Applicablev1.0.0

Article 46: derogation from conformity assessment procedure

By way of derogation from Article 43, a market surveillance authority may, upon a duly justified request, authorise the placing on the market or the putting into service of specific high-risk AI systems within the territory of the Member State concerned, for exceptional reasons of public security, the protection of life and health of persons, environmental protection or the protection of key industrial and infrastructural assets. The authorisation is for a limited period while the conformity assessment is carried out, and those procedures are completed without undue delay. Law-enforcement authorities and civil protection authorities may start without an authorisation in a situation of urgency, provided that it is requested without undue delay; if it is refused, use stops with immediate effect and all results and outputs are discarded. The authorisation is issued only if the system complies with the requirements of Section 2, goes to the Commission and the other Member States, and is deemed justified after fifteen calendar days without objection.

Preliminary reading

What the provision says is settled; who the duty holder is in this model is not. Article 46 addresses the market surveillance authority (paragraphs 1, 3 and 6) and the Commission (paragraph 5). The provider and the deployer are the requesting party and the party that bears the consequences, and they therefore sit in `affected_actor_ids` with `duty_holder_uncertainty_status: out_of_scope`. A defensible alternative reading writes the market surveillance authority in as duty holder: it exists as an actor in this dataset, and paragraphs 3 and 6 impose a notification and a withdrawal on it that read as duties. On that reading it moves from `oversight_actor_ids` to `duty_holder_ids` and the provider and deployer stay as affected parties; the substance of this object does not change, the basis does. We keep it in the oversight role because no other obligation in this dataset names it as addressee and the meaning of the field would otherwise differ within the same dataset. What also remains uncertain is what the limited period of paragraph 1 is: the text names no maximum and ties the duration only to the exceptional reasons justifying the derogation and to the conformity assessment being carried out. Anyone building on this route cannot read from the text how long it may last. On the dating there is no such doubt: Article 46 sits in Section 5 of Chapter III, the third paragraph of Article 113 excepts only Sections 1, 2 and 3 and its point (b) concerns Section 4, so the general application date of the second paragraph governs, 2 August 2026. On Regulation (EU) 2026/1744. That text was retrieved after all on 6 September 2026 from the Publications Office Cellar service and is archived in data/ai-act/review/sources/reg-eu-2026-1744-nl.txt and -en.txt. The amending regulation carries forty-three amendment points in its Article 1; which of those are reflected in the local legal texts is recorded per point in data/ai-act/review/consolidation-manifest.json. Where a point touches this Article, that is stated below with the statement concerned.

The text of the provision is settled. How it plays out has not been decided in case law or guidance, so this is our reasoned reading and not established law. Weigh it yourself, or put it to your own lawyer.

Paragraph 1 provides the following.

Praxikon tracks Article 46: derogation from conformity assessment procedure under the EU AI Act, checked against the official source on 6 September 2026, citing the source for every statement.

Status: Applicable
Application date: Not recorded
Version: 1.0.0
Last reviewed: 6 September 2026

Review status: placed against the official source (6 September 2026). Next check due by 5 March 2027. The check date is the knowledge date of this version; no later recheck has been recorded.

From source to evidence

Why this obligation applies, what it asks of you, and what you show for it.

Applies

Applicable · Not recorded

For whom

Deployer
Provider of an AI system
Body governed by public law

What you do

Prepare a derogation request and the exit plan that goes with it

What you record

File accompanying a request to derogate from the conformity assessment

Official source

Article 46(1)-(2)

Who this is relevant to

When this applies

Deployer
An organisation using an AI system under its authority, excluding personal non-professional use.
Provider of an AI system
A party that develops or has an AI system developed and places it on the market under its own name.
Body governed by public law
A deployer that is a body governed by public law.

1The authorisation may be granted only for exceptional reasons of public security or the protection of life and health of persons, environmental protection or the protection of key industrial and infrastructural assets. That list is the entire basis: a commercial interest, a delivery deadline or a tender date is not in it.
2A duly justified request is required, the authorisation comes from a market surveillance authority, it concerns specific high-risk AI systems, and it operates solely within the territory of the Member State concerned. It is moreover for a limited period while the necessary conformity assessment procedures are being carried out, and the completion of those procedures shall be undertaken without undue delay.
3The authorisation is issued only if the market surveillance authority concludes that the high-risk AI system complies with the requirements of Section 2. The derogation therefore concerns the procedure of Article 43 and not the substantive requirements of Articles 8 to 15: those must be met before the authorisation exists.

