AI Act Obligations for Market Surveillance Authorities

Source text: “National market surveillance authorities and the national data protection authorities of Member States that have been notified of the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for law enforcement purposes pursuant to paragraph 4 shall submit to the Commission annual reports on such use. For that purpose, the Commission shall provide Member States and national market surveillance and data protection authorities with a template, including information on the number of the decisions taken by competent judicial authorities or an independent administrative authority whose decision is binding upon requests for authorisations in accordance with paragraph 3 and their result.”

In practice: Authorities should establish internal data collection processes to track all authorisation requests and outcomes throughout the year, ensuring the annual report can be compiled accurately using the Commission template. Designate a reporting officer responsible for aggregating this data.

Source text: “For high-risk AI systems listed in point 1 of Annex III, where, in demonstrating the compliance of a high-risk AI system with the requirements set out in Section 2, the provider has applied harmonised standards referred to in Article 40, or, where applicable, common specifications referred to in Article 41, the provider shall opt for one of the following conformity assessment procedures based on: In demonstrating the compliance of a high-risk AI system with the requirements set out in Section 2, the provider shall follow the conformity assessment procedure set out in Annex VII where: For the purposes of the conformity assessment procedure referred to in Annex VII, the provider may choose any of the notified bodies. However, where the high-risk AI system is intended to be put into service by law enforcement, immigration or asylum authorities or by Union institutions, bodies, offices or agencies, the market surveillance authority referred to in Article 74(8) or (9), as applicable, shall act as a notified body.”

In practice: Map your AI system to Annex III point 1 and check whether applicable harmonised standards under Article 40 or common specifications under Article 41 exist. If they do, you may use internal control (Annex VI); if not, engage a notified body under Annex VII. For law enforcement use cases, contact the designated market surveillance authority early as it will serve as the notified body.

Source text: “By way of derogation from Article 43 and upon a duly justified request, any market surveillance authority may authorise the placing on the market or the putting into service of specific high-risk AI systems within the territory of the Member State concerned, for exceptional reasons of public security or the protection of life and health of persons, environmental protection or the protection of key industrial and infrastructural assets. That authorisation shall be for a limited period while the necessary conformity assessment procedures are being carried out, taking into account the exceptional reasons justifying the derogation. The completion of those procedures shall be undertaken without undue delay.”

In practice: Operators seeking emergency authorisation should document the exceptional justification thoroughly and immediately initiate the conformity assessment procedure in parallel, tracking progress to ensure timely completion.

Source text: “The authorisation referred to in paragraph 1 shall be issued only if the market surveillance authority concludes that the high-risk AI system complies with the requirements of Section 2. The market surveillance authority shall inform the Commission and the other Member States of any authorisation issued pursuant to paragraphs 1 and 2. This obligation shall not cover sensitive operational data in relation to the activities of law-enforcement authorities.”

In practice: Market surveillance authorities should establish a standardised notification template for communicating authorisations to the Commission and other Member States, and maintain a clear register of what constitutes sensitive operational data exempt from disclosure.

Source text: “Where the Commission considers the authorisation unjustified, it shall be withdrawn by the market surveillance authority of the Member State concerned.”

In practice: Market surveillance authorities should establish clear internal procedures for receiving and acting on Commission decisions to withdraw derogation authorisations, including timelines and notification mechanisms to affected providers.

Source text: “For high-risk AI systems related to products covered by Union harmonisation legislation listed in Section A of Annex I, only the derogations from the conformity assessment established in that Union harmonisation legislation shall apply.”

In practice: Providers of high-risk AI systems embedded in products covered by Annex I Section A legislation (e.g., medical devices, machinery) should consult the applicable sectoral Union harmonisation legislation to identify the correct derogation procedures, rather than relying on the general AI Act derogation provisions.

Source text: “Competent authorities shall provide providers and prospective providers participating in the AI regulatory sandbox with guidance on regulatory expectations and how to fulfil the requirements and obligations set out in this Regulation. Upon request of the provider or prospective provider of the AI system, the competent authority shall provide a written proof of the activities successfully carried out in the sandbox. The competent authority shall also provide an exit report detailing the activities carried out in the sandbox and the related results and learning outcomes. Providers may use such documentation to demonstrate their compliance with this Regulation through the conformity assessment process or relevant market surveillance activities. In this regard, the exit reports and the written proof provided by the national competent authority shall be taken positively into account by market surveillance authorities and notified bodies, with a view to accelerating conformity assessment procedures to a reasonable extent.”

In practice: Request written proof and an exit report from the competent authority upon completing sandbox activities, and include these documents in your conformity assessment dossier to demonstrate compliance and potentially expedite third-party review.

