Market surveillance authority

This role supervises and receives the notifications. It is the institutional role, not the national body that fills it.

1. Source

   Official fact on this object, with its locator.

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 20(1)-(2)

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   • Digital Omnibus on AI 2026/1744

     Locator: Article 1, point (40)(b), of Regulation (EU) 2026/1744, replacing Article 113, third paragraph, point (c), of Regulation (EU) 2024/1689

     praxikon:eu:ai-act:source:reg-eu-2026-1744

     Open official source

   Via

   • Condition | allApplies to providers of high-risk AI systems as soon as they consider, or have reason to consider, that a system they have placed on the market or put into service is not in conformity with this Regulation. For the standalone Annex III route (Article 6(2)) the date is 2 December 2027. For systems embedded as a safety component in products covered by the Annex I harmonisation legislation (Article 6(1)) the date is 2 August 2028.
   • Condition | any ofThe second layer in paragraph 2 is added only where the system presents a risk within the meaning of Article 79(1) and the provider becomes aware of that risk. The investigation of causes and the duty to inform the market surveillance authorities and, where applicable, the notified body that issued a certificate under Article 44, then come on top of the corrective actions under paragraph 1.
   • Condition | any ofThe distributor, the importer and the deployer appear here as affected parties, but that is not their only possible position. Anyone who puts their name or trade mark on a high-risk system already placed on the market, who substantially modifies such a system, or who changes the intended purpose of a system not classified as high-risk so that it becomes high-risk, is considered a provider under Article 25(1) and is subject to the obligations of Article 16. Point (j) of that Article routes straight to Article 20, so this provision then becomes a duty of their own rather than a notification arriving from someone else. In the trade mark case this applies without prejudice to contractual arrangements allocating the obligations otherwise.
   • ExceptