We turn the texts into the requirements that apply to your organisation, then into controls, evidence and registers kept up to date. Your compliance can be checked at any time, not only the night before an audit.
Which texts concern you? Select one or more: the page shows only what relates to them.
What is it?EU regulation on the digital operational resilience of the financial sector, directly applicable since 17 January 2025.1
Are you in scope?*You are in scope if your entity is on the Article 2 list (credit institution, investment firm, management company, insurer…) or if you are an ICT third-party service provider, that is an undertaking providing ICT services, subject to the Article 2 exclusions.28179
See the chainWhat is it?EU directive on the cybersecurity of essential and important entities: it binds the Member States. In France it goes through the « résilience » bill, a decree of which will set the security objectives that ANSSI’s ReCyF sets out (working version).2522
Are you in scope?*You are likely in scope if you carry out, in the Union, an activity in a sector of Annexes I or II and are at least a medium-sized enterprise; some entities are covered regardless of size. The binding scope will be that of the French transposition law.1819
See the chainWhat is it?EU regulation on the protection of personal data, applicable since 25 May 2018. It requires security measures appropriate to the risk; the CNIL guide sets them out as recommendations.364142
Are you in scope?*You are in scope if you process personal data, by automated means or in a filing system, in the context of an establishment in the Union, or if, established outside the Union, you offer goods or services to people in the Union or monitor their behaviour in the Union, subject to the exclusions in Article 2(2).3738396162
See the chainWhat is it?EU regulation on the cyber resilience of products with digital elements. Reporting of vulnerabilities and incidents has applied since 11 September 2026, the rest applies from 11 December 2027.66
Are you in scope?*You are likely in scope if you develop, manufacture or have designed a software or hardware product meant to connect to a device or network, and market it under your name, subject to the Article 2 exclusions.636564
See the chainWhat is it?EU regulation laying down harmonised rules on artificial intelligence. The text as published applies from 2 August 2026; AI literacy and the prohibited practices have applied since 2 February 2025, and the high-risk classification of Article 6(1) applies from 2 August 2027.919293
Are you in scope?*You are likely in scope if, established or located in the Union, you use an AI system under your authority in a professional activity (deployer), or if you develop one, or have one developed, and place it on the market or put it into service in the Union under your name (provider), subject to the Article 2 exclusions.8387828685
See the chainAn audit does not check that you wrote policies. It checks that every applicable requirement has an owner, a control and dated evidence.
So we start from the texts, provision by provision, and keep the link all the way to the evidence. When a text changes, you know which documents and controls to review.
Each provision is traced to the control that serves it, the test that checks it and the evidence it produces. The texts are quoted word for word at the foot of the page; the controls and evidence below are examples from our catalogue, adapted to each organisation.
Select one or more texts at the top of the page to show their traceability chains.
An illustrative selection of provisions, not an exhaustive one.
Applicability*Directly applicable since 17 January 2025 to financial entities (credit institutions, investment firms, managers of alternative investment funds, management companies, insurance undertakings…) and to ICT third-party service providers, subject to the exclusions in Article 2(3) and (4).12345678910
The management body defines, approves and oversees the ICT risk management framework, and is responsible for its implementation.
Management approves the cyber risk-management framework, follows its implementation and answers for it.
Also serves
A sound, comprehensive and well-documented ICT risk management framework, part of the overall risk management system.
Risks to systems and data are analysed, treated and reviewed; residual risks are formally accepted.
Also serves
Incidents are detected, classified under each applicable text and notified on time.
Also serves
A digital operational resilience testing programme, except for microenterprises; for the entities identified, TLPT at least every three years, a frequency the authority may adjust.
The effectiveness of the measures is regularly tested and assessed, and findings are dealt with.
Also serves
Keep a register of information on all contractual arrangements for ICT services provided by ICT third-party service providers.
Providers are listed, and their contracts carry the applicable security requirements.
Also serves
An illustrative selection of provisions, not an exhaustive one.
Applicability*The directive binds the Member States. In France, the transposition bill provides for security objectives to be set by decree; ANSSI’s ReCyF sets them out, and it is the reference to prepare for. As a general rule it covers entities in the sectors of Annexes I and II that are at least medium-sized; some are covered regardless of their size. They are classed as essential or important. ReCyF v2.5 of 17 March 2026, a working version: not binding until the transposition is enacted.1819202122
A digital security governance framework under the responsibility of the chief executive, with a compliance analysis and an action plan followed over time. Management approves the measures and answers for them.
Management approves the cyber risk-management framework, follows its implementation and answers for it.
Also serves
Proportionate measures based on risk analysis; for essential entities, a risk-based approach under the chief executive’s responsibility, through to the acceptance of residual risks.
Risks to systems and data are analysed, treated and reviewed; residual risks are formally accepted.
Also serves
Keep an up-to-date list of activities and services, and of the information systems that support them.
Activities, services and information systems are inventoried, and the inventory is kept up to date.
Keep an up-to-date list of IT providers and suppliers, and make sure, in particular by contract, that their services comply.
Providers are listed, and their contracts carry the applicable security requirements.
Also serves
An organisation, processes and tools to prepare for and respond to incidents; for a significant incident, the directive sets an early warning within 24 hours, a notification within 72 hours and a final report no later than one month after.
Incidents are detected, classified under each applicable text and notified on time.
Also serves
An illustrative selection of provisions, not an exhaustive one.
