How Does Market Surveillance Work Under Article 74?

What triggers a market surveillance evaluation?

A market surveillance evaluation can be triggered by the authority's own surveillance activity, by a complaint under Article 85, by information from another authority, by a serious incident report under Article 73, or by information from a notified body, a deployer or another source. The authority does not need to wait for harm to occur: it can evaluate a system where it has sufficient reason to consider that the system presents a risk or is non-compliant. That breadth means an operator should treat any supervisory contact, complaint or incident as a potential trigger, and should preserve the relevant records from the moment it becomes aware of the issue. The authority's evaluation will focus on the system as it is actually supplied and used, including its intended purpose, its documentation, its logs and its performance in the deployment context, rather than on the provider's description of it in isolation. A system that looks compliant on paper but performs differently in use will be evaluated on its actual performance.

What information can an authority require?

A market surveillance authority can require the relevant operator to provide information and documentation, including the technical documentation, the conformity assessment information, the registration information and the post-market monitoring records. In defined circumstances, where the authority has exhausted other means and the information is necessary for the evaluation, it can require access to data, including training, validation and testing datasets, and to source code, subject to the safeguards in the Act, including confidentiality and intellectual property protections. The authority can also require information about the supply chain, the operators involved and the systems' deployment. An operator should therefore keep its documentation, datasets and code in a form that can be produced in a structured way, with confidential material identified and protected through the procedures the Act provides, rather than refusing access outright or producing unstructured material that cannot be assessed. The response to an information request should be complete, accurate and timely, and should be recorded with its date and contents.

For the broader regulatory framework, see enforcement and market surveillance.

How is risk evaluated?

The authority evaluates whether the AI system presents a risk to the health or safety of persons, to fundamental rights, or to other aspects of public interest protection, and whether it complies with the requirements of the Act. The evaluation considers the system's intended purpose, its actual use, the population affected, the severity and likelihood of harm, and the operator's documentation and controls. Where the system is a high-risk system, the evaluation will test the Chapter III requirements, including risk management, data governance, documentation, logging, human oversight, accuracy, robustness and cybersecurity, against the evidence the operator provides. Where the system is not high-risk, the evaluation will test the provisions that do apply to it, such as prohibitions and transparency duties. The operator should therefore be ready to explain, for each requirement, what was done, what evidence supports it and what remains open, rather than asserting compliance in general terms.

What happens after an evaluation finds non-compliance?

Where an evaluation finds non-compliance, the authority requires the relevant operator to take appropriate corrective action to bring the system into compliance within a period the authority prescribes, which must be proportionate to the nature of the risk. The operator must inform the authority and, where relevant, the notified body of the action taken. Where the non-compliance concerns the CE marking, the EU declaration of conformity, registration or the appointment of an authorised representative, or where technical documentation is unavailable, the authority follows the specific procedure in the Act for those formal non-compliance cases. Where the operator does not take corrective action within the prescribed period, or where the risk requires immediate action, the authority can take measures to restrict or prohibit the system being made available on the market, or to ensure it is recalled or withdrawn. The operator can challenge a measure through the remedies the Act and national law provide, but a challenge does not by itself suspend the measure unless the relevant procedure provides for it.

How are cross-border cases handled?

Where a system is made available in more than one Member State, or where a risk or non-compliance affects more than one Member State, the authorities cooperate through information exchange and coordination, and the Commission can support a Union-level response. An authority that takes a restrictive measure must inform the Commission and the other Member States, and other authorities can take account of the measure in their own surveillance. That cooperation means an operator cannot treat a measure in one Member State as a local issue: the same system, documentation and corrective action will be visible to other authorities, and inconsistent responses in different States will be compared. The practical control is a central incident and surveillance log, with a single owner for the system's response, so that information given to one authority, corrective action promised in one State and the timetable for that action are consistent everywhere the system is available.

Continue with corrective actions, restrictions and withdrawals.

What does this guide not decide?

This guide does not predict what a market surveillance authority will decide about a particular system, what information it will require, or what period it will set for corrective action. Those matters depend on the system's risk, the evidence and the authority's assessment, and they require the consolidated text of Chapter IX and Regulation (EU) 2019/1020 to be applied to the facts. The guide also does not cover the AI Office's Union-level procedure for general-purpose AI models in detail, which is addressed in the guides on the AI Office and on Article 101 fines. Where a market surveillance evaluation is under way, seek qualified advice promptly, preserve all relevant records, and respond within the periods the authority sets.

Frequently asked questions

Continue through this AI Act cluster

• enforcement and market surveillance
• corrective actions, restrictions and withdrawals
• national competent authorities under Article 70
• the right to lodge a complaint under Article 85
• serious incident reporting under Article 73
• provider responsibilities