What the official source establishes

Paragraph 3 provides the following. The authorisation referred to in paragraph 1 shall be issued only if the market surveillance authority concludes that the high-risk AI system complies with the requirements of Section 2. The market surveillance authority shall inform the Commission and the other Member States of any authorisation issued pursuant to paragraphs 1 and 2. This obligation shall not cover sensitive operational data in relation to the activities of law-enforcement authorities. Paragraph 4 provides the following. Where, within 15 calendar days of receipt of the information referred to in paragraph 3, no objection has been raised by either a Member State or the Commission in respect of an authorisation issued by a market surveillance authority of a Member State in accordance with paragraph 1, that authorisation shall be deemed justified.

Paragraph 5 provides the following. Where, within 15 calendar days of receipt of the notification referred to in paragraph 3, objections are raised by a Member State against an authorisation issued by a market surveillance authority of another Member State, or where the Commission considers the authorisation to be contrary to Union law, or the conclusion of the Member States regarding the compliance of the system as referred to in paragraph 3 to be unfounded, the Commission shall, without delay, enter into consultations with the relevant Member State. The operators concerned shall be consulted and have the possibility to present their views. Having regard thereto, the Commission shall decide whether the authorisation is justified. The Commission shall address its decision to the Member State concerned and to the relevant operators. Paragraph 6 provides the following. Where the Commission considers the authorisation unjustified, it shall be withdrawn by the market surveillance authority of the Member State concerned. Paragraph 7 provides the following. For high-risk AI systems related to products covered by Union harmonisation legislation listed in Section A of Annex I, only the derogations from the conformity assessment established in that Union harmonisation legislation shall apply.

Our interpretation

The official source remains authoritative. This general interpretation is not legal advice.

This is the only route in the Regulation along which a high-risk AI system reaches the market or is put into service without a completed conformity assessment, and that is exactly why it is not a commercial route. Three things make that firm. The grounds are exhaustive and none of them is about the supplier: public security, the protection of life and health of persons, environmental protection, the protection of key industrial and infrastructural assets. A tight delivery deadline, a tender closing in, or a notified body with a waiting list are not among them. The derogation moreover concerns only the procedure of Article 43 and not the substance: paragraph 3 allows the authorisation only where the market surveillance authority concludes that the system complies with the requirements of Section 2. So it does not buy you time to do Articles 9 to 15 later; at most it buys time for the paperwork of the assessment. And it is closed off geographically: the authorisation operates within the territory of the Member State concerned, which means a system running on this basis in one Member State simply has no basis in the next. Note finally paragraph 7. For high-risk AI systems related to products under Section A of Annex I this Article is not a route: there, only the derogations of the sectoral harmonisation legislation apply. Anyone building a regulated product therefore looks for the exit in his own sectoral framework and not here.

Paragraph 2 reverses the order and that is the heaviest part of this Article for whoever uses it. In a situation of urgency a law-enforcement authority or a civil protection authority may put the system into service first and request the authorisation afterwards, provided that happens without undue delay. The other side sits in the same sentence: if the authorisation is refused, use stops with immediate effect and all results and outputs of that use are immediately discarded. That is not a suspension but a rollback, and it reaches what was produced in the meantime. Anyone starting on this basis must therefore know in advance which decisions, files, alerts and derived datasets count as results and outputs and how they can be found; working out afterwards what the system touched is too late by then, and a decision that rested on such an output is left standing without support. There is also a European aftermath that lands on the requester without him being a party to it. The market surveillance authority informs the Commission and the other Member States, and after 15 calendar days without objection the authorisation is deemed justified. If an objection is raised, by a Member State or by the Commission, the Commission enters into consultations, the operators concerned are consulted and the Commission decides. If it considers the authorisation unjustified, the market surveillance authority withdraws it. For the organisation that means: an authorisation is not firm for the first fifteen days, and it stays withdrawable afterwards. Plan for those two moments, and make sure the conformity assessment genuinely continues in the meantime, because the text names no maximum duration and ties the limited period only to the completion of those procedures.

