Biometrics
Remote biometric identification, biometric categorisation, emotion recognition systems — outside prohibited use cases.
Article 22 · Regulation (EU) 2024/1689
Article 22 applies to non-EU providers of high-risk AI systems under either Article 6(1) / Annex I or Article 6(2) / Annex III. Under Article 113 as amended by Regulation (EU) 2026/1744, Section 3 — including Article 22 — applies from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. SecureFound can prepare and assume that mandate for the applicable market-entry date.
Article 6 scope
Article 22 covers high-risk AI systems classified through either route in Article 6: Article 6(1) covers certain AI systems that are safety components of, or themselves products covered by, Annex I legislation and require third-party conformity assessment; Article 6(2) covers systems listed in Annex III, subject to the classification rules in Article 6. The categories below summarise the Annex III route.
Remote biometric identification, biometric categorisation, emotion recognition systems — outside prohibited use cases.
AI used as safety components in management and operation of critical digital infrastructure, road traffic, water, gas, heating, electricity.
AI determining access to educational institutions, evaluating learning outcomes, assessing students, monitoring exams.
Recruitment, candidate evaluation, promotion and termination decisions, task allocation, monitoring and evaluation of workers.
Credit scoring, eligibility for public benefits, risk assessment for life and health insurance, emergency call dispatching.
AI used by law enforcement for risk assessment, polygraphs, evidence reliability, profiling — within permitted uses.
Risk assessment for migration, polygraphs at borders, examination of asylum and visa applications.
AI assisting judicial authorities in researching and applying law to facts; AI influencing voting behaviour.
Article 22 obligations
Confirm the EU Declaration of Conformity and technical documentation are drawn up correctly.
Maintain provider contact details, DoC, technical documentation, certifications at the disposal of competent authorities.
Provide reasoned-request documentation, cooperate with national market surveillance authorities, support risk mitigation.
Assist with the EU database registration and ensure information accuracy.
Timeline
Regulation (EU) 2026/1744 entered into force on 27 July 2026 and amended Article 113. Chapter III, Sections 1, 2 and 3 apply from 2 December 2027 for high-risk systems classified under Article 6(2) / Annex III and from 2 August 2028 for systems classified under Article 6(1) / Annex I.
Article 22 is in Chapter III, Section 3, so its statutory appointment obligation follows those application dates. A provider may prepare or appoint a representative earlier as part of market-entry planning, but the former 2 August 2026 date is no longer the current Article 22 application deadline.
Send us the basics of your AI system. We respond within 48 hours with a confidential eligibility review.
Request eligibility review