⚠ Medium compliance impact for SMEs
WHAT THE ARTICLE IS ABOUT
The consent framework for real-world AI test subjects
Article 61 establishes the informed consent requirements for persons who participate in real-world testing of high-risk AI systems outside regulatory sandboxes. It mirrors the principles of GDPR and medical research consent frameworks — ensuring that participation is voluntary, informed, and genuinely free from coercion or undue influence.
WHAT IT SAYS
Prior, informed, freely given — with specific information requirements
- Freely given informed consent must be obtained from test subjects before their participation and after they have been provided with clear, relevant and understandable information
- The information provided must cover: the nature and objectives of the testing, the expected duration, the conditions under which testing will occur, the subject’s rights including the right to withdraw at any time without detriment, arrangements for reversing or disregarding AI decisions made during testing, and who is responsible for the testing
- Consent must be documented, dated, and a copy provided to the participant
- Participants have the right to withdraw consent at any time without explanation and without suffering any negative consequences — this right cannot be waived
- Consent is not valid if obtained through deception, coercion or undue influence
- Special protections apply for vulnerable groups — additional safeguards must be in place where test subjects may be in a situation of dependency or vulnerability
- Exceptions apply for law enforcement contexts where consent cannot practically be obtained in advance
WHO IS AFFECTED
Providers conducting real-world testing and the test subjects themselves
- Providers conducting real-world testing under Article 60 — they must design and implement the consent process
- Natural persons who are test subjects — they have clear rights and protections
- Market surveillance authorities monitoring whether consent requirements are met
- Data protection authorities where personal data is processed in connection with testing
WHAT IT MEANS FOR SMES
Design your consent process carefully — it is a legal prerequisite
- A real-world testing programme without valid informed consent is unlawful — this is not a procedural formality but a substantive legal requirement that must be met before testing begins
- The consent information requirements are specific and comprehensive — use Article 61 as your checklist when designing participant information sheets and consent forms
- The right to withdraw without detriment is non-waivable — ensure your testing infrastructure can accommodate mid-test withdrawals without data integrity problems
- The documentation requirement means you must keep signed, dated consent records — store these securely and for as long as your testing programme runs
- If your test subjects include employees, customers, or others in a relationship of dependency with your organisation, apply additional safeguards — the power imbalance means consent may not be genuinely free without extra protections
Related Articles
- Article 60 — Real world testing (the testing procedure this consent framework serves)
- Article 26 — Deployer obligations (includes informing individuals subject to AI decisions)
- Article 10 — Data governance (training data collected during testing must meet these standards)
- Article 59 — Personal data in sandboxes (the analogous data protection framework for sandbox testing)