Applicability*Applicable since 25 May 2018 to automated processing of personal data, and to non-automated processing of data that form or are meant to form part of a filing system, subject to the exclusions in Article 2(2). It covers processing in the context of the activities of an establishment of a controller or processor in the Union and, under conditions, processing by a controller outside the Union that targets people in the Union. Article 32 requires measures appropriate to the risk, taking into account the state of the art; the CNIL’s guide on the security of personal data describes that state of the art.36373839404142
The CNIL guideThe CNIL’s guide on the security of personal data, version 2024 (mise à jour 2026), has 25 thematic sheets: 151 baseline precautions, the minimum expected; 132 complementary measures to go further; and 91 practices to avoid. Its measures take the form of recommendations, but they describe the state of the art against which Article 32 is assessed: we treat them, with ANSSI’s guides, as the expected level, not as an option.4142
Technical and organisational measures appropriate to the risk to people’s rights and freedoms. The CNIL recommends a risk analysis, even a minimal one, reviewed regularly.
Risks to systems and data are analysed, treated and reviewed; residual risks are formally accepted.
Also serves
Have the ability to ensure the ongoing confidentiality, integrity, availability and resilience of systems. The CNIL recommends logging user activity, technical interventions and security events, and protecting those logs.
The confidentiality, integrity and availability of systems are protected and monitored.
Have the ability to restore the availability of and access to data in a timely manner after an incident. The CNIL recommends frequent backups, one of them offline, and regular checks that they restore.
Systems and data can be restored in a timely manner after an incident.
Use only processors that provide sufficient guarantees. The CNIL recommends a contract that sets out, in particular, their security obligations.
Providers are listed, and their contracts carry the applicable security requirements.
Also serves
Notify a personal data breach to the supervisory authority without undue delay and, where feasible, within 72 hours (later, with reasons for the delay), unless the risk is unlikely, and inform the people concerned when the risk is high. The CNIL recommends assessing the risk to people and keeping a register of all breaches.
Incidents are detected, classified under each applicable text and notified on time.
Also serves
Implement appropriate measures and be able to demonstrate compliance. The CNIL recommends a management review at least once a year.
Management approves the cyber risk-management framework, follows its implementation and answers for it.
Also serves
A process for regularly testing, assessing and evaluating the effectiveness of the security measures.
The effectiveness of the measures is regularly tested and assessed, and findings are dealt with.
Also serves
An illustrative selection of provisions, not an exhaustive one.
Applicability*Covers products with digital elements made available on the market, software or hardware, whose use includes a data connection to a device or network, subject to the exclusions in Article 2. The obligations fall mostly on the manufacturer, who designs or has the product designed and markets it under its name. Applies from 11 December 2027; the Article 14 reporting obligation has applied since 11 September 2026.63646566
Design, develop and produce the product in accordance with the essential cybersecurity requirements of Part I of Annex I.
Security is built in from design and checked on every change to the product.
Also serves
Assess the product’s cybersecurity risks, take them into account from design to maintenance, and document and update that assessment during the support period.
The product’s cybersecurity risks are assessed, documented and updated during the support period.
Exercise due diligence when integrating third-party components, including free and open-source software, so that they do not compromise the product’s cybersecurity.
Third-party components, open source included, are examined with due diligence before they are integrated into the product.
Handle the vulnerabilities of the product and its components effectively during the support period, and report those of a component to whoever manufactures or maintains it.
Vulnerabilities in the product and its components are handled for the whole support period.
Notify the coordinating CSIRT and ENISA of any actively exploited vulnerability and any severe incident, in both cases with an early warning within 24 hours and a notification within 72 hours; the final report is due within 14 days after a fix is available for a vulnerability, and within one month after the notification for an incident.
Actively exploited vulnerabilities and severe incidents affecting the product are notified on time.
An illustrative selection of provisions, not an exhaustive one.
Applicability*Covers providers that place AI systems on the market or put them into service in the Union, wherever they are established; deployers established or located in the Union; and providers and deployers in a third country where the output of the AI system is used in the Union, subject to the exclusions in Article 2. The obligations depend on the role and on the system: some practices are prohibited, high-risk systems carry their own requirements, and systems that interact with people carry transparency obligations. The text as published applies from 2 August 2026; Chapters I and II, including AI literacy and the prohibited practices, since 2 February 2025; Article 6(1) from 2 August 2027.81828384858687888990919293
Providers and deployers take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and of the other people who operate or use AI systems on their behalf, taking into account their knowledge and the context of use.
Everyone who operates or uses AI systems on the organisation’s behalf has the AI literacy their role and context call for.
Place on the market, put into service or use none of the practices Article 5 prohibits; identify the high-risk systems, including those referred to in Annex III, save those that, under the conditions of Article 6(3), pose no significant risk of harm. A provider who considers an Annex III system not to be high-risk documents its assessment before placing it on the market or putting it into service.
Every AI system, developed or used, is inventoried and qualified: role (provider or deployer), prohibited practice, high risk, transparency obligation.
For providers of high-risk systems, a risk management system run throughout the system’s lifecycle. Before deploying certain high-risk systems, deployers that are bodies governed by public law or private entities providing public services, and deployers of some systems referred to in Annex III, assess the impact on fundamental rights.
The risks of each AI system to people’s health, safety and fundamental rights are assessed before it goes live and reviewed throughout its use.
Design and develop high-risk systems to achieve an appropriate level of accuracy, robustness and cybersecurity throughout their lifecycle, resilient against attempts to exploit their vulnerabilities, including data poisoning, model poisoning and adversarial examples.
Security is built in from design and checked on every change to the product.
Also serves
Deployers of high-risk systems use them according to the instructions for use, assign human oversight to people with the necessary competence, training and authority, monitor their operation, and keep the logs under their control for at least six months, unless other law provides otherwise. For financial institutions subject to Union financial services law, monitoring is deemed fulfilled by complying with its internal governance rules, and the logs are kept with the documentation that law requires.