Source text: “Providers or prospective providers may conduct the testing in real world conditions only where all of the following conditions are met:”

In practice: Submit the real-world testing plan to the competent market surveillance authority well in advance of the planned testing start date; track the 30-day approval window and check whether national law provides for tacit approval or requires explicit authorisation. Register the testing in the EU database (or secure non-public section for law enforcement/migration/asylum/border control systems) before commencing.

Source text: “In accordance with Article 75, Member States shall confer on their market surveillance authorities the powers of requiring providers and prospective providers to provide information, of carrying out unannounced remote or on-site inspections, and of performing checks on the conduct of the testing in real world conditions and the related high-risk AI systems. Market surveillance authorities shall use those powers to ensure the safe development of testing in real world conditions.”

In practice: Ensure your real-world testing plan and related documentation are readily accessible to market surveillance authorities at any time. Maintain up-to-date records of testing activities, system configurations, and safety measures to facilitate unannounced inspections.

Source text: “The scientific panel shall advise and support the AI Office, in particular with regard to the following tasks:”

In practice: Providers of general-purpose AI models should be aware that the scientific panel may be called upon to assist market surveillance authorities investigating their systems; maintain comprehensive technical documentation to facilitate such reviews.

Source text: “Upon receiving a notification related to a serious incident referred to in Article 3, point (49)(c), the relevant market surveillance authority shall inform the national public authorities or bodies referred to in Article 77(1). The Commission shall develop dedicated guidance to facilitate compliance with the obligations set out in paragraph 1 of this Article. That guidance shall be issued by 2 August 2025, and shall be assessed regularly.”

In practice: Market surveillance authorities should establish internal escalation procedures to notify national public authorities promptly upon receipt of Article 3(49)(c) incident notifications. Compliance teams should monitor the Commission's guidance publication by 2 August 2025 and integrate it into their incident reporting frameworks.

Source text: “The market surveillance authority shall take appropriate measures, as provided for in Article 19 of Regulation (EU) 2019/1020, within seven days from the date it received the notification referred to in paragraph 1 of this Article, and shall follow the notification procedures as provided in that Regulation.”

In practice: Market surveillance authorities should implement a triage and escalation workflow that is triggered immediately upon receipt of a serious incident notification, ensuring that appropriate measures are identified and initiated within the seven-day deadline and that all steps are documented in accordance with Regulation (EU) 2019/1020 procedures.

Source text: “National competent authorities shall immediately notify the Commission of any serious incident, whether or not they have taken action on it, in accordance with Article 20 of Regulation (EU) 2019/1020.”

In practice: Establish an internal escalation and notification workflow that triggers an immediate report to the Commission upon identification of a serious AI-related incident. Ensure your national competent authority has a direct communication channel with the Commission aligned with the Article 20 procedure of Regulation (EU) 2019/1020, and document all incidents even if no corrective action was taken.

Source text: “Regulation (EU) 2019/1020 shall apply to AI systems covered by this Regulation. For the purposes of the effective enforcement of this Regulation:”

In practice: Operators of AI systems should familiarise themselves with Regulation (EU) 2019/1020 obligations (e.g., cooperation with market surveillance authorities, product traceability) as these now apply to them. Map your AI system supply chain roles (provider, deployer, importer, distributor) to the economic operator definitions.

Source text: “As part of their reporting obligations under Article 34(4) of Regulation (EU) 2019/1020, the market surveillance authorities shall report annually to the Commission and relevant national competition authorities any information identified in the course of market surveillance activities that may be of potential interest for the application of Union law on competition rules. They shall also annually report to the Commission about the use of prohibited practices that occurred during that year and about the measures taken.”

In practice: Market surveillance authorities should establish internal processes to flag and document competition-relevant findings and prohibited AI practice incidents throughout the year, enabling timely and accurate annual reporting to the Commission and competition authorities.

Source text: “By way of derogation from paragraph 6, in appropriate circumstances, and provided that coordination is ensured, another relevant authority may be identified by the Member State as market surveillance authority for the purposes of this Regulation. National market surveillance authorities supervising regulated credit institutions regulated under Directive 2013/36/EU, which are participating in the Single Supervisory Mechanism established by Regulation (EU) No 1024/2013, should report, without delay, to the European Central Bank any information identified in the course of their market surveillance activities that may be of potential interest for the prudential supervisory tasks of the European Central Bank specified in that Regulation.”

In practice: Member States designating an alternative market surveillance authority should establish formal coordination protocols. National supervisors of SSM credit institutions should implement procedures to promptly share AI-related market surveillance findings with the ECB, including defining what constitutes 'potential interest' for prudential supervision.

Source text: “Any information or documentation obtained by market surveillance authorities shall be treated in accordance with the confidentiality obligations set out in Article 78.”

In practice: Market surveillance authorities should implement internal information handling policies aligned with Article 78 confidentiality requirements, including access controls, data classification, and staff training on handling commercially sensitive or classified information obtained during investigations.

