est journalisée), les mésusages par des comptes habilités (ex. : en mettant en place une charte d’utilisation ou des alertes spécifiques) et l’écrasement des traces générées par les applicatifs concernés.

Force normative

recommandation (droit souple)

Source

Guide pratique RGPD — Sécurité des données personnelles

Version

2024 (mise à jour 2026)

the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Version

CELEX 32016R0679 — ELI reg/2016/679

Effectuer des sauvegardes fréquentes des données, que celles-ci soient sous forme papier ou électronique. Il peut être opportun de prévoir des sauvegardes incrémentales quotidiennes et des sauvegardes complètes à intervalles réguliers.

Force normative

recommandation (droit souple)

Source

Guide pratique RGPD — Sécurité des données personnelles

Version

2024 (mise à jour 2026)

Isoler au moins une sauvegarde hors ligne, déconnectée du réseau de l’entreprise.

Force normative

recommandation (droit souple)

Source

Guide pratique RGPD — Sécurité des données personnelles

Version

2024 (mise à jour 2026)

Effectuer des sauvegardes et vérifier régulièrement leur intégrité et la capacité de les restaurer (voir la fiche n°17 - Sauvegarder).

Force normative

recommandation (droit souple)

Source

Guide pratique RGPD — Sécurité des données personnelles

Version

2024 (mise à jour 2026)

Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Version

CELEX 32016R0679 — ELI reg/2016/679

Prévoir un contrat avec les sous-traitants, qui définit notamment l’objet, la durée, la finalité du traitement ainsi que les obligations des parties, notamment en termes de sécurité. S’assurer qu’il contient en particulier des dispositions fixant : la répartition des responsabilités et des obligations en matière de confidentialité des données personnelles confiées ; des contraintes minimales en matière d’authentification des utilisateurs ; les conditions de restitution et de destruction des données en fin du contrat ; les règles de gestion et de notification des incidents. Celles-ci devraient comprendre une information du responsable de traitement en cas de découverte de faille de sécurité ou d’incident de sécurité et cela dans les plus brefs délais lorsqu’il s’agit d’une violation de données personnelles ; l’assistance que doit fournir le sous-traitant pour garantir le respect des obligations de sécurité ; la revue régulière des mesures de sécurité et, le cas échéant, les conditions de leur révision.

Force normative

recommandation (droit souple)

Source

Guide pratique RGPD — Sécurité des données personnelles

Version

2024 (mise à jour 2026)

In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Version

CELEX 32016R0679 — ELI reg/2016/679

When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Version

CELEX 32016R0679 — ELI reg/2016/679

Évaluer le risque, pour les personnes, engendré par la violation en tenant compte de la gravité et de la probabilité des conséquences que la violation pourrait avoir sur leurs droits et libertés.

Force normative

recommandation (droit souple)

Source

Guide pratique RGPD — Sécurité des données personnelles

Version

2024 (mise à jour 2026)

Tenir un registre interne de toutes les violations de données personnelles.

Force normative

recommandation (droit souple)

Source

Guide pratique RGPD — Sécurité des données personnelles

Version

2024 (mise à jour 2026)

Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Version

CELEX 32016R0679 — ELI reg/2016/679

Assurer un suivi avec la direction en termes de gestion de risques informatiques à travers une revue de direction au moins annuelle. Elle doit permettre d’établir une synthèse et de prendre des décisions considérant : l’évolution du contexte, des enjeux et des attentes des parties prenantes (ex. : clients, partenaires, autorités de contrôle) ; le changement des objectifs et missions de l’organisme ; l’évolution de la menace numérique ; l’essor de nouvelles technologies ou solutions de sécurité ; les évolutions des systèmes d’information et des traitements de données ; l’évolution des risques sur la sécurité des données et la vie privée ; l’avancement du plan d’action juridique (ex. : mise en conformité des contrats) et technique (mesures de sécurité) ; les incidents et violations rencontrés, avec leur impact sur l’organisme et les personnes concernées ; les demandes et plaintes reçues et traitées concernant les données personnelles.

Force normative

recommandation (droit souple)

Source

Guide pratique RGPD — Sécurité des données personnelles

Version

2024 (mise à jour 2026)

a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Version

CELEX 32016R0679 — ELI reg/2016/679

the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Version

CELEX 32016R0679 — ELI reg/2016/679

the monitoring of their behaviour as far as their behaviour takes place within the Union.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Version

CELEX 32016R0679 — ELI reg/2016/679

This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

This Regulation does not apply to products with digital elements to which the following Union legal acts apply:

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

‘manufacturer’ means a natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

For the purpose of complying with paragraph 1, manufacturers shall undertake an assessment of the cybersecurity risks associated with a product with digital elements and take the outcome of that assessment into account during the planning, design, development, production, delivery and maintenance phases of the product with digital elements with a view to minimising cybersecurity risks, preventing incidents and minimising their impact, including in relation to the health and safety of users.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

