docs(verification): add Article 12 and correct the Article 111(2) attribution

[ioanavalea]

What this changes

Two corrections to the informative section added in #310, in one diff at @lywinged's suggestion in review there.

Article 12 joins Article 11 and Annex IV as a provision a reader might expect to supply a verification depth, and does not. The Article 111(2) sentence is corrected, because it presented a recital as operative text.

Type of change

• Editorial (typo, link fix, clarification: no normative effect)
• Non-breaking spec change (new optional field, new platform profile, informative addition)
• Breaking spec change (requires 14-day comment period and Project Lead sign-off)
• Schema change
• Example addition

Spec section

None. docs/verification.md only. Section 3.3.1 of spec/trace-v0.2.md is unchanged and no schema file is touched.

Why

Article 12. Suggested on the ground that a reader who knows this repository will look for it. Article 12(1) requires that a high-risk system technically allow the automatic recording of events over its lifetime, which addresses neither provenance nor build inputs, so it makes the section's argument rather than complicating it. Article 12 sits in Chapter III Section 2, so the closing sentence's list of provisions is extended to Articles 11, 12, 15 and 25 rather than left inconsistent. The count in "Two adjacent provisions are sometimes read as supplying one" is deliberately untouched, since that sentence refers to Article 25(4) and Article 15(5).

Article 111(2). The merged sentence made the dates "subject to the Article 111(2) grace period for units of a type and model already placed on the market". Article 1 point (39)(a) of Regulation (EU) 2026/1744 replaces Article 111(2), and the replacement carries the significant-changes test and a 2 August 2030 compliance date for providers and deployers of high-risk systems intended to be used by public authorities. It does not carry the type-and-model language. That reading is recital 39, and "type and model" occurs three times in the whole Regulation, all three inside that recital and none in the operative articles. The reading was right and the attribution was not.

Checklist

• DCO sign-off on all commits (git commit -s)
• CHANGELOG.md updated (for any normative change): not applicable, no normative change
• Breaking changes marked in spec text: not applicable
• Backward compatibility statement included: not applicable

AI assistance

Drafting and source verification were AI-assisted. Article 12 of Regulation (EU) 2024/1689, and Article 111(2) as replaced by Article 1 point (39)(a), recital 39, and Article 113 third paragraph point (c) as replaced by point (40)(b) of Regulation (EU) 2026/1744, were read against the Official Journal text before being cited.

[lywinged]

Approved.

Both corrections hold, and I checked them against the Official Journal text rather than against the PR body, from the Publications Office copy since EUR-Lex answers this environment with an empty page.

• Article 12 sits in Chapter III Section 2 with Articles 11 and 15, and Article 25 in Section 3, so the extended list is right. Article 12(1) reads "shall technically allow for the automatic recording of events (logs) over the lifetime of the system", which is the capability requirement the new sentence describes and nothing about provenance or build inputs.
• Article 1 point (39)(a) replaces Article 111(2) with the significant-changes test and the 2 August 2030 sentence for systems intended to be used by public authorities. "type and model" occurs three times in the Regulation, all three inside recital 39, and the operative articles carry it nowhere, which is what the closing sentence now says.
• The count in "Two adjacent provisions" is right to leave alone; the new sentence sits before it and the two it refers to are still Article 25(4) and Article 15(5).

One suggestion, not a condition. The paraphrase of the replaced Article 111(2) says operators of systems "placed on the market before that date of application". The replacement says "placed on the market or put into service", and it carves out "other than the systems referred to in paragraph 1 of this Article", the Annex X large-scale IT systems. The first is two words and costs nothing. The second is a real exclusion, but in an informative paragraph about which provisions impose a verification depth it is optional, and I would not hold the merge for either.

On the Article 42(3) question you raised on #310: a separate PR, and yes, it has a place in the paragraph on Regulation (EU) 2024/2847. I read point (18), Article 12 of the Cyber Resilience Act and Annex I Part II point 1 against the Official Journal and reached the same result. The opening words of that Article 12(1), "Without prejudice to the requirements relating to accuracy and robustness set out in Article 15 of Regulation (EU) 2024/1689", reserve two of Article 15's three subjects to the AI Act, so what is deemed satisfied is its cybersecurity requirement and nothing else; and condition (b) is met through the software bill of materials "covering at the very least the top-level dependencies", an inventory rather than a provenance check. Two instruments arriving at the section's point from opposite sides is worth three sentences, and the narrowing to one subject of Article 15 is the sentence that must survive editing. I would keep this PR to the two corrections it names, which is the reason for a separate diff rather than a reason against the addition.

Checked on the branch: the four CI steps green on 3.11 with the hash-pinned install, 1402 passed and 1 skipped on the head, base a247244, no dashes in the added lines, docs/verification.md only, DCO present. Nothing in the test suite reads this section; two tests name the file in their docstrings for a different rule.

Issue #314 is the right shape for the line 61 sentence, and I will answer there rather than here.

[ioanavalea]

Pushed bfdc1ba, which dismissed your approval, so this needs another look.

Both points from your review are in. The sentence now reads "placed on the market or put into service", and it carries the exclusion as "other than the systems referred to in Article 111(1)". You called the second optional in an informative paragraph and I took it anyway, since the paragraph reports the population the provision applies to, and without the exclusion it reports a wider one than the provision has.

Two further clauses went in for the same reason. Neither was in your review, so revert either if you read the paragraph's job more narrowly than I have.

• only where, as from that date, those systems are subject to significant changes in their designs. Without "as from that date" the sentence loses the point from which a design change starts to count.
• and in any case requires providers and deployers. The provision opens that limb with "In any case", which marks the 2030 date as independent of the significant-changes test rather than as a second condition under it.

Article 111 of Regulation (EU) 2024/1689 and Article 1 point (39) of Regulation (EU) 2026/1744 were read against the Official Journal text. Point (39) replaces paragraph 2 and adds a paragraph 4, so paragraph 1 stands as enacted, and the excluded population is AI systems which are components of the large-scale IT systems established by the legal acts listed in Annex X.

The Article 42(3) addition stays out of this diff, as you suggested, and follows in its own.

Source verification for this comment was AI-assisted.

[imran-siddique]

Both corrections are right and one of them catches something I flagged and did not chase. One sentence needs sourcing before this can land.

Article 12: take it. A reader of this repository will look for Article 12 first, and the reason it does not supply a verification depth is worth stating rather than leaving to inference. Art. 12(1) requires that a high-risk system technically allow the automatic recording of events over its lifetime, which is a capability requirement about logging and says nothing about provenance or build inputs. Verified against the Regulation.

Article 111(2): take it, and thank you for chasing it. When I approved #310 I wrote that I had not independently verified the Article 111(2) characterisation, and it turns out the version that merged was wrong. Your replacement matches the provision as amended: it applies to operators of high-risk systems other than those in 111(1) placed on the market before the date of application, only where they undergo significant changes in design from that date, and in any case requires providers and deployers of high-risk systems intended for use by public authorities to comply by 2 August 2030.

The last sentence cannot ship as written. It reads:

The reading that one lawfully placed unit carries the other units of the same type and model is recital 39 rather than operative text.

It does not name an instrument, and recital 39 of Regulation (EU) 2024/1689 is about the processing of biometric data for biometric identification and its relationship to Article 9(1) GDPR. It says nothing about units already placed on the market. The AI Act's transitional recitals sit in the 110s, next to Article 111.

If you mean recital 39 of Regulation (EU) 2026/1744 rather than of the AI Act, that is plausible from the surrounding sentence and it needs saying, because a reader lands on the AI Act by default.

So: name the instrument and confirm the number, or drop the sentence. The paragraph stands without it, since the operative text you have added already does the work.

I would rather ask than correct it myself. This is a citation-accuracy change and the citations should be yours.

[ioanavalea]

Fixed in 2ebe592, and you are right on both halves of it.

Recital 39 of Regulation (EU) 2024/1689 concerns any processing of biometric data and other personal data involved in the use of AI systems for biometric identification, and its relationship to Article 10 of Directive (EU) 2016/680 and Article 9(1) of Regulation (EU) 2016/679. It carries nothing about units already on the market, and "type and model" does not occur in that Regulation at all.

The instrument is Regulation (EU) 2026/1744, whose recital 39 provides that "if at least one individual unit of the high-risk AI system has been lawfully placed on the market or put into service before the date specified in Article 111(2), other individual units of the same type and model of high-risk AI system are subject to the grace period provided in that Article 111(2)". The phrase occurs three times in that Regulation, all three inside that recital.

I named the instrument rather than dropping the sentence, because it is the sentence that stops a reader carrying the grace period into operative text, which is the error the merged version made. The same sentence also said "one lawfully placed unit" where the recital says placed on the market or put into service, so that limb is restored as well.