Each high-risk AI system is used according to its instructions, overseen by competent people with the authority to override it, monitored, and its logs kept.
Providers make sure people are informed that they are interacting with an AI system, unless it is obvious, and mark generated audio, image, video or text content in a machine-readable format. Deployers disclose deep fakes, and text published to inform the public on matters of public interest, as artificially generated or manipulated.
People know when they interact with an AI system, and generated or manipulated content is marked or disclosed.
Providers of high-risk systems report any serious incident to the market surveillance authorities of the Member States where it occurred, immediately after establishing a causal link or its reasonable likelihood, and no later than 15 days after becoming aware of it; within two days for a widespread infringement or the most serious incidents, ten days in the event of a death.
Incidents are detected, classified under each applicable text and notified on time.
Also serves
Whether a text applies to your organisation is a legal question: it depends on your status, your activities and how they qualify, and must be confirmed by a specialised lawyer. We prepare that analysis with you, with the texts, without replacing that advice.
You choose the level; scope and deliverables are set by contract.
We continuously check the requirements in scope and document gaps, with their evidence.
DeliverablesWe analyse the gaps and help you decide: priorities, trade-offs, your answer to the authority or the client.
DeliverablesWe run the follow-up of the agreed actions with your teams, without making the changes in your systems.
DeliverablesTools already built and proven, so the engagement time goes to your organisation rather than to the texts.
One tool, shared with your teams: registers of assets, providers, risks, incidents and vulnerabilities; requirements and coverage, provision by provision; action plan and testing programme; documents edited online and exported to Word or PDF. Access by invitation, data backed up and exportable.
Your AI assistants connect to the application over MCP, with the same authentication. They query requirements, progress and overdue actions, can update the registers, and prepare answers to your clients’ security questionnaires from the documents held in the platform, after analysis.
DORA and its technical standards, NIS 2, ReCyF, GDPR, CRA, AI Act: extracted provision by provision. Every quote links to the official text and its version.
From day one, security questionnaires to send your suppliers, tailored to their classification.
In principle yes, if your entity is on the list in Article 2 of the Regulation (credit institution, investment firm, management company, insurer…), subject to the exclusions in paragraphs 3 and 4, which cover for instance some small AIF managers or insurers. If you provide ICT services to such entities, you are concerned as a third-party provider, in particular through their contractual requirements. We prepare the applicability analysis in the first conversation; have it confirmed by your lawyer.2811211310
The directive binds the Member States; in France it goes through the « résilience » bill, a decree of which will set the security objectives that ANSSI’s ReCyF sets out. The ReCyF is published as a working version. We help you prepare without treating as mandatory what is not yet.2522
It depends on your sector and on the French transposition; we examine it case by case, with the texts. Either way, governance, risk management, incidents and providers are handled in a single set-up.
It creates no obligation of its own, but it should not be read as optional. Article 32 of the GDPR requires measures appropriate to the risk, taking into account the state of the art; the CNIL guide, like ANSSI’s guides, describes that state of the art. So we treat it as the expected level.4142
If you develop or manufacture, or have designed, developed or manufactured, a product with digital elements whose use includes a data connection to a device or network, and market it under your name, you are likely a manufacturer under the Regulation, subject to the Article 2 exclusions. The reporting obligation has applied since 11 September 2026, the rest applies from 11 December 2027. We prepare the applicability analysis; have it confirmed by your lawyer.636566
If you use an AI system under your authority in a professional activity, you are a deployer under the Regulation; if you develop one, or have one developed, and place it on the market or put it into service under your name, you are a provider; subject in both cases to the Article 2 exclusions. Your obligations then depend on your role and on how each system qualifies. The text as published applies from 2 August 2026; AI literacy and the prohibited practices have applied since 2 February 2025. We prepare the applicability analysis, use by use; have it confirmed by your lawyer.8786859192
No. We prepare the demonstration of compliance: requirements, controls, evidence. The audit and the legal opinion, in particular on whether the texts apply, stay independent.
For the requirements relevant to your organisation, get an initial view of existing controls, available evidence, gaps to address and practical priorities. We can start with a focused 30-day engagement covering one entity, one applicable framework and agreed requirements. Scope and price by quote; not an exhaustive audit, certification or legal advice.
Exact text, in its original language, from the frameworks extracted from the official text.
