---
title: "Recital 140 AI Act"
canonical: "https://dposchool.com/ai-act/recital/140"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#rct_140"
source_note: "Source: Regulation (EU) 2024/1689, OJ L, 2024/1689, 12.7.2024; articles and annexes from the consolidated text 02024R1689-20260727. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-30"
language: "en"
publisher: "DPO School"
---

Recitals

# Recital 140 AI Act

Official Journal text of 12 July 2024. Retrieved 30 October 2026.

## Official text

This Regulation should provide the legal basis for the providers and prospective providers in the AI regulatory sandbox to use personal data collected for other purposes for developing certain AI systems in the public interest within the AI regulatory sandbox, only under specified conditions, in accordance with Article 6(4) and Article 9(2), point (g), of Regulation (EU) 2016/679, and Articles 5, 6 and 10 of Regulation (EU) 2018/1725, and without prejudice to Article 4(2) and Article 10 of Directive (EU) 2016/680. All other obligations of data controllers and rights of data subjects under Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680 remain applicable. In particular, this Regulation should not provide a legal basis in the meaning of Article 22(2), point (b) of Regulation (EU) 2016/679 and Article 24(2), point (b) of Regulation (EU) 2018/1725. Providers and prospective providers in the AI regulatory sandbox should ensure appropriate safeguards and cooperate with the competent authorities, including by following their guidance and acting expeditiously and in good faith to adequately mitigate any identified significant risks to safety, health, and fundamental rights that may arise during the development, testing and experimentation in that sandbox.

## Source

Source: Regulation (EU) 2024/1689, OJ L, 2024/1689, 12.7.2024; articles and annexes from the consolidated text 02024R1689-20260727. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Recital 140 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#rct_140)

Official Journal text of 12 July 2024. Retrieved 30 October 2026.

This is reference material, not legal advice.

## Navigation

[AI Act Navigator](https://dposchool.com/ai-act) / [Recitals](https://dposchool.com/ai-act/recitals) / Recital 140

Previous: [Recital 139 AI Act](https://dposchool.com/ai-act/recital/139)

Next: [Recital 141 AI Act](https://dposchool.com/ai-act/recital/141)

## For AI agents

- Machine-readable index: https://dposchool.com/ai-act/llms.txt
- JSON API: https://dposchool.com/ai-act/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents