TABLE OF CONTENTS  1

1. INTRODUCTION  2

2. ILLUSTRATIVE AI VALUE CHAIN SCENARIOS  5

2.1 HIGH-RISK AI SYSTEMS BUILT ON TOP OF GPAI SYSTEMS  5

2.2 CLOUD COMPUTING SERVICES, MODEL FINE-TUNING, AND DATA INPUTS  5

2.3 AGENTIC AI SYSTEMS, ORCHESTRATION OF GPAI MODELS, AND TOOL USE OF EXTERNAL SERVICES  6

3. GENERAL PRINCIPLES FOR INFORMATION SHARING UNDER ARTICLE 25 AIA  9

3.1 INFORMATION FLOWS UNDER ARTICLE 25 AIA IN COMPLEX AI VALUE CHAINS  9

3.2 CONDITIONS FOR RESPONSIBILITIES UNDER ARTICLE 25(4) AIA  11

3.2.1 SCOPE OF COVERED INPUT SUPPLIERS  11

3.2.2 SCOPE OF LEGITIMATE INFORMATION REQUESTS  12

3.3 INFORMATION SHARING MECHANISMS  13

4. INFORMATION SHARING FOR SPECIFIC HIGH-RISK AI SYSTEM REQUIREMENTS  17

4.1 ARTICLE 9 AIA: RISK MANAGEMENT SYSTEM  17

4.2 ARTICLE 10 AIA: DATA GOVERNANCE  17

4.3 ARTICLE 15 AIA: ACCURACY, ROBUSTNESS, AND CYBERSECURITY  18

4.4 ARTICLE 72 AIA: POST-MARKET MONITORING  19

4.5 ARTICLE 73 AIA: SERIOUS INCIDENT REPORTING  20

4.6 ARTICLE 12 AIA: RECORD-KEEPING  21

4.7 ADDITIONAL HIGH-RISK AI SYSTEM OBLIGATIONS THAT MAY REQUIRE INFORMATION SHARING  21

5. RECOMMENDATIONS FOR IMPLEMENTING THE AI ACT'S INFORMATION SHARING PROVISIONS  23

ABOUT CERRE  26

ABOUT THE AUTHOR  27