EU AI Act market surveillance authorities and their powers
This page explains who your market surveillance authority is, what it is legally entitled to ask for, how far its inspection powers reach into your codebase and datasets, and what a real document request looks like once it lands in your inbox. Enforcement powers have been live since 2 August 2026, so this is operational reality rather than planning material.
Who the market surveillance authority is
Article 70 requires every Member State to establish or designate at least one notifying authority and at least one market surveillance authority as national competent authorities. Those designations were to be communicated to the Commission by 2 August 2025, and Article 70(2) obliges Member States to give those bodies adequate technical, financial and human resources, including staff with competence in AI, data and cybersecurity.
Article 74(1) plugs the Act into the existing market surveillance machinery: Regulation (EU) 2019/1020 applies to AI systems covered by the AI Act. That matters, because it means an AI authority inherits the standard toolkit of a product safety regulator, including documentary requests, on-site inspection, sampling, and orders to restrict, withdraw or recall.
Two allocation rules catch people out. Under Article 74(8), for high-risk systems in Annex III points 1, 6 and 7 used for law enforcement, border management, the administration of justice and democratic processes, the designated authority is either the data protection supervisory authority or another authority designated under equivalent conditions. Under Article 74(9), where a Union institution, body, office or agency falls within scope, the European Data Protection Supervisor acts as market surveillance authority. Separately, Article 77 gives national authorities that supervise fundamental rights obligations the power to request and access any documentation created or maintained under the Act, and to ask the market surveillance authority to organise technical testing of a high-risk system.
What the authority can actually demand
Article 74(12) is the provision to read closely. Market surveillance authorities are to be granted full access to the documentation as well as to the training, validation and testing datasets used for the development of high-risk AI systems, including, where appropriate and subject to security safeguards, through application programming interfaces or other technical means enabling remote access. That is not a summary. It is the datasets themselves.
Source code is gated but not off limits. Article 74(13) allows access to source code on a reasoned request, and only where both conditions are met: access is necessary to assess conformity with the Chapter III Section 2 requirements, and testing or auditing based on the data and documentation already supplied has been exhausted or has proved insufficient. In practice that means a weak or incomplete documentation pack increases the likelihood of a source code request, not the reverse. Anything obtained is subject to the confidentiality and intellectual property protections in Article 78.
On the operator side, Article 21 requires providers of high-risk systems to supply, on a reasoned request from a competent authority, all information and documentation necessary to demonstrate conformity, in a language easily understood by that authority and in an official Union language indicated by the Member State. The same article requires providers to give access to the automatically generated logs referred to in Article 19(1) where those logs are under their control.
Provider or deployer, the duties differ
If you place a high-risk system on the market or put it into service under your own name or trade mark, you are the provider. You hold the technical documentation, the quality management system records and the conformity assessment evidence, and Article 18 requires you to keep technical documentation, quality management system documentation, notified body decisions and the EU declaration of conformity at the disposal of national competent authorities for ten years after the system is placed on the market or put into service. Article 19 requires retention of automatically generated logs for a period appropriate to the intended purpose and at least six months.
If you use a high-risk system under your own authority, you are the deployer. Article 26(12) obliges you to cooperate with competent authorities in any action they take in relation to that system. Article 26(6) requires you to keep the logs generated by the system, to the extent they are under your control, for a period appropriate to the intended purpose and in any case at least six months. A deployer who cannot produce human oversight records, input data governance evidence or logs is exposed on its own account, regardless of how good the provider's paperwork is.
What a document request looks like in practice
Requests arrive as a formal letter or portal notification naming the system, citing the legal basis, and setting a response deadline, typically between ten and thirty calendar days depending on the national administrative law that applies. The content is predictable because it tracks the statutory requirements.
| What is asked for | Where it comes from |
|---|---|
| Technical documentation for the named system and version | Article 11 and Annex IV |
| EU declaration of conformity and CE marking evidence | Articles 47 and 48 |
| Risk management system records and residual risk decisions | Article 9 |
| Data governance evidence for training, validation and test sets | Article 10 |
| Automatically generated logs for a stated date range | Articles 12, 19 and 26(6) |
| Instructions for use supplied to deployers | Article 13 |
| Human oversight design and deployer-side oversight records | Article 14 |
| Quality management system documentation | Article 17 |
| Post-market monitoring plan and collected data | Article 72 |
If the authority has sufficient reason to consider the system presents a risk, Article 79 requires it to evaluate compliance with the Regulation. Where it finds non-compliance, it requires the operator to take corrective action, withdraw the system or recall it within a period it prescribes, and in any event within no more than fifteen working days. If the operator fails to act, the authority takes provisional measures to prohibit or restrict availability, withdraw or recall, and notifies the Commission and other Member States.
Article 80 covers the self-classification route. Where a provider has classified an Annex III system as not high-risk under Article 6(3) and the authority disagrees, the authority evaluates the system and, if it is high-risk, requires the provider to bring it into compliance. Article 83 deals with formal non-compliance such as missing or wrongly affixed CE marking, a missing EU declaration of conformity, failure to register in the EU database, or technical documentation that is not available.
Getting the response wrong carries its own penalty. Article 99(5) sets fines of up to 7 500 000 EUR or 1% of total worldwide annual turnover, whichever is higher, for supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request. Article 99(6) applies the lower of the two figures to SMEs and start-ups. Other operator breaches sit at up to 15 000 000 EUR or 3%, and Article 5 prohibited practices at up to 35 000 000 EUR or 7%. GPAI model providers are enforced centrally by the Commission under Articles 88 to 94, with fines under Article 101 of up to 15 000 000 EUR or 3% of worldwide turnover.
The dates that bind
- 2 February 2025. Article 5 prohibitions have applied since this date.
- 2 August 2025. Member States were to have designated and notified their national competent authorities under Article 70.
- 2 August 2026. Enforcement powers and penalties went live. Article 50 transparency and Article 53 GPAI obligations have been enforceable since this date.
- 2 December 2027. Annex III standalone high-risk obligations apply, following the Digital Omnibus provisional agreement of May 2026, which is still pending formal adoption. This is 413 days away.
- 2 August 2028. Annex I embedded high-risk obligations apply.
What to do in the next quarter
- Name the authority and the inbox. Identify which national market surveillance authority covers each market where you place or deploy systems, and nominate one accountable owner plus a deputy who can acknowledge a request within two working days. Put the address the authority will write to under monitoring.
- Build a production-ready documentation pack. Assemble the Annex IV technical documentation, the declaration of conformity, the Article 9 risk management file and the Article 17 quality management system records into one versioned repository, indexed by system and release, and exportable in the official language of each Member State you sell into.
- Verify log retention is actually working. Confirm that automatically generated logs exist, are tamper-evident, cover the fields needed to reconstruct a decision, and are retained for the lifetime of the deployment and at minimum six months. Run a drill: pull all logs for one system for one named week and time how long it takes.
- Decide your source code position in advance. Document what would be disclosed under an Article 74(13) reasoned request, under what security safeguards, and which internal approvals are needed. Deciding this during a live request wastes days you do not have.
- Wire incident reporting into the same path. Article 73 serious incident notifications go to the market surveillance authority of the Member State where the incident occurred, with a general deadline of fifteen days from awareness, shortened for widespread infringements and critical infrastructure disruption. Those notifications should route through the same owner who handles document requests. See our page on incident reporting.
Most of the pressure in a market surveillance request comes from assembly time rather than from substance, because the evidence usually exists in fragments across engineering, product and legal. If you want a quick read on which obligations attach to your systems and which authority is likely to supervise them, the free screener at https://www.getactcomply.com/check walks through classification and role in about ten minutes. Our pages on what enforcement now looks like and fines and penalties cover the downstream consequences in more detail.