Article 61: Informed Consent for Testing in Real-World Conditions Outside AI Regulatory Sandboxes
Article 61 specifies the informed consent requirements for persons participating in real-world testing under Article 60. Consent must be freely given, specific, informed, and unambiguous. Participants must be told the nature and purpose of the testing, the conditions and risks involved, and their right to withdraw at any time without detriment. For persons unable to give consent (e.g., minors), legal representative consent is required. These requirements do not derogate from GDPR consent rules where personal data is processed.
Who does this apply to?
- -Providers of high-risk AI systems who must obtain informed consent from test subjects before conducting real-world testing under Article 60
- -Test subjects and their legal representatives who must receive clear information about the testing and can withdraw consent at any time
- -Ethics review boards and DPOs overseeing testing protocols to ensure consent standards are met
Scenarios
A provider testing an AI-assisted diagnostic tool in a hospital setting prepares consent forms that explain: what the AI system does, how it will be used during the test, what data will be collected, the potential risks and benefits, and that the patient can withdraw at any time without affecting their care. The forms are reviewed by the hospital's ethics committee.
A provider wants to test an educational AI tool with secondary school students (minors). The provider obtains consent from parents or legal guardians, provides age-appropriate information to the students themselves, and ensures that non-participation does not affect the students' grades or access to education.
What Article 61 requires (in plain terms)
Article 61 ensures that no one becomes an unwitting subject of AI testing. It sets out the minimum information that must be provided and the quality standards for consent:
Consent quality: - Freely given — no pressure, coercion, or significant imbalance of power between the provider and the test subject. - Specific — consent is for the particular testing activity described, not a blanket authorisation. - Informed — participants must genuinely understand what they are consenting to. - Unambiguous — a clear affirmative act (not pre-ticked boxes or silence).
Information to be provided: - The nature and purpose of the real-world testing. - The conditions under which the test will be conducted and the expected duration. - The risks and potential consequences of participation. - The participant's right to withdraw at any time without giving reasons and without any detriment.
Special cases: - Where the test subject cannot give consent (e.g., minors or persons under guardianship), consent must be obtained from a legal representative. - Where the testing involves processing personal data, the GDPR consent requirements apply in addition — Article 61 does not replace or reduce GDPR Article 7 standards.
Relationship to GDPR consent
Article 61 consent for real-world testing and GDPR consent for personal data processing are distinct but overlapping requirements:
- Article 61 addresses consent to participate in the testing activity itself — being exposed to an AI system in real-world conditions.
- GDPR Article 6/7 addresses the legal basis for processing personal data that may be collected during the test.
Where both apply, providers must satisfy both sets of requirements. In practice, this often means a combined consent form that clearly distinguishes between (a) consent to participate in the AI test and (b) consent (or another legal basis) for the data processing involved. The GDPR's higher bar for processing sensitive data (Article 9 GDPR) or children's data also applies where relevant.
How Article 61 connects to the rest of the Act
- Article 60 — the real-world testing framework that Article 61 consent supports. Testing cannot proceed without valid consent.
- Article 57 — sandboxes have their own supervision model; Article 61 specifically covers testing outside sandboxes.
- Article 59 — personal data processing inside sandboxes has separate rules (DPA approval rather than individual consent).
- Article 113 — application dates.
Compliance checklist
- Design a consent process that meets all four quality criteria: freely given, specific, informed, and unambiguous — document how each criterion is satisfied.
- Prepare clear, plain-language consent materials explaining the AI system, testing purpose, conditions, risks, and the right to withdraw at any time without detriment.
- For test subjects who cannot consent (minors, persons under guardianship), obtain legal representative consent and provide age- or capacity-appropriate information to the subject themselves.
- Where personal data is processed during testing, ensure GDPR consent or another lawful basis is in place in addition to Article 61 consent — consider a combined consent form with clear separation.
- Maintain records of all consents obtained, including when and how consent was given, the information provided, and any withdrawals.
- Ensure withdrawal mechanisms are easy to use and that withdrawal does not result in any detriment to the test subject.
Testing AI with real people? Make sure your consent process is compliant — start the free assessment.
Start Free AssessmentRelated Articles
Article 60: Testing of High-Risk AI Systems in Real-World Conditions Outside AI Regulatory Sandboxes
Article 57: AI Regulatory Sandboxes
Article 59: Further Processing of Personal Data for Developing Certain AI Systems in the Public Interest in the AI Regulatory Sandbox
Article 113: Entry into Force and Application Dates
Frequently asked questions
Can I rely on Article 61 consent to also cover GDPR data processing?
Not automatically. Article 61 consent covers participation in the testing activity. If personal data is processed, you also need a lawful basis under GDPR (which may be consent or another basis like legitimate interest, depending on the circumstances). Where you use consent for both, the consent must meet the higher GDPR standard.
What does 'without detriment' mean when a participant withdraws?
The participant must not suffer any negative consequences for withdrawing — no loss of service access, no penalties, no negative impact on care or education. The withdrawal must be as easy as giving consent, and the provider must stop exposing the person to the AI system.
Do ethics review boards need to approve the consent process?
Article 61 does not explicitly require ethics board approval, but national law and sectoral regulations (especially in healthcare and education) may impose additional ethics review requirements. It is good practice to involve an ethics review where vulnerable populations are involved.