Article 41 allows the Commission to adopt common specifications by implementing act, where it has requested a harmonised standard and the request was not accepted, the standard was not delivered on time, the standard insufficiently addresses fundamental rights concerns, or the standard does not comply with the request, and where no harmonised standard reference is published or expected within a reasonable period. Conformity with common specifications, or parts of them, gives a presumption of conformity to the extent they cover the requirements or obligations. When a harmonised standard reference is published for the same requirements, the Commission repeals the implementing acts or parts of them for those requirements. Common specifications are an exceptional fallback, not a parallel standardisation route, and no common specification is asserted in this guide without a checking instruction to the Official Journal and the implementing act.
When can the Commission adopt common specifications?
The Commission can adopt common specifications only where all the conditions in Article 41(1) are met. The Commission must have requested one or more European standardisation organisations to draft a harmonised standard, and one of the following must apply: no organisation accepted the request, the standard was not delivered on time, the standard insufficiently addresses fundamental rights concerns, or the standard does not comply with the request. In addition, no reference of a harmonised standard for the requirements or obligations concerned must have been published in the Official Journal, and no such reference must be expected to be published within a reasonable period. Those conditions are cumulative and must be shown in the implementing act. The Commission must also consult relevant bodies or expert groups, and must follow the examination procedure for implementing acts, with the committee of Member State representatives. A provider should therefore not assume that a delay in standardisation automatically leads to common specifications, and should not treat a Commission consultation or a draft specification as an adopted specification. The implementing act, with its recitals showing the Article 41 conditions, is the source to check, and the act number, date and Official Journal reference should be recorded.
What do common specifications cover?
Common specifications cover the requirements or obligations for which the Article 41 conditions are met, as specified in the implementing act. They can cover technical specifications for a requirement, such as risk management, data governance, logging, transparency, human oversight, accuracy, robustness or cybersecurity, to the extent the act specifies. They can be adopted for high risk AI systems, for general purpose AI models, or for both, depending on the act. The specifications are set out in the implementing act or in an annex to it, and they must be read in full, with the scope, the requirements and any restrictions recorded. A specification that covers a requirement in part gives a presumption only for the part it covers, in the same way as a harmonised standard. A provider that relies on a common specification should map each requirement to the specification part relied on, with the evidence, in the same coverage map used for standards. A provider should also check whether the specification has been amended, repealed or replaced, and whether a harmonised standard has since been cited for the same requirements, because the specification position can change. The specification record should be kept with the standards register, with the act and the coverage recorded.
For the broader regulatory framework, see codes, standards and sandboxes overview.
How does the presumption for common specifications work?
Article 41(3) provides that high risk AI systems and general purpose AI models in conformity with common specifications, or parts of them, are presumed to be in conformity with the requirements in Chapter III, Section 2 or, as applicable, with the obligations in Chapter V, Sections 2 and 3, to the extent that those specifications cover those requirements or obligations. The presumption is therefore limited by coverage, in the same way as the Article 40 presumption. The provider must show, in the technical documentation, which common specifications were applied, in full or in part, and how the system conforms to them, and must show the other solutions adopted for requirements not covered. Where a provider does not apply a common specification, it must show compliance by other means, with the reasoning recorded. The presumption does not remove the need for conformity assessment, registration or post market monitoring, and it does not remove the need for the provider to test and evidence the system. A provider that states that it follows a common specification, without stating the part, the version and the evidence, has not shown that the presumption applies. The presumption file for common specifications should be built in the same way as the file for harmonised standards, with the implementing act, the coverage map and the evidence.
What happens when a harmonised standard is published?
Article 41(4) provides that, when the reference of a harmonised standard is published in the Official Journal, the Commission shall repeal the implementing acts, or the parts of them, adopted under Article 41 covering the same requirements or obligations. The common specification therefore sunsets for those requirements when a standard is cited, and the provider must move to the standard route, or to another means of demonstrating compliance, for those requirements. The transition should be planned: the provider should check the Official Journal for new citations, check whether a citation covers the same requirements as a specification it relies on, check whether the specification has been repealed in whole or in part, and update the coverage map and the technical documentation accordingly. A provider that continues to rely on a repealed specification, without checking the standard, will have a file that cites a repealed act. A provider that moves to a standard without checking its coverage will have a file that claims a presumption the standard does not give. The transition record should show the old specification, the new standard, the coverage comparison, and the action taken, with dates. The transition should be treated as a change control item, with review by the person responsible for the file.
How do common specifications differ from guidance?
Common specifications differ from guidance in legal status and in effect. Common specifications are adopted by implementing act, are published in the Official Journal, and give a presumption of conformity to the extent they cover the requirements. Guidance, including Commission guidelines, AI Office guidance and Service Desk material, explains the law, gives examples and sets out the Commission or AI Office interpretation, but it does not give a presumption of conformity and it does not create legal duties. A provider should therefore distinguish, in its file, between a common specification relied on for a presumption, a harmonised standard relied on for a presumption, and guidance relied on for interpretation, with each source cited separately and with the legal effect stated. A provider that treats guidance as a specification, or a specification as guidance, will misstate the legal basis for its file. Guidance is useful and should be followed where it explains the law, but it cannot replace a specification or a standard where a presumption is claimed. The file should show the hierarchy: Regulation, implementing act for common specifications, harmonised standard citation, and guidance, in that order, with the role of each stated.
Continue with harmonised standards process.
What does this guide not state?
This guide does not state whether any common specification has been adopted, does not list any common specification, and does not reproduce any implementing act. No common specification was verified for this guide, and none should be assumed to exist for a particular requirement. A provider that needs a common specification for a requirement should check the Official Journal, the Commission implementing acts, and the AI Office and Service Desk material, on the date of reliance, and should record what was found, including a negative finding where no specification exists. This guide explains the Article 41 mechanism and the checking route, not the current list of specifications.
Frequently asked questions
Are common specifications the same as standards?
No. Common specifications are adopted by the Commission by implementing act as an exceptional fallback where harmonised standards are absent, delayed or insufficient and the Article 41 conditions are met. Harmonised standards are developed by CEN and CENELEC under a standardisation request and cited in the Official Journal. Both can give a presumption to the extent they cover the requirements, but their adoption, status and repeal differ.
When are common specifications repealed?
When a harmonised standard reference is published in the Official Journal for the same requirements or obligations, the Commission repeals the implementing acts or parts of them for those requirements under Article 41(4). A provider must check for new citations and update its coverage map and file when a repeal occurs.
Can a provider ignore a common specification?
Yes, in the sense that common specifications are not mandatory. A provider can demonstrate compliance by other means, including harmonised standards or its own technical solutions, with the reasoning and evidence recorded. A provider that does not apply a specification must still meet the requirements, and must show how, in the technical documentation.
Where are common specifications published?
In implementing acts published in the Official Journal. The act number, date and annex must be checked, with the Article 41 conditions in the recitals. Guidance on the Commission and Service Desk sites can help identify an act, but the act itself is the source.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗European Commission AI Act standardisation ↗