32022R2554-a64-p0This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union . It shall apply from 17 January 2025.32022R2554-a2-p1Without prejudice to paragraphs 3 and 4, this Regulation applies to the following entities:32022R2554-a2-p1-1credit institutions;32022R2554-a2-p1-5investment firms;32022R2554-a2-p1-11managers of alternative investment funds;32022R2554-a2-p1-12management companies;32022R2554-a2-p1-14insurance and reinsurance undertakings;32022R2554-a2-p1-21ICT third-party service providers.32022R2554-a2-p3This Regulation does not apply to:32022R2554-a2-p4Member States may exclude from the scope of this Regulation entities referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU that are located within their respective territories. Where a Member State makes use of such option, it shall inform the Commission thereof as well as of any subsequent changes thereto. The Commission shall make that information publicly available on its website or other easily accessible means.32022R2554-a5-p2The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework referred to in Article 6(1). For the purposes of the first subparagraph, the management body shall:32022R2554-a6-p1Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively and to ensure a high level of digital operational resilience.32022R2554-a19-p1Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article. Where a financial entity is subject to supervision by more than one national competent authority referred to in Article 46, Member States shall designate a single competent authority as the relevant competent authority responsible for carrying out the functions and duties provided for in this Article. Credit institutions classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, shall report major ICT-related incidents to the relevant national competent authority designated in accordance with Article 4 of Directive 2013/36/EU, which shall immediately transmit that report to the ECB. For the purpose of the first subparagraph, financial entities shall produce, after collecting and analysing all relevant information, the initial notification and reports referred to in paragraph 4 of this Article using the templates referred to in Article 20 and submit them to the competent authority. In the event that a technical impossibility prevents the submission of the initial notification using the template, financial entities shall notify the competent authority about it via alternative means. The initial notification and reports referred to in paragraph 4 shall include all information necessary for the competent authority to determine the significance of the major ICT-related incident and assess possible cross-border impacts. Without prejudice to the reporting pursuant to the first subparagraph by the financial entity to the relevant competent authority, Member States may additionally determine that some or all financial entities shall also provide the initial notification and each report referred to in paragraph 4 of this Article using the templates referred to in Article 20 to the competent authorities or the computer security incident response teams (CSIRTs) designated or established in accordance with Directive (EU) 2022/2555.32022R2554-a24-p1For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures, financial entities, other than microenterprises, shall, taking into account the criteria set out in Article 4(2), establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk-management framework referred to in Article 6.32022R2554-a26-p1Financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, which are identified in accordance with paragraph 8, third subparagraph, of this Article, shall carry out at least every 3 years advanced testing by means of TLPT. Based on the risk profile of the financial entity and taking into account operational circumstances, the competent authority may, where necessary, request the financial entity to reduce or increase this frequency.32022R2554-a28-p3As part of their ICT risk management framework, financial entities shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers. The contractual arrangements referred to in the first subparagraph shall be appropriately documented, distinguishing between those that cover ICT services supporting critical or important functions and those that do not. Financial entities shall report at least yearly to the competent authorities on the number of new arrangements on the use of ICT services, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions which are being provided. Financial entities shall make available to the competent authority, upon its request, the full register of information or, as requested, specified sections thereof, along with any information deemed necessary to enable the effective supervision of the financial entity. Financial entities shall inform the competent authority in a timely manner about any planned contractual arrangement on the use of ICT services supporting critical or important functions as well as when a function has become critical or important.32022R2554-a3-p0-19‘ICT third-party service provider’ means an undertaking providing ICT services;32022L2555-a2-p1This Directive applies to public or private entities of a type referred to in Annex I or II which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article, and which provide their services or carry out their activities within the Union. Article 3(4) of the Annex to that Recommendation shall not apply for the purposes of this Directive.32022L2555-a2-p2Regardless of their size, this Directive also applies to entities of a type referred to in Annex I or II, where:32022L2555-a3-p1For the purposes of this Directive, the following entities shall be considered to be essential entities:32022L2555-a3-p2For the purposes of this Directive, entities of a type referred to in Annex I or II which do not qualify as essential entities pursuant to paragraph 1 of this Article shall be considered to be important entities. This includes entities identified by Member States as important entities pursuant to Article 2(2), points (b) to (e).recyf:obj-1Les entités [importantes ou essentielles] réalisent et maintiennent à jour une liste de l’ensemble de leurs activités et services ainsi que des systèmes d’information y contribuant.
Ces entités sont tenues d’appliquer les [objectifs de sécurité] sur l’ensemble de leurs systèmes d’information, à l’exception de ceux pour lesquels elles justifient, sur la base d’une analyse de risques, qu’ils ne sont pas exposés à l’un des risques suivants :
1. La dégradation ou l'interruption, directe ou indirecte, des activités ou services de l'entité ;
2. La divulgation à des personnes non autorisées d'informations sensibles traitées par les activités ou services de l'entité ;
3. L'altération des informations nécessaires aux activités ou services de l'entité.
La mise en œuvre de mesures de sécurité sur ces systèmes d’information ne permet pas de justifier qu’ils ne sont exposés à aucun des risques précités.
Pour ces systèmes d’information, le choix de ne pas appliquer les objectifs de sécurité ainsi que sa justification au regard des critères précédents doivent apparaître explicitement dans la liste mentionnée au premier alinéa.32022L2555-a20-p1Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article. The application of this paragraph shall be without prejudice to national law as regards the liability rules applicable to public institutions, as well as the liability of public servants and elected or appointed officials.recyf:obj-2Les entités [importantes et essentielles] définissent un cadre de gouvernance de la sécurité numérique placé sous la responsabilité du dirigeant exécutif.
Le cadre de gouvernance de la sécurité numérique consiste en la mise en place, au sein des entités [importantes et essentielles] :
1. D’une organisation ;
2. De rôles et responsabilités en matière de sécurité numérique ;
3. De processus de gestion de la conformité ;
4. D’une politique de sécurité des systèmes d’information et des politiques comprenant au minimum des dispositions en matière d’usage du chiffrement, de contrôle d’accès physique et logique et de revue de l’application des mesures de sécurité mises en œuvre.
Les entités [importantes et essentielles] :
- réalisent une analyse de leur conformité vis-à-vis des dispositions [pointer vers les dispositions du décret correspondant aux objectifs de sécurité],
- identifient les éventuels écarts existants par rapport aux objectifs de sécurité et,
- établissent et suivent dans la durée un plan d’action pour corriger chacun de ces écarts dans les meilleurs délais. Ce plan d’action est adapté à la structure de l’entité et à son environnement.
La responsabilité de ce plan d’action est déterminée au regard du cadre de gouvernance de la sécurité numérique mis en place.