What you can do now

Treat this route as a contingency plan and not as a planning option. Establish, before you need it, whether it is open to you at all: if your system sits in a product from Section A of Annex I, paragraph 7 closes it and you look for the derogation in your sectoral framework. If it is open, draft the reasoning document now: which of the four exceptional reasons you invoke, on which facts, why delay is not possible, and why this system in particular. Add to it the evidence that the system complies with the requirements of Section 2, because without that conclusion the market surveillance authority cannot issue the authorisation. Record where the conformity assessment stands and what still has to happen, with an end date, and name the person who carries that procedure through while the system runs. If you prepare for the reversed order of paragraph 2, that comes with an exit plan written in advance: which decisions, files, alerts and derived datasets count as results and outputs, how they can be traced per system version, who discards them, within what period, and what happens to decisions that rested on them. Put the fifteen calendar days after the notification of paragraph 3 in your calendar as the moment the authorisation first counts as justified, and reckon with withdrawal after that. Finally, set out in supplier contracts who submits the request, who supplies the reasoning and who bears the cost if the authorisation is refused or withdrawn.

01
Prepare a derogation request and the exit plan that goes with it
Write in advance the reasoning paragraph 1 calls for, with the exceptional reason invoked, the evidence that the system complies with the requirements of Section 2, the status of the ongoing conformity assessment, and an exit plan in case the authorisation is refused or withdrawn.

What to retain

File accompanying a request to derogate from the conformity assessment

Per request: which system and which version, which exceptional reason was invoked and on which facts, to which market surveillance authority and on what date the request was made, what the status of the conformity assessment was, which end date was agreed, when the notification of paragraph 3 was made, and what the outcome was.

Control and reassessment

Review of an authorisation expiring, being refused or withdrawn
The control that keeps a system running under Article 46 under watch: the ongoing conformity assessment has an owner and an end date, the fifteen calendar days of paragraph 4 are in the calendar, and a rehearsed plan is in place to stop use with immediate effect and discard all results and outputs if the authorisation is refused or withdrawn.

Public tools

Full text of Article 46
The full legal text in the public AI Act Explorer.
Read Article 46 in the AI Act Explorer

Conditions and exceptions

Paragraph 2 removes the prior authorisation in a duly justified situation of urgency for exceptional reasons of public security or in the case of a specific, substantial and imminent threat to the life or physical safety of natural persons. Only law-enforcement authorities and civil protection authorities may rely on it, and only for putting into service, provided that such authorisation is requested during or after the use without undue delay.
Paragraph 7 excludes this Article for high-risk AI systems related to products covered by Union harmonisation legislation listed in Section A of Annex I. There, only the derogations from the conformity assessment established in that Union harmonisation legislation shall apply. For a regulated product, Article 46 is therefore not a route.
The notification duty in paragraph 3 towards the Commission and the other Member States shall not cover sensitive operational data in relation to the activities of law-enforcement authorities. The authorisation itself stands; the flow of data around it is limited.

Official sources and locators

EU Artificial Intelligence Act 2024/1689
European Parliament and Council | original-oj-2024-07-12
Source locator: Article 46(1)-(2)
Open official source
EU Artificial Intelligence Act 2024/1689
European Parliament and Council | original-oj-2024-07-12
Source locator: Article 46(3)-(4)
Open official source
EU Artificial Intelligence Act 2024/1689
European Parliament and Council | original-oj-2024-07-12
Source locator: Article 46(5)-(7)
Open official source
EU Artificial Intelligence Act 2024/1689
European Parliament and Council | original-oj-2024-07-12
Source locator: Article 43(1), (2) and (4); Article 47(1); Article 48(1); Article 49(1); Article 79(1); Chapter III, Section 5, and Article 113, second paragraph
Open official source

Referring to this object

Citation block

Copy this reference into your advice, article or file. The identifier, the version and the hash keep the statement findable later, even once the dataset has moved on.

