Article 79 – Procedure at National Level for Dealing with AI Systems Presenting a Risk

WHAT THE ARTICLE IS ABOUT

The national enforcement procedure from risk identification to withdrawal

Article 79 establishes the formal procedural sequence that market surveillance authorities follow when dealing with an AI system that presents a risk to health, safety or fundamental rights. It defines the steps from initial evaluation through to mandatory corrective action and, where necessary, market withdrawal — with built-in protections for operators and escalation mechanisms to EU level.

WHAT IT SAYS

Evaluate, require corrective action, withdraw if necessary, notify the EU

• Where an authority has sufficient reason to consider an AI system presents a risk, it must evaluate it for compliance with the Act’s requirements
• During evaluation, the authority must give the operator the opportunity to submit their view — procedural fairness is built in
• If non-compliance is found, the authority must require the operator to take corrective action within 15 working days — or a shorter period where harmonisation legislation specifies one
• Corrective action must cover all AI systems of the same type the operator has placed on the Union market, not just the specific unit investigated
• If the operator does not take adequate corrective action within the deadline, the authority must take provisional measures — prohibiting, restricting, withdrawing or recalling the system
• The authority must notify the Commission and other member states of any provisional measures without undue delay
• Where the non-compliance is not limited to the authority’s national territory, the notification triggers a 3-month window for other member states and the Commission to raise objections
• Where fundamental rights risks are identified, the authority must also inform and cooperate with the relevant national fundamental rights bodies under Article 77

WHO IS AFFECTED

All providers and operators of high-risk AI systems in the EU market

• Providers whose systems are flagged as presenting a risk — they face evaluation, corrective action demands and potentially withdrawal orders
• Importers and distributors who may also be considered operators and face the same corrective action obligations
• Market surveillance authorities conducting the procedure
• The Commission and other member states notified of provisional measures

WHAT IT MEANS FOR SMES

Know the procedure — and be ready to respond within 15 days

• The 15-working-day corrective action deadline is firm — if you receive a corrective action demand, you have three calendar weeks to demonstrate compliance; build this response capacity into your operations
• The right to submit your view before a finding of non-compliance is made is an important procedural protection — use it; engage legal counsel promptly if an investigation begins
• Corrective action must cover all units on the market, not just the one investigated — if you have deployed the same system to multiple customers, the remediation obligation is across all of them
• Voluntary corrective action before an authority imposes provisional measures is always better — the reputational and commercial impact of a market surveillance authority withdrawal order is far greater than a voluntary recall
• Document your corrective actions meticulously and submit evidence of compliance to the authority within the deadline — receiving confirmation that measures are adequate closes the investigation

Related Articles

• Article 74 — Market surveillance (the general powers exercised in this procedure)
• Article 81 — Union safeguard procedure (the EU-level escalation triggered by Article 79 notifications)
• Article 20 — Corrective actions (the provider’s own corrective action obligation)
• Article 99 — Penalties (fines that may follow if corrective action is not taken)