Les entités essentielles établissent ce plan d’action en tenant compte de l’analyse de risques qu’elles sont tenues de réaliser en application de [l’objectif 16].
Ce plan d’action ne préjuge pas de l’appréciation du respect de ses obligations légales et règlementaires lors d’un contrôle par l’ANSSI.32022L2555-a21-p1Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services. Taking into account the state-of-the-art and, where applicable, relevant European and international standards, as well as the cost of implementation, the measures referred to in the first subparagraph shall ensure a level of security of network and information systems appropriate to the risks posed. When assessing the proportionality of those measures, due account shall be taken of the degree of the entity’s exposure to risks, the entity’s size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact.32022L2555-a21-p2-1policies on risk analysis and information system security;recyf:obj-16Les entités [essentielles] mettent en œuvre une approche par les risques placée sous la responsabilité du dirigeant exécutif et leur permettant :
1. de prendre connaissance et de suivre l’évolution des risques pesant sur leurs systèmes d’information ;
2. de définir et suivre la mise en œuvre des mesures de sécurité pour maîtriser ces risques ;
3. d’accepter les risques résiduels.32022L2555-a21-p2-9human resources security, access control policies and asset management;32022L2555-a21-p2-4supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;recyf:obj-3Les entités [importantes ou essentielles] réalisent et maintiennent à jour une liste des prestataires et fournisseurs informatiques intervenant dans la réalisation de leurs activités ou dans la fourniture de leurs services et avec lesquels il existe une relation de droit ou de fait ainsi que le périmètre et la nature de la prestation ou du service fourni.
Les entités [importantes ou essentielles] mettent en place des processus visant à s’assurer, notamment par la voie contractuelle de la conformité des prestations informatiques dont elles bénéficient aux obligations auxquelles l’entité est assujettie notamment en matière de gestion des risques qui menacent la sécurité de leurs réseaux et systèmes d’information et de notification des incidents importants.32022L2555-a21-p2-2incident handling;32022L2555-a23-p4-1without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning, which, where applicable, shall indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;32022L2555-a23-p4-2without undue delay and in any event within 72 hours of becoming aware of the significant incident, an incident notification, which, where applicable, shall update the information referred to in point (a) and indicate an initial assessment of the significant incident, including its severity and impact, as well as, where available, the indicators of compromise;32022L2555-a23-p4-4a final report not later than one month after the submission of the incident notification under point (b), including the following:recyf:obj-12Les entités [importantes ou essentielles] mettent en œuvre une organisation, des processus et des outils adaptés pour se préparer et réagir à des événements de sécurité susceptibles d’affecter la réalisation de leurs activités ou la fourniture de leurs services.32016R0679-a99-p2It shall apply from 25 May 2018.32016R0679-a2-p1This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.32016R0679-a2-p2This Regulation does not apply to the processing of personal data:32016R0679-a3-p1This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.32016R0679-a3-p2This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:32016R0679-a32-p1Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:F20-PE-02Mener une analyse de risques, même minimale, selon les trois étapes suivantes : 1. Recenser les traitements de données personnelles, automatisés ou non, les données traitées (ex. : fichiers clients, contrats) et les supports sur lesquels ces traitements reposent : les matériels (ex. : serveurs, ordinateurs portables, disques durs) ; les logiciels (ex. : systèmes d’exploitation, logiciels métier) ; les ressources d’informatique en nuage (cloud) utilisés (ex. : SaaS, PaaS, IaaS) ; les canaux de communication logiques ou physiques (ex. : fibre optique, Wi-Fi, Internet, échanges verbaux, coursiers) ; les supports papier (ex. : documents imprimés, photocopies) ; les locaux et installations physiques où se situent les éléments précédemment cités (ex. : locaux informatiques, bureaux). Cette étape mérite d’être menée indépendamment de toute analyse de risques (voir la fiche n°1 - Piloter la sécurité des données). 2. Apprécier les risques engendrés par chaque traitement : a. Identifier les impacts potentiels sur les droits et libertés des personnes concernées, pour les trois évènements redoutés suivants : accès illégitime à des données (ex. : usurpation d’identité consécutive à la divulgation des fiches de paie de l’ensemble des salariés d’une entreprise) ; modification non désirée de données (ex. : accusation à tort d’une personne d’une faute ou d’un délit suite à la modification de journaux d’accès) ; disparition temporaire ou définitive de données (ex. : non-détection d’une interaction médicamenteuse du fait de l’impossibilité d’accéder au dossier électronique du patient). b. Identifier les sources de risques (qui ou qu’est-ce qui pourrait être à l’origine de chaque évènement redouté ?), en prenant en compte des sources humaines internes et externes (ex. : administrateur informatique, utilisateur, attaquant externe, concurrent) ainsi que des sources non humaines internes et externes (ex. : eau, épidémie, matériaux dangereux, virus informatique non ciblé). c. Identifier les menaces (qu’est-ce qui pourrait permettre que chaque évènement redouté survienne ?). Ces menaces surviennent sur les supports identifiés précédemment (matériels, logiciels, canaux de communication, supports papier, etc.), qui peuvent être : utilisés de manière inadaptée (ex. : abus de droits, erreur de manipulation) ; modifiés (ex. : piégeage logiciel ou matériel ou « keylogger », installation d’un logiciel malveillant) ; perdus (ex. : vol d’un ordinateur portable, perte d’une clé USB) ; observés (ex. : observation d’un écran dans un train, géolocalisation d’un matériel) ; détériorés (ex. : vandalisme, dégradation du fait de l’usure naturelle) ; surchargés (ex. : unité de stockage pleine, attaque par déni de service). d. Déterminer les mesures existantes ou prévues qui permettent de réduire chaque risque (ex. : contrôle d’accès, sauvegardes, traçabilité, sécurité des locaux, chiffrement, anonymisation). e. Estimer la gravité (impact ou préjudice potentiel pour les personnes concernées) et la vraisemblance (probabilité qu’ils se réalisent) des risques, au regard des éléments précédents (exemple d’échelle utilisable pour l’estimation : négligeable, modérée, importante, maximale). Le tableau suivant peut être utilisé pour formaliser cette réflexion : 3. Mettre en œuvre et vérifier les mesures prévues. Si les mesures existantes et prévues sont jugées appropriées, il convient de s’assurer qu’elles soient appliquées et contrôlées (voir la fiche n°1 - Piloter la sécurité des données). Sinon, des mesures supplémentaires