The cybersecurity risk assessment shall be documented and updated as appropriate during a support period to be determined in accordance with paragraph 8 of this Article. That cybersecurity risk assessment shall comprise at least an analysis of cybersecurity risks based on the intended purpose and reasonably foreseeable use, as well as the conditions of use, of the product with digital elements, such as the operational environment or the assets to be protected, taking into account the length of time the product is expected to be in use. The cybersecurity risk assessment shall indicate whether and, if so in what manner, the security requirements set out in Part I, point (2), of Annex I are applicable to the relevant product with digital elements and how those requirements are implemented as informed by the cybersecurity risk assessment. It shall also indicate how the manufacturer is to apply Part I, point (1), of Annex I and the vulnerability handling requirements set out in Part II of Annex I.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

For the purpose of complying with paragraph 1, manufacturers shall exercise due diligence when integrating components sourced from third parties so that those components do not compromise the cybersecurity of the product with digital elements, including when integrating components of free and open-source software that have not been made available on the market in the course of a commercial activity.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

Manufacturers shall, upon identifying a vulnerability in a component, including in an open source-component, which is integrated in the product with digital elements report the vulnerability to the person or entity manufacturing or maintaining the component, and address and remediate the vulnerability in accordance with the vulnerability handling requirements set out in Part II of Annex I. Where manufacturers have developed a software or hardware modification to address the vulnerability in that component, they shall share the relevant code or documentation with the person or entity manufacturing or maintaining the component, where appropriate in a machine-readable format.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

Manufacturers shall ensure, when placing a product with digital elements on the market, and for the support period, that vulnerabilities of that product, including its components, are handled effectively and in accordance with the essential cybersecurity requirements set out in Part II of Annex I. Manufacturers shall determine the support period so that it reflects the length of time during which the product is expected to be in use, taking into account, in particular, reasonable user expectations, the nature of the product, including its intended purpose, as well as relevant Union law determining the lifetime of products with digital elements. When determining the support period, manufacturers may also take into account the support periods of products with digital elements offering a similar functionality placed on the market by other manufacturers, the availability of the operating environment, the support periods of integrated components that provide core functions and are sourced from third parties as well as relevant guidance provided by the dedicated administrative cooperation group (ADCO) established pursuant to Article 52(15) and the Commission. The matters to be taken into account in order to determine the support period shall be considered in a manner that ensures proportionality. Without prejudice to the second subparagraph, the support period shall be at least five years. Where the product with digital elements is expected to be in use for less than five years, the support period shall correspond to the expected use time. Taking into account ADCO recommendations as referred to in Article 52(16), the Commission may adopt delegated acts in accordance with Article 61 to supplement this Regulation by specifying the minimum support period for specific product categories where the market surveillance data suggests inadequate support periods. Manufacturers shall include the information that was taken into account to determine the support period of a product with digital elements in the technical documentation as set out in Annex VII. Manufacturers shall have appropriate policies and procedures, including coordinated vulnerability disclosure policies, referred to in Part II, point (5), of Annex I to process and remediate potential vulnerabilities in the product with digital elements reported from internal or external sources.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that actively exploited vulnerability via the single reporting platform established pursuant to Article 16.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

an early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it, indicating, where applicable, the Member States on the territory of which the manufacturer is aware that their product with digital elements has been made available;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

unless the relevant information has already been provided, a vulnerability notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively exploited vulnerability, which shall provide general information, as available, about the product with digital elements concerned, the general nature of the exploit and of the vulnerability concerned as well as any corrective or mitigating measures taken, and corrective or mitigating measures that users can take, and which shall also indicate, where applicable, how sensitive the manufacturer considers the notified information to be;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

unless the relevant information has already been provided, a final report, no later than 14 days after a corrective or mitigating measure is available, including at least the following:

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

A manufacturer shall notify any severe incident having an impact on the security of the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that incident via the single reporting platform established pursuant to Article 16.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

an early warning notification of a severe incident having an impact on the security of the product with digital elements, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it, including at least whether the incident is suspected of being caused by unlawful or malicious acts, which shall also indicate, where applicable, the Member States on the territory of which the manufacturer is aware that their product with digital elements has been made available;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

unless the relevant information has already been provided, an incident notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the incident, which shall provide general information, where available, about the nature of the incident, an initial assessment of the incident, as well as any corrective or mitigating measures taken, and corrective or mitigating measures that users can take, and which shall also indicate, where applicable, how sensitive the manufacturer considers the notified information to be;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

unless the relevant information has already been provided, a final report, within one month after the submission of the incident notification under point (b), including at least the following:

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Version

CELEX 32024R2847 — ELI reg/2024/2847

This Regulation applies to:

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

deployers of AI systems that have their place of establishment or are located within the Union;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

This Regulation does not apply to areas outside the scope of Union law, and shall not, in any event, affect the competences of the Member States concerning national security, regardless of the type of entity entrusted by the Member States with carrying out tasks in relation to those competences. This Regulation does not apply to AI systems where and in so far they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes, regardless of the type of entity carrying out those activities. This Regulation does not apply to AI systems which are not placed on the market or put into service in the Union, where the output is used in the Union exclusively for military, defence or national security purposes, regardless of the type of entity carrying out those activities.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

‘deployer’ means a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

The following AI practices shall be prohibited:

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

In addition to the high-risk AI systems referred to in paragraph 1, AI systems referred to in Annex III shall be considered to be high-risk.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use. This obligation shall not apply to AI systems authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, unless those systems are available for the public to report a criminal offence.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union . It shall apply from 2 August 2026. However:

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

Chapters I and II shall apply from 2 February 2025;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

Article 6(1) and the corresponding obligations in this Regulation shall apply from 2 August 2027.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

By derogation from paragraph 2, an AI system referred to in Annex III shall not be considered to be high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making. The first subparagraph shall apply where any of the following conditions is fulfilled:

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

A provider who considers that an AI system referred to in Annex III is not high-risk shall document its assessment before that system is placed on the market or put into service. Such provider shall be subject to the registration obligation set out in Article 49(2). Upon request of national competent authorities, the provider shall provide the documentation of the assessment.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

A risk management system shall be established, implemented, documented and maintained in relation to high-risk AI systems.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

The risk management system shall be understood as a continuous iterative process planned and run throughout the entire lifecycle of a high-risk AI system, requiring regular systematic review and updating. It shall comprise the following steps:

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

Prior to deploying a high-risk AI system referred to in Article 6(2), with the exception of high-risk AI systems intended to be used in the area listed in point 2 of Annex III, deployers that are bodies governed by public law, or are private entities providing public services, and deployers of high-risk AI systems referred to in points 5 (b) and (c) of Annex III, shall perform an assessment of the impact on fundamental rights that the use of such system may produce. For that purpose, deployers shall perform an assessment consisting of:

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

High-risk AI systems shall be designed and developed in such a way that they achieve an appropriate level of accuracy, robustness, and cybersecurity, and that they perform consistently in those respects throughout their lifecycle.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

High-risk AI systems shall be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities. The technical solutions aiming to ensure the cybersecurity of high-risk AI systems shall be appropriate to the relevant circumstances and the risks. The technical solutions to address AI specific vulnerabilities shall include, where appropriate, measures to prevent, detect, respond to, resolve and control for attacks trying to manipulate the training data set (data poisoning), or pre-trained components used in training (model poisoning), inputs designed to cause the AI model to make a mistake (adversarial examples or model evasion), confidentiality attacks or model flaws.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems, pursuant to paragraphs 3 and 6.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

Deployers shall monitor the operation of the high-risk AI system on the basis of the instructions for use and, where relevant, inform providers in accordance with Article 72. Where deployers have reason to consider that the use of the high-risk AI system in accordance with the instructions may result in that AI system presenting a risk within the meaning of Article 79(1), they shall, without undue delay, inform the provider or distributor and the relevant market surveillance authority, and shall suspend the use of that system. Where deployers have identified a serious incident, they shall also immediately inform first the provider, and then the importer or distributor and the relevant market surveillance authorities of that incident. If the deployer is not able to reach the provider, Article 73 shall apply mutatis mutandis . This obligation shall not cover sensitive operational data of deployers of AI systems which are law enforcement authorities. For deployers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law, the monitoring obligation set out in the first subparagraph shall be deemed to be fulfilled by complying with the rules on internal governance arrangements, processes and mechanisms pursuant to the relevant financial service law.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

Deployers of high-risk AI systems shall keep the logs automatically generated by that high-risk AI system to the extent such logs are under their control, for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in applicable Union or national law, in particular in Union law on the protection of personal data. Deployers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law shall maintain the logs as part of the documentation kept pursuant to the relevant Union financial service law.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated. Providers shall ensure their technical solutions are effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art, as may be reflected in relevant technical standards. This obligation shall not apply to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof, or where authorised by law to detect, prevent, investigate or prosecute criminal offences.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offence. Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the transparency obligations set out in this paragraph are limited to disclosure of the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work. Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences or where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

Providers of high-risk AI systems placed on the Union market shall report any serious incident to the market surveillance authorities of the Member States where that incident occurred.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

The report referred to in paragraph 1 shall be made immediately after the provider has established a causal link between the AI system and the serious incident or the reasonable likelihood of such a link, and, in any event, not later than 15 days after the provider or, where applicable, the deployer, becomes aware of the serious incident. The period for the reporting referred to in the first subparagraph shall take account of the severity of the serious incident.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

Notwithstanding paragraph 2 of this Article, in the event of a widespread infringement or a serious incident as defined in Article 3, point (49)(b), the report referred to in paragraph 1 of this Article shall be provided immediately, and not later than two days after the provider or, where applicable, the deployer becomes aware of that incident.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

Notwithstanding paragraph 2, in the event of the death of a person, the report shall be provided immediately after the provider or the deployer has established, or as soon as it suspects, a causal relationship between the high-risk AI system and the serious incident, but not later than 10 days after the date on which the provider or, where applicable, the deployer becomes aware of the serious incident.

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

Version

CELEX 32024R1689 — ELI reg/2024/1689

managers of alternative investment funds as referred to in Article 3(2) of Directive 2011/61/EU;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554

insurance and reinsurance undertakings as referred to in Article 4 of Directive 2009/138/EC;

Force normative

droit UE directement applicable (règlement, niveau 1)

Source

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector

Version

CELEX 32022R2554 — ELI reg/2022/2554