Source text: “Where the relevant market surveillance authorities have sufficient reason to consider general-purpose AI systems that can be used directly by deployers for at least one purpose that is classified as high-risk pursuant to this Regulation to be non-compliant with the requirements laid down in this Regulation, they shall cooperate with the AI Office to carry out compliance evaluations, and shall inform the Board and other market surveillance authorities accordingly.”

In practice: Market surveillance authorities should establish clear internal protocols for escalating suspected non-compliance of general-purpose AI systems to the AI Office, including documentation of the evidence threshold and notification procedures to the Board.

Source text: “Where a market surveillance authority is unable to conclude its investigation of the high-risk AI system because of its inability to access certain information related to the general-purpose AI model despite having made all appropriate efforts to obtain that information, it may submit a reasoned request to the AI Office, by which access to that information shall be enforced. In that case, the AI Office shall supply to the applicant authority without delay, and in any event within 30 days, any information that the AI Office considers to be relevant in order to establish whether a high-risk AI system is non-compliant. Market surveillance authorities shall safeguard the confidentiality of the information that they obtain in accordance with Article 78 of this Regulation. The procedure provided for in Chapter VI of Regulation (EU) 2019/1020 shall apply mutatis mutandis.”

In practice: Market surveillance authorities should document all efforts made to obtain information before submitting a reasoned request to the AI Office, and implement confidentiality protocols aligned with Article 78 of the AI Act to handle any information received from the AI Office.

Source text: “Where a market surveillance authority has sufficient reason to consider that an AI system classified by the provider as non-high-risk pursuant to Article 6(3) is indeed high-risk, the market surveillance authority shall carry out an evaluation of the AI system concerned in respect of its classification as a high-risk AI system based on the conditions set out in Article 6(3) and the Commission guidelines.”

In practice: Providers should maintain thorough documentation justifying their non-high-risk classification under Article 6(3) and Commission guidelines, as market surveillance authorities may challenge that classification at any time.

Source text: “Where, in the course of that evaluation, the market surveillance authority finds that the AI system concerned is high-risk, it shall without undue delay require the relevant provider to take all necessary actions to bring the AI system into compliance with the requirements and obligations laid down in this Regulation, as well as take appropriate corrective action within a period the market surveillance authority may prescribe.”

In practice: Providers should have a compliance readiness plan for high-risk AI requirements so that if reclassified, they can act swiftly within the authority-prescribed timeframe to avoid penalties.

Source text: “Where the market surveillance authority considers that the use of the AI system concerned is not restricted to its national territory, it shall inform the Commission and the other Member States without undue delay of the results of the evaluation and of the actions which it has required the provider to take.”

In practice: Market surveillance authorities should establish clear internal procedures for determining when an AI system's use extends beyond national borders and triggering cross-border notification workflows promptly.

Source text: “Where the provider of the AI system concerned does not take adequate corrective action within the period referred to in paragraph 2 of this Article, Article 79(5) to (9) shall apply.”

In practice: Providers should establish internal escalation protocols and timelines for responding to market surveillance authority requests; failure to act within the specified period triggers full Article 79 enforcement, including potential market withdrawal orders.

Source text: “Where, in the course of the evaluation pursuant to paragraph 1 of this Article, the market surveillance authority establishes that the AI system was misclassified by the provider as non-high-risk in order to circumvent the application of requirements in Chapter III, Section 2, the provider shall be subject to fines in accordance with Article 99.”

In practice: Providers must ensure their risk classification decisions are documented, objective, and defensible; intentional misclassification to avoid high-risk obligations constitutes a sanctionable infringement under Article 99 and should be treated as a serious compliance risk.

Source text: “In exercising their power to monitor the application of this Article, and in accordance with Article 11 of Regulation (EU) 2019/1020, market surveillance authorities may perform appropriate checks, taking into account in particular information stored in the EU database referred to in Article 71 of this Regulation.”

In practice: Providers should ensure that all information registered in the EU database under Article 71 is accurate, complete, and up to date, as market surveillance authorities will actively use this data when conducting checks on AI systems classified as non-high-risk.

Source text: “Where, having performed an evaluation under Article 79, after consulting the relevant national public authority referred to in Article 77(1), the market surveillance authority of a Member State finds that although a high-risk AI system complies with this Regulation, it nevertheless presents a risk to the health or safety of persons, to fundamental rights, or to other aspects of public interest protection, it shall require the relevant operator to take all appropriate measures to ensure that the AI system concerned, when placed on the market or put into service, no longer presents that risk without undue delay, within a period it may prescribe.”

In practice: Operators should maintain a risk register that goes beyond regulatory compliance checklists and includes residual risk assessments. Establish a rapid-response protocol for receiving and acting on market surveillance authority directives, including a designated contact point and escalation path.