doivent être identifiées et mises en œuvre pour réduire la gravité et/ou la vraisemblance des risques associés.32016R0679-a32-p2In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.F20-PE-03Revoir régulièrement l’analyse de risques et, en particulier, en cas de modification du système ou du contexte du traitement.32016R0679-a32-p1-2the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;F16-PE-01Prévoir un système de journalisation (c’est-à-dire un enregistrement dans des fichiers journaux ou « logs ») des activités métier des utilisateurs (traces applicatives), des interventions techniques (y compris par les administrateurs), des anomalies et des évènements liés à la sécurité (traces techniques ou « système »).F16-PE-05Protéger les équipements de journalisation et les informations journalisées pour empêcher les opérations non autorisées (ex. : en les rendant inaccessibles aux personnes dont l’activité est journalisée), les mésusages par des comptes habilités (ex. : en mettant en place une charte d’utilisation ou des alertes spécifiques) et l’écrasement des traces générées par les applicatifs concernés.32016R0679-a32-p1-3the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;F17-PE-01Effectuer des sauvegardes fréquentes des données, que celles-ci soient sous forme papier ou électronique. Il peut être opportun de prévoir des sauvegardes incrémentales quotidiennes et des sauvegardes complètes à intervalles réguliers.F17-PE-03Isoler au moins une sauvegarde hors ligne, déconnectée du réseau de l’entreprise.F09-PE-07Effectuer des sauvegardes et vérifier régulièrement leur intégrité et la capacité de les restaurer (voir la fiche n°17 - Sauvegarder).32016R0679-a28-p1Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.F14-PE-02Prévoir un contrat avec les sous-traitants, qui définit notamment l’objet, la durée, la finalité du traitement ainsi que les obligations des parties, notamment en termes de sécurité. S’assurer qu’il contient en particulier des dispositions fixant : la répartition des responsabilités et des obligations en matière de confidentialité des données personnelles confiées ; des contraintes minimales en matière d’authentification des utilisateurs ; les conditions de restitution et de destruction des données en fin du contrat ; les règles de gestion et de notification des incidents. Celles-ci devraient comprendre une information du responsable de traitement en cas de découverte de faille de sécurité ou d’incident de sécurité et cela dans les plus brefs délais lorsqu’il s’agit d’une violation de données personnelles ; l’assistance que doit fournir le sous-traitant pour garantir le respect des obligations de sécurité ; la revue régulière des mesures de sécurité et, le cas échéant, les conditions de leur révision.32016R0679-a33-p1In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.32016R0679-a34-p1When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.F19-PE-05Évaluer le risque, pour les personnes, engendré par la violation en tenant compte de la gravité et de la probabilité des conséquences que la violation pourrait avoir sur leurs droits et libertés.F19-PE-06Tenir un registre interne de toutes les violations de données personnelles.32016R0679-a24-p1Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.F01-PE-05Assurer un suivi avec la direction en termes de gestion de risques informatiques à travers une revue de direction au moins annuelle. Elle doit permettre d’établir une synthèse et de prendre des décisions considérant : l’évolution du contexte, des enjeux et des attentes des parties prenantes (ex. : clients, partenaires, autorités de contrôle) ; le changement des objectifs et missions de l’organisme ; l’évolution de la menace numérique ; l’essor de nouvelles technologies ou solutions de sécurité ; les évolutions des systèmes d’information et des traitements de données ; l’évolution des risques sur la sécurité des données et la vie privée ; l’avancement du plan d’action juridique (ex. : mise en conformité des contrats) et technique (mesures de sécurité) ; les incidents et violations rencontrés, avec leur impact sur l’organisme et les personnes concernées ; les demandes et plaintes reçues et traitées concernant les données personnelles.32016R0679-a32-p1-4a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.32016R0679-a3-p2-1the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or32016R0679-a3-p2-2the monitoring of their behaviour as far as their behaviour takes place within the Union.32024R2847-a2-p1This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.32024R2847-a2-p2This Regulation does not apply to products with digital elements to which the following Union legal acts apply:32024R2847-a3-p0-13‘manufacturer’ means a natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge;32024R2847-a71-p2This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.32024R2847-a13-p1When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I.32024R2847-a13-p2For the purpose of complying with paragraph 1, manufacturers shall undertake an assessment of the cybersecurity risks associated with a product with digital elements and take the outcome of that assessment into account during the planning, design, development, production, delivery and maintenance phases of the product with digital elements with a view to minimising cybersecurity risks, preventing incidents and minimising their impact, including in relation to the health and safety of users.32024R2847-a13-p3The cybersecurity risk assessment shall be documented and updated as appropriate during a support period to be determined in accordance with paragraph 8 of this Article. That cybersecurity risk assessment shall comprise at least an analysis of cybersecurity risks based on the intended purpose and reasonably foreseeable use, as well as the conditions of use, of the product with digital elements, such as the operational environment or the assets to be protected, taking into account the length of time the product is expected to be in use. The cybersecurity risk assessment shall indicate whether and, if so in what manner, the security requirements set out in Part I, point (2), of Annex I are applicable to the relevant product with digital elements and how those requirements are implemented as informed by the cybersecurity risk assessment. It shall also indicate how the manufacturer is to apply Part I, point (1), of Annex I and the vulnerability handling requirements set out in Part II of Annex I.32024R2847-a13-p5For the purpose of complying with paragraph 1, manufacturers shall exercise due diligence when integrating components sourced from third parties so that those components do not compromise the cybersecurity of the product with digital elements, including when integrating components of free and open-source software that have not been made available on the market in the course of a commercial activity.32024R2847-a13-p6Manufacturers shall, upon identifying a vulnerability in a component, including in an open source-component, which is integrated in the product with digital elements report the vulnerability to the person or entity manufacturing or maintaining the component, and address and remediate the vulnerability in accordance with the vulnerability handling requirements