Art.4a(2) — Special-category data processed for bias detection outside the high-risk provider case — deployers of high-risk systems, and providers and deployers of other AI systems and models
Examine this duty against your system’s use and your operator role. Keep supporting records, unresolved questions and a named reviewer’s determination together.
See how E-ARI connects evidence and decision review to governance reports.
- Who it binds
- provider, deployer
- Supporting record to examine
- a written policy. A record supports review; its presence does not establish that this duty is satisfied. Documentation cannot make a prohibited practice permissible.
- Usually owned by
- DPO
- Severity
- Major — a gap here is a finding an auditor will raise and expect a remediation plan for.
Does it apply to you?
Applicability under the Act is risk tier × operator role, not tier alone. This grid is computed by running the same function the assessment uses, so it cannot drift from what the product would tell you.
- high riskprovider, deployer
Read against Regulation (EU) 2024/1689 as amended, consolidated text 02024R1689-20260727 (consolidation 001.001, incorporating Regulation (EU) 2026/1744). What we work from