(1) The Federal Network Agency (Bundesnetzagentur) shall maintain a non-public register under Article 49(5) of Regulation (EU) 2024/1689 of high-risk AI systems under point 2 of Annex III to Regulation (EU) 2024/1689.
(2) Before the placing on the market or putting into service of a high-risk AI system referred to in point 2 of Annex III to Regulation (EU) 2024/1689, providers or their authorised representatives must register themselves and the high-risk AI system in the register under subsection (1). This does not apply to public bodies of the Länder within the meaning of section 2 of the Federal Data Protection Act (Bundesdatenschutzgesetz). When registering, the providers or their authorised representatives must provide the corresponding information listed in Section A of Annex VIII to Regulation (EU) 2024/1689.
(3) Before the putting into service or use of a high-risk AI system referred to in point 2 of Annex III to Regulation (EU) 2024/1689, deployers must register themselves and the high-risk AI system in the register under subsection (1) where the deployers are federal public bodies within the meaning of section 2 of the Federal Data Protection Act (Bundesdatenschutzgesetz). When registering, the deployers must provide the corresponding information listed in Section C of Annex VIII to Regulation (EU) 2024/1689.
(4) The market surveillance authorities competent under section 2(1) to (6) and (8) are entitled to obtain information from the register about the high-risk AI system falling within their respective responsibility, in so far as this is necessary for the performance of their tasks. For that purpose, the Federal Network Agency is entitled to pass on the corresponding information from the register to the competent market surveillance authority. The Federal Network Agency may transmit information from the register to the European Commission and to other bodies provided for under Regulation (EU) 2024/1689, in so far as this is necessary for the performance of the Federal Network Agency's tasks. No transmission to third parties shall take place.
(5) The processing of personal data by the Federal Network Agency in connection with the register is permissible in so far as it is necessary for maintaining the register.