set out in Part II of Annex I. Where manufacturers have developed a software or hardware modification to address the vulnerability in that component, they shall share the relevant code or documentation with the person or entity manufacturing or maintaining the component, where appropriate in a machine-readable format.32024R2847-a13-p8Manufacturers shall ensure, when placing a product with digital elements on the market, and for the support period, that vulnerabilities of that product, including its components, are handled effectively and in accordance with the essential cybersecurity requirements set out in Part II of Annex I. Manufacturers shall determine the support period so that it reflects the length of time during which the product is expected to be in use, taking into account, in particular, reasonable user expectations, the nature of the product, including its intended purpose, as well as relevant Union law determining the lifetime of products with digital elements. When determining the support period, manufacturers may also take into account the support periods of products with digital elements offering a similar functionality placed on the market by other manufacturers, the availability of the operating environment, the support periods of integrated components that provide core functions and are sourced from third parties as well as relevant guidance provided by the dedicated administrative cooperation group (ADCO) established pursuant to Article 52(15) and the Commission. The matters to be taken into account in order to determine the support period shall be considered in a manner that ensures proportionality. Without prejudice to the second subparagraph, the support period shall be at least five years. Where the product with digital elements is expected to be in use for less than five years, the support period shall correspond to the expected use time. Taking into account ADCO recommendations as referred to in Article 52(16), the Commission may adopt delegated acts in accordance with Article 61 to supplement this Regulation by specifying the minimum support period for specific product categories where the market surveillance data suggests inadequate support periods. Manufacturers shall include the information that was taken into account to determine the support period of a product with digital elements in the technical documentation as set out in Annex VII. Manufacturers shall have appropriate policies and procedures, including coordinated vulnerability disclosure policies, referred to in Part II, point (5), of Annex I to process and remediate potential vulnerabilities in the product with digital elements reported from internal or external sources.32024R2847-a14-p1A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that actively exploited vulnerability via the single reporting platform established pursuant to Article 16.32024R2847-a14-p2-1an early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it, indicating, where applicable, the Member States on the territory of which the manufacturer is aware that their product with digital elements has been made available;32024R2847-a14-p2-2unless the relevant information has already been provided, a vulnerability notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively exploited vulnerability, which shall provide general information, as available, about the product with digital elements concerned, the general nature of the exploit and of the vulnerability concerned as well as any corrective or mitigating measures taken, and corrective or mitigating measures that users can take, and which shall also indicate, where applicable, how sensitive the manufacturer considers the notified information to be;32024R2847-a14-p2-3unless the relevant information has already been provided, a final report, no later than 14 days after a corrective or mitigating measure is available, including at least the following:32024R2847-a14-p3A manufacturer shall notify any severe incident having an impact on the security of the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that incident via the single reporting platform established pursuant to Article 16.32024R2847-a14-p4-1an early warning notification of a severe incident having an impact on the security of the product with digital elements, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it, including at least whether the incident is suspected of being caused by unlawful or malicious acts, which shall also indicate, where applicable, the Member States on the territory of which the manufacturer is aware that their product with digital elements has been made available;32024R2847-a14-p4-2unless the relevant information has already been provided, an incident notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the incident, which shall provide general information, where available, about the nature of the incident, an initial assessment of the incident, as well as any corrective or mitigating measures taken, and corrective or mitigating measures that users can take, and which shall also indicate, where applicable, how sensitive the manufacturer considers the notified information to be;32024R2847-a14-p4-3unless the relevant information has already been provided, a final report, within one month after the submission of the incident notification under point (b), including at least the following:32024R1689-a2-p1This Regulation applies to:32024R1689-a2-p1-1providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country;32024R1689-a2-p1-2deployers of AI systems that have their place of establishment or are located within the Union;32024R1689-a2-p1-3providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union;32024R1689-a2-p3This Regulation does not apply to areas outside the scope of Union law, and shall not, in any event, affect the competences of the Member States concerning national security, regardless of the type of entity entrusted by the Member States with carrying out tasks in relation to those competences. This Regulation does not apply to AI systems where and in so far they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes, regardless of the type of entity carrying out those activities. This Regulation does not apply to AI systems which are not placed on the market or put into service in the Union, where the output is used in the Union exclusively for military, defence or national security purposes, regardless of the type of entity carrying out those activities.32024R1689-a3-p0-3‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge;32024R1689-a3-p0-4‘deployer’ means a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity;32024R1689-a5-p1The following AI practices shall be prohibited:32024R1689-a6-p2In addition to the high-risk AI systems referred to in paragraph 1, AI systems referred to in Annex III shall be considered to be high-risk.32024R1689-a50-p1Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use. This obligation shall not apply to AI systems authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, unless those systems are available for the public to report a criminal offence.32024R1689-a113-p0This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union . It shall apply from 2 August 2026. However:32024R1689-a113-p0-1Chapters