Reference

Praxikon, "Article 46: derogation from conformity assessment procedure",
praxikon:eu:ai-act:obligation:article-46-derogation-from-conformity-assessment@1.0.0,
dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.2.0 (schema 1.5.0),
effective_at 2026-08-02T00:00:00.000Z, known_at 2026-09-06T00:00:00.000Z,
sha256 1750dded1098676522ac2284e471cb504967e1c6055f5c0a19d556778c2e3792,
https://www.praxikon.com/en/verplichtingen/article-46-derogation-from-conformity-assessment
(https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-46-derogation-from-conformity-assessment&effective_at=2026-08-02&known_at=2026-09-06&lang=en, accessed 2026-09-15)

Short form

praxikon:eu:ai-act:obligation:article-46-derogation-from-conformity-assessment@1.0.0 (sha256 1750dded)

BibTeX

@misc{praxikon-eu-ai-act-obligation-article-46-derogation-from-conformity-assessment-1-0-0,
  author       = {{Praxikon}},
  title        = {Article 46: derogation from conformity assessment procedure},
  year         = {2026},
  version      = {1.0.0},
  number       = {praxikon:eu:ai-act:obligation:article-46-derogation-from-conformity-assessment},
  howpublished = {AI Act Change \& Evidence Graph, dataset 2.2.0, schema 1.5.0},
  note         = {effective_at 2026-08-02T00:00:00.000Z; known_at 2026-09-06T00:00:00.000Z; sha256 1750dded1098676522ac2284e471cb504967e1c6055f5c0a19d556778c2e3792},
  url          = {https://www.praxikon.com/en/verplichtingen/article-46-derogation-from-conformity-assessment},
  urldate      = {2026-09-15},
  language     = {en}
}

CSL JSON

[
  {
    "id": "praxikon:eu:ai-act:obligation:article-46-derogation-from-conformity-assessment@1.0.0",
    "type": "dataset",
    "title": "Article 46: derogation from conformity assessment procedure",
    "container-title": "AI Act Change & Evidence Graph",
    "publisher": "Praxikon",
    "version": "1.0.0",
    "number": "praxikon:eu:ai-act:obligation:article-46-derogation-from-conformity-assessment",
    "URL": "https://www.praxikon.com/en/verplichtingen/article-46-derogation-from-conformity-assessment",
    "language": "en",
    "issued": {
      "date-parts": [
        [
          2026,
          9,
          6
        ]
      ]
    },
    "accessed": {
      "date-parts": [
        [
          2026,
          9,
          15
        ]
      ]
    },
    "note": "dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.2.0; schema 1.5.0; effective_at 2026-08-02T00:00:00.000Z; known_at 2026-09-06T00:00:00.000Z; sha256 1750dded1098676522ac2284e471cb504967e1c6055f5c0a19d556778c2e3792; retrieved_from https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-46-derogation-from-conformity-assessment&effective_at=2026-08-02&known_at=2026-09-06&lang=en; licence https://www.praxikon.com/nl/legal/terms"
  }
]

How to verify a reference later is set out in the methodology. Terms

Version history

v1.0.0
2 August 2026
Article 46: derogation from conformity assessment procedure
By way of derogation from Article 43, a market surveillance authority may, upon a duly justified request, authorise the placing on the market or the putting into service of specific high-risk AI systems within the territory of the Member State concerned, for exceptional reasons of public security, the protection of life and health of persons, environmental protection or the protection of key industrial and infrastructural assets. The authorisation is for a limited period while the conformity assessment is carried out, and those procedures are completed without undue delay. Law-enforcement authorities and civil protection authorities may start without an authorisation in a situation of urgency, provided that it is requested without undue delay; if it is refused, use stops with immediate effect and all results and outputs are discarded. The authorisation is issued only if the system complies with the requirements of Section 2, goes to the Commission and the other Member States, and is deemed justified after fifteen calendar days without objection.

Corrections to this obligation

No substantive correction to this object has been recorded.

Open the correction log

Behind this page

Zahed Ashkara

Freelance AI & Privacy Consultant, jurist

View profile LinkedIn

Help with implementation

Zahed Ashkara, jurist and freelance AI & Privacy Consultant, supports implementation with your team through Embed AI.

View AI governance at Embed AI

For AI agents and integrations

This page and the machine output derive from the same versioned object. Use the API for deterministic filters by role, topic and time.

Open as JSON Open as JSON-LD Open this object in the explorer Read the methodology