On #310, the Article 111(2) characterisation you approved was mine, so this is me clearing up after myself rather than catching you.

Source verification for this comment was AI-assisted. Recital 39 of each Regulation was read against the Official Journal text before being quoted.

[lywinged]

Recital 39 of Regulation (EU) 2026/1744 is the grace-period one, so the number is right and only the instrument is missing. It carries a condition the sentence would want as well: the other units are subject to the grace period as long as the design of that system remains unchanged.

Worth knowing before you write the correction, because it is what makes this easy to get wrong. In that Regulation 39 is both the recital and the point of Article 1, and point (39)(a) is the operative replacement of Article 111(2). The contrast your sentence draws is between two things numbered 39 in the same instrument.

One more in the same paragraph while it is open, and it is at least as much mine as yours. Point (39)(a) requires those providers and deployers to "take the necessary steps to comply with the requirements and obligations laid down in this Regulation by 2 August 2030", and the paragraph has them "comply by 2 August 2030". Writing it as to take the necessary steps to comply by 2 August 2030 closes it. The short form is in the paragraph I approved at f7fd601 and in the review above as well, so it has already survived two readings that should have caught it.

Those two are my only open items.

[lywinged]

Your fix is right, and the limb you restored alongside it is one I had not raised: recital 39 has at least one individual unit lawfully placed on the market or put into service, and the sentence now says so.

Withdrawing the condition I suggested. The paragraph already carries it, inverted, in the sentence immediately before: the provision applies only where those systems are subject to significant changes in their designs, which is the recital's design-remains-unchanged the other way round. Adding it would have said the same thing twice. You were right not to.

I also wrote that I had two open items and that was short by three. None of the three is an ask. They are listed so they are declined rather than missed, and because you have the sentence open.

The provision's opening, "Without prejudice to the application of Article 5 as referred to in Article 113, third paragraph, point (a)", is not carried at all. "only where" stands where both Article 111(2) as enacted and its replacement say "only if", and your own commit message for bfdc1ba writes "only if". And "before that date of application" points at the two dates of Sections 2 and 3 where the provision points at Chapter III.

The necessary-steps limb is the one I would still take.

[ioanavalea]

eb2a5b3 takes the necessary-steps limb, and one of the three you listed to be declined rather than missed.

Taken: the necessary-steps limb. Point (39)(a) requires those providers and deployers to take the necessary steps to comply, whereas the paragraph had them comply, which states an outcome where the provision states a duty to act. I ran a clause-by-clause diff of the paraphrase against the provision before bfdc1ba and let this one through as acceptable compression, so it is three readings rather than two.

Taken although you did not ask: only if. Both Article 111(2) as enacted and its replacement use it, and you are right that my commit message for bfdc1ba had it while the file did not. One word, and no reason to leave it diverging.

Declined: the "Without prejudice to the application of Article 5" opening. Article 5 concerns prohibited practices, and this paragraph exists to say which provisions impose a verification depth, so the reservation would add a cross-reference the paragraph never uses. It also opens Article 111(1) as well as Article 111(2), so carrying it in the one we paraphrase and not in the one we cite would read as a distinction rather than as an omission.

Declined: "before that date of application" for the provision's "date of application of Chapter III referred to in Article 113". Chapter III has five Sections and they do not share one application date. Section 4 applies from 2 August 2025 under Article 113, third paragraph, point (b), Section 5 under the general rule in the second paragraph from 2 August 2026, and Sections 1, 2 and 3 from the two dates point (40)(b) sets. So the provision's own formulation does not resolve to a single date, whereas the sentence before ours names the two dates for the Sections that Articles 11, 12, 15 and 25 sit in, which is what "that date of application" points at. The verbatim form would be less precise here rather than more.

On the numbering: agreed, and it is why the sentence now names the instrument instead of the number alone. I left the contrast as recital 39 against operative text rather than naming point (39)(a), since the paragraph already says Article 111(2) was replaced by the same Regulation, and a clause about which of two things numbered 39 is operative would be about the numbering rather than about the law. Say so if you would rather it were explicit.

Source verification for this comment was AI-assisted. Article 111, Article 113 and the Section structure of Chapter III of Regulation (EU) 2024/1689, and Article 1 point (39)(a) of Regulation (EU) 2026/1744, were read against the Official Journal text.