I and II shall apply from 2 February 2025;32024R1689-a113-p0-3Article 6(1) and the corresponding obligations in this Regulation shall apply from 2 August 2027.32024R1689-a4-p0Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.32024R1689-a6-p3By derogation from paragraph 2, an AI system referred to in Annex III shall not be considered to be high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making. The first subparagraph shall apply where any of the following conditions is fulfilled:32024R1689-a6-p4A provider who considers that an AI system referred to in Annex III is not high-risk shall document its assessment before that system is placed on the market or put into service. Such provider shall be subject to the registration obligation set out in Article 49(2). Upon request of national competent authorities, the provider shall provide the documentation of the assessment.32024R1689-a9-p1A risk management system shall be established, implemented, documented and maintained in relation to high-risk AI systems.32024R1689-a9-p2The risk management system shall be understood as a continuous iterative process planned and run throughout the entire lifecycle of a high-risk AI system, requiring regular systematic review and updating. It shall comprise the following steps:32024R1689-a27-p1Prior to deploying a high-risk AI system referred to in Article 6(2), with the exception of high-risk AI systems intended to be used in the area listed in point 2 of Annex III, deployers that are bodies governed by public law, or are private entities providing public services, and deployers of high-risk AI systems referred to in points 5 (b) and (c) of Annex III, shall perform an assessment of the impact on fundamental rights that the use of such system may produce. For that purpose, deployers shall perform an assessment consisting of:32024R1689-a15-p1High-risk AI systems shall be designed and developed in such a way that they achieve an appropriate level of accuracy, robustness, and cybersecurity, and that they perform consistently in those respects throughout their lifecycle.32024R1689-a15-p5High-risk AI systems shall be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities. The technical solutions aiming to ensure the cybersecurity of high-risk AI systems shall be appropriate to the relevant circumstances and the risks. The technical solutions to address AI specific vulnerabilities shall include, where appropriate, measures to prevent, detect, respond to, resolve and control for attacks trying to manipulate the training data set (data poisoning), or pre-trained components used in training (model poisoning), inputs designed to cause the AI model to make a mistake (adversarial examples or model evasion), confidentiality attacks or model flaws.32024R1689-a26-p1Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems, pursuant to paragraphs 3 and 6.32024R1689-a26-p2Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.32024R1689-a26-p5Deployers shall monitor the operation of the high-risk AI system on the basis of the instructions for use and, where relevant, inform providers in accordance with Article 72. Where deployers have reason to consider that the use of the high-risk AI system in accordance with the instructions may result in that AI system presenting a risk within the meaning of Article 79(1), they shall, without undue delay, inform the provider or distributor and the relevant market surveillance authority, and shall suspend the use of that system. Where deployers have identified a serious incident, they shall also immediately inform first the provider, and then the importer or distributor and the relevant market surveillance authorities of that incident. If the deployer is not able to reach the provider, Article 73 shall apply mutatis mutandis . This obligation shall not cover sensitive operational data of deployers of AI systems which are law enforcement authorities. For deployers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law, the monitoring obligation set out in the first subparagraph shall be deemed to be fulfilled by complying with the rules on internal governance arrangements, processes and mechanisms pursuant to the relevant financial service law.32024R1689-a26-p6Deployers of high-risk AI systems shall keep the logs automatically generated by that high-risk AI system to the extent such logs are under their control, for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in applicable Union or national law, in particular in Union law on the protection of personal data. Deployers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law shall maintain the logs as part of the documentation kept pursuant to the relevant Union financial service law.32024R1689-a50-p2Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated. Providers shall ensure their technical solutions are effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art, as may be reflected in relevant technical standards. This obligation shall not apply to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof, or where authorised by law to detect, prevent, investigate or prosecute criminal offences.32024R1689-a50-p4Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offence. Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the transparency obligations set out in this paragraph are limited to disclosure of the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work. Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences or where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content.32024R1689-a73-p1Providers of high-risk AI systems placed on the Union market shall report any serious incident to the market surveillance authorities of the Member States where that incident occurred.32024R1689-a73-p2The report referred to in paragraph 1 shall be made immediately after the provider has established a causal link between the AI system and the serious incident or the reasonable likelihood of such a link, and, in any event, not later than 15 days after the provider or, where applicable, the deployer, becomes aware of the serious incident. The period for the reporting referred to in the first subparagraph shall take account of the severity of the serious incident.32024R1689-a73-p3Notwithstanding paragraph 2 of this Article, in the event of a widespread infringement or a serious incident as defined in Article 3, point (49)(b), the report referred to in paragraph 1 of this Article shall be provided immediately, and not later than two days after the provider or, where applicable, the deployer becomes aware of that incident.32024R1689-a73-p4Notwithstanding paragraph 2, in the event of the death of a person, the report shall be provided immediately after the provider or the deployer has established, or as soon as it suspects, a causal relationship between the high-risk AI system and the serious incident, but not later than 10 days after the date on which the provider or, where applicable, the deployer becomes aware of the serious incident.32022R2554-a2-p3-1managers of alternative investment funds as referred to in Article 3(2) of Directive 2011/61/EU;32022R2554-a2-p3-2insurance and reinsurance undertakings as referred to in Article 4 of Directive 2009/138/EC;