Article 21 requires providers of high-risk AI systems to cooperate with national competent authorities, on a reasoned request, in any action the authority takes to reduce or mitigate risks posed by the system, and to provide the authority with the information and documentation necessary to demonstrate conformity, in an easily understandable form and in a language determined by the Member State. Article 20 requires a provider that considers or has reason to consider that a system is not in conformity to take corrective action immediately, and to inform the relevant parties and the market surveillance authority where the system presents a risk. Cooperation is an ongoing duty, not a response to an investigation, and it must be supported by documentation that can be produced without delay.
What does cooperation under Article 21 require?
Cooperation under Article 21 has two elements: providing information and documentation on a reasoned request, and cooperating in action to reduce or mitigate risks. The information must be sufficient to demonstrate conformity, in an easily understandable form, and in a language the Member State determines. The provider should therefore keep the technical documentation, the quality management documentation, the conformity records, and the post-market and incident records in a form that can be produced promptly, in the required language, without needing to reconstruct them. Cooperation in risk mitigation can include withdrawing, disabling, recalling, or correcting a system, informing deployers and distributors, and providing updates to the authority. The provider should name an authority contact, with authority to act, so that a request is not delayed by internal routing.
What triggers corrective action under Article 20?
Corrective action is triggered where a provider considers, or has reason to consider, that a high-risk system is not in conformity with the Act. The trigger is not proof of harm or an authority finding. It can arise from internal testing, post-market monitoring, deployer feedback, a serious incident report, a supplier notice, or an authority request. Once triggered, the provider must immediately take the necessary corrective action to bring the system into conformity, withdraw it, disable it, or recall it, as appropriate. The choice among those actions depends on the nature of the non-conformity and the risk it presents. A minor documentation error and a safety-related failure require different responses, but both require a recorded decision and a timetable.
For the broader regulatory framework, see provider responsibilities.
Who must be informed, and when?
Where a high-risk system presents a risk, Article 20 requires the provider to inform, without undue delay, the market surveillance authority of the Member State where the system was placed on the market or put into service, and, where applicable, the notified body that issued a certificate. The provider must also inform distributors, deployers, the authorised representative and importers concerned, so that they can act. The information should describe the non-conformity, the risk, the corrective action taken or planned, and the effect on systems already supplied. A provider that learns of a risk through a deployer or a distributor should treat that report as a trigger for assessment, and should acknowledge and act on it, rather than treating the report as a customer complaint to be handled in the ordinary course.
How do serious incidents fit into cooperation?
Serious incident reporting under Article 73 is a separate duty that interacts with Articles 20 and 21. A provider must report a serious incident to the market surveillance authority of the Member State where the incident occurred, immediately after establishing a causal link, or the reasonable likelihood of such a link, between the system and the incident, and in any event within the period the article sets. The report, the investigation, and the corrective action should be coordinated through the quality management system, so that the authority receives a consistent account. The provider should keep the incident file, the causal analysis, the corrective action, and the authority correspondence together, and should update the risk management and post-market monitoring records from the findings.
How should a provider prepare for an authority request?
Preparation means keeping the conformity file current, in the required languages, with a named contact and a process for producing it on request. The file should include the technical documentation, the declaration, the certificates, the quality management documentation, the logs and monitoring records, and the correspondence with deployers and authorities. A simulated authority request, answered within the time the provider sets for itself, will reveal gaps in the file, in translation, or in access. The provider should also prepare for a request that is not about a single system, but about a product family, a model, or a supplier, by keeping the file organised so that the relevant systems can be identified quickly. Preparation should be tested regularly, not only when a request arrives.
Continue with Article 16 provider duties.
What is not decided by this guide?
This guide explains the cooperation and corrective action duties in outline. It does not decide whether a particular system is non-conforming, whether a risk is present, what corrective action is appropriate, or whether a serious incident must be reported. Those questions need the facts of the non-conformity, the risk analysis, and the incident evidence, read against Articles 20, 21 and 73 in the consolidated text. Where a risk to health, safety or fundamental rights is possible, the provider should act promptly, inform the authority, and confirm the position with a competent authority or legal adviser, rather than waiting for certainty.
Frequently asked questions
Must a provider wait for an authority to act before correcting a system?
No. Article 20 requires immediate corrective action where the provider considers or has reason to consider that a system is not in conformity. The provider must act, and inform the relevant parties and the authority where the system presents a risk, without waiting for an authority direction.
What language must documentation be provided in?
Article 21 requires information and documentation in an easily understandable form and in a language determined by the Member State concerned. The provider should confirm the language requirement for each Member State where the system is supplied, and keep the file in those languages.
Does cooperation end once a system is withdrawn?
No. Cooperation can continue after withdrawal, including informing deployers, handling systems already supplied, reporting incidents, and providing information to the authority about the withdrawn system and the corrective action taken.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