Where a market surveillance authority finds non-compliance, it requires the relevant operator to take corrective action within a prescribed period. If the operator does not comply, or if the risk requires it, the authority can restrict or prohibit the system being made available on the market, or ensure it is recalled or withdrawn. Formal non-compliance, such as a missing or incorrect CE marking, a missing declaration of conformity, a missing registration or unavailable technical documentation, follows its own procedure. Corrective action is distinct from a penalty: it fixes the market position, while a penalty under Article 99 sanctions the infringement. Both can follow from the same facts.
What is corrective action?
Corrective action is the action an operator must take to bring an AI system into compliance with the Act, as required by a market surveillance authority following an evaluation. It can include correcting the system, its documentation, its marking, its registration or its instructions, restricting its availability, or taking other measures proportionate to the risk and the non-compliance found. The authority prescribes a period for the action, proportionate to the nature of the risk, and the operator must inform the authority of the action taken. Corrective action is not voluntary: it is a requirement backed by the authority's power to restrict or prohibit the system if the action is not taken. An operator should therefore treat a corrective action requirement as a formal project, with a named owner, a plan, a timetable and evidence of completion, rather than as a general instruction to improve. The completion evidence should show what changed, what was tested and when the system was brought into compliance.
When can a system be restricted or prohibited?
A system can be restricted or prohibited where the operator does not take the required corrective action within the prescribed period, where the non-compliance persists, or where the risk presented by the system requires immediate action. Restriction can take the form of limiting the system's availability, its uses or its deployment, while prohibition prevents it being made available on the market at all. The measure must be appropriate and proportionate to the risk and the non-compliance, and the authority must follow the procedure in Chapter IX, including informing the Commission and other Member States where a restrictive measure is taken. An operator facing a restriction should record the measure, the systems and versions affected, the markets affected and the corrective action required to lift it, and should not continue to supply the system in a way the measure forbids. Continuing supply in breach of a restriction can lead to further enforcement, including penalties.
For the broader regulatory framework, see enforcement and market surveillance.
What is recall and withdrawal?
Recall and withdrawal are measures that remove a system that is already on the market or in use. Withdrawal prevents a system from being made available on the market or being put into service, while recall requires a system already supplied to be returned or removed from use, as the Act and Regulation (EU) 2019/1020 provide. The authority can ensure recall or withdrawal where non-compliance persists or where the risk requires it, and the operator must carry out the measure and inform the authority and, where relevant, deployers and affected people. A recall or withdrawal plan should identify every deployment of the affected versions, the deployers and users to be notified, the steps to remove or disable the system, the handling of data and logs, and the verification that the measure is complete. That plan should be prepared in advance for high-risk systems, as part of the post-market and incident arrangements, so it can be executed promptly if a measure is imposed.
What is formal non-compliance?
Formal non-compliance covers cases where the system itself may not present a substantive risk, but a formal requirement has not been met: the CE marking has been affixed in violation of the Act or has not been affixed, the EU declaration of conformity has not been drawn up or has not been drawn up correctly, registration in the EU database has not been carried out, no authorised representative has been appointed where required, or technical documentation is not available. In those cases, the authority requires the operator to put an end to the non-compliance within a prescribed period, and if the non-compliance persists, the authority takes appropriate and proportionate measures to restrict or prohibit the system or ensure its recall or withdrawal. Formal non-compliance should therefore not be treated as a technicality: a missing registration or a missing declaration can lead to the same market measures as a substantive failure, and the cure is to complete the formal step and evidence it, not to argue that the system is safe in substance.
What should an operator do when a measure is imposed?
When a measure is imposed, the operator should first record the measure in full, including the authority, the date, the systems and versions affected, the grounds, the period set and the action required. It should then stop any supply or use the measure forbids, notify affected deployers and, where the measure requires it, affected people, and start the corrective action plan with a named owner and a timetable. It should preserve all relevant records, respond to the authority within the periods set, and seek qualified advice on whether to challenge the measure and on what grounds, since the remedies and suspensive effect depend on the Act and national procedural law. Throughout, the operator should keep a single log of the measure, the action taken and the communications with the authority, so the position can be shown consistently to other authorities, notified bodies and deployers. A measure handled in fragments, by different teams without a shared log, is harder to lift and harder to defend.
Continue with the market surveillance procedure under Article 74.
What does this guide not decide?
This guide does not predict what measure an authority will impose for a particular non-compliance, what period it will set, or whether a challenge to a measure would succeed. Those matters depend on the risk, the evidence, the operator's response and the procedural law of the Member State concerned, and they require the consolidated text of Chapter IX and qualified advice on the facts. The guide also does not cover the AI Office's corrective measures for general-purpose AI models, which follow the Union-level procedure. Where a corrective action requirement or a restrictive measure has been imposed, seek qualified advice promptly, comply with the measure as written, and keep the complete record of the action taken.
Frequently asked questions
Is corrective action the same as a fine?
No. Corrective action fixes the market position by bringing the system into compliance. A fine under Article 99 sanctions the infringement. Both can follow from the same facts, and corrective action does not remove penalty exposure.
Can a missing registration lead to withdrawal?
Yes, if the formal non-compliance persists after the authority has required it to be ended within a prescribed period. The authority can then restrict, prohibit, recall or withdraw the system as appropriate and proportionate.
What should an operator do first when a measure is imposed?
Record the measure in full, stop any supply or use it forbids, notify affected deployers and people as required, preserve records, and start a corrective action plan with a named owner and timetable, seeking qualified advice on remedies.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk implementation timeline ↗