(1) The market surveillance authorities competent under this Act and the market surveillance authority to be designated under Article 52(2) of Regulation (EU) 2024/2847 shall cooperate, within their respective areas of responsibility, in a spirit of cooperation and trust in order to perform their tasks. They shall share with one another observations and findings that may be relevant to the performance of their respective tasks within their respective area of responsibility.
(2) As part of that cooperation, the market surveillance authority to be designated under Article 52(2) of Regulation (EU) 2024/2847 shall inform the market surveillance authority competent in each case under this Act of suspected cases of non-conformity of high-risk AI systems under Article 6 of Regulation (EU) 2024/1689 with the cybersecurity requirements under Article 13(3), point (b)(ii), and Article 15(1) and (5) of Regulation (EU) 2024/1689. The market surveillance authority competent under this Act shall then examine whether to take market surveillance measures. For that purpose, the Federal Network Agency and the market surveillance authority to be designated under Article 52(2) of Regulation (EU) 2024/2847 shall draw up joint criteria for examining, for high-risk AI systems under Article 6 of Regulation (EU) 2024/1689, the applicable cybersecurity requirements under Article 13(3), point (b)(ii), and Article 15(1) and (5) of Regulation (EU) 2024/1689. Those criteria do not apply to market surveillance in respect of financial entities within the meaning of Article 2(2) of Regulation (EU) 2022/2554. In the course of market surveillance under section 2(3), BaFin shall, in agreement with the Federal Network Agency and the market surveillance authority to be designated under Article 52(2) of Regulation (EU) 2024/2847, draw up separate criteria for examining the cybersecurity requirements under Article 13(3), point (b)(ii), and Article 15(1) and (5) of Regulation (EU) 2024/1689 for high-risk AI systems under Article 6 of Regulation (EU) 2024/1689. The tasks and powers of BaFin under Regulation (EU) 2022/2554 shall remain unaffected. The market surveillance authority competent under this Act shall inform the market surveillance authority to be designated under Article 52(2) of Regulation (EU) 2024/2847 of the outcome of the examination.
(3) The market surveillance authority to be designated under Article 52(2) of Regulation (EU) 2024/2847 and, where the scope of Regulation (EU) 2022/2554 is affected, the authority referred to in section 2(3), shall cooperate
in the preparation of the European Commission's guidelines under Article 96(1), point (a), in conjunction with Article 15(5) of Regulation (EU) 2024/1689,
in the development of harmonised European standards under Article 40 of Regulation (EU) 2024/1689 on the cybersecurity requirements under Article 15(5) of Regulation (EU) 2024/1689, and
in the establishment, by the European Commission, of common specifications for the cybersecurity requirements under Article 15(5) of Regulation (EU) 2024/1689 pursuant to Article 41 of Regulation (EU) 2024/1689.
(4) Until the market surveillance authority is designated under Article 52(2) of Regulation (EU) 2024/2847, the Federal Office for Information Security (BSI) shall perform the tasks referred to in subsections (1) to (3).