! High compliance impact for SMEs
WHAT THE ARTICLE IS ABOUT
The investigative and corrective powers of enforcement authorities
Article 74 establishes the market surveillance framework for the AI Act — granting national competent authorities the powers they need to monitor compliance, investigate suspected violations, and take corrective action. It applies Regulation (EU) 2019/1020 on market surveillance to AI systems, adapting it with AI-specific provisions and establishing special arrangements for law enforcement and high-risk sectors.
WHAT IT SAYS
Request documents, conduct inspections, order withdrawals, impose measures
- Market surveillance authorities apply the general market surveillance framework of Regulation (EU) 2019/1020 to AI systems, with the AI Act’s specific additions
- Where they have reasonable grounds to consider an AI system presents a risk, authorities may require the operator to take appropriate and proportionate corrective action within a specified timeframe
- Authorities may order the withdrawal or recall of a high-risk AI system from the market where the operator fails to take corrective action
- For high-risk AI systems used by law enforcement, immigration or asylum authorities: the market surveillance authority is the European Data Protection Supervisor for EU institutions, and a designated authority at national level for member state use
- Where an AI system is a safety component of a regulated product: the same authority responsible for market surveillance of that product also handles AI Act surveillance
- Authorities may request access to training, validation and testing data, source code, and any other documentation necessary to assess compliance
- Authorities must cooperate with each other and with the AI Office on cross-border cases
- Authorities must report their surveillance activities annually to the Commission
WHO IS AFFECTED
All providers and deployers of high-risk AI systems
- Providers of high-risk AI systems — market surveillance authorities can inspect their systems and documentation
- Deployers — may also be subject to surveillance, particularly public authority deployers
- Importers and distributors who may be required to cooperate with investigations
- Market surveillance authorities who exercise the powers defined in this article
WHAT IT MEANS FOR SMES
Know what authorities can ask for — and be ready to respond
- Market surveillance authorities can request your technical documentation, training data, source code and any other compliance records — organise these so they can be produced quickly on request
- The standard for triggering an investigation is reasonable grounds to consider a risk — not proof of violation; an authority does not need evidence of wrongdoing to begin an investigation
- Corrective action orders come with a timeframe set by the authority — compliance within that timeframe is mandatory; failure to comply is a separate violation
- A withdrawal or recall order is the most severe corrective measure short of penalties — it means your system must be removed from the market entirely; this is the business continuity risk that makes proactive compliance essential
- Cooperation with authorities during investigations is itself a legal obligation under Article 21 — obstruction or non-cooperation creates additional liability
- Keep your technical documentation current and complete at all times — not just at market launch; an authority can request it at any point during the system’s operational lifetime
Related Articles
- Article 21 — Cooperation with competent authorities (the obligation to cooperate during investigations)
- Article 73 — Serious incident reporting (incidents trigger surveillance authority involvement)
- Article 99 — Penalties (the fines authorities impose after finding non-compliance)
- Article 70 — National competent authorities (the bodies exercising these powers)
