A provider or prospective provider testing an Annex III high-risk AI system in real world conditions outside a sandbox may do so only where every Art.60(4) condition is met: a real-world testing plan has been drawn up and submitted to the market surveillance authority of the Member State where the testing takes place; that authority has approved the testing and the plan, approval being understood as given after thirty days of silence unless national law requires an express authorisation; the testing has been registered with a Union-wide unique single identification number and the Annex IX information, in the secure non-public section for law enforcement, migration, asylum and border control systems; the provider is established in the Union or has appointed a Union legal representative; data transferred to third countries is covered by applicable Union safeguards; the testing lasts no longer than necessary and no more than six months, extendable once by six months on prior notification with an explanation; subjects belonging to vulnerable groups are appropriately protected; co-operating deployers are informed of all relevant aspects, given the Art.13 instructions for use, and bound by an agreement setting out roles and responsibilities; the subjects have given informed consent under Art.61, save in the narrow law enforcement case where the testing and its outcome must have no negative effect and personal data must be deleted afterwards; the testing is effectively overseen by suitably qualified persons with the capacity, training and authority to act; and the system's predictions, recommendations or decisions can be effectively reversed and disregarded. Subjects may withdraw at any time without detriment or justification and may require the immediate permanent deletion of their personal data, and any serious incident during the testing must be reported under Art.73.
This control maps to 12 controls across 6 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
EU AI Act EUAI-Art.60 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of EU AI Act your existing evidence covers. Hold ISO/IEC 42001:2023 and 17 of 43 EU AI Act controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the ISO/IEC 42001:2023 pair alone.
The graph holds this control, the 12 it maps to, and the evidence behind each claim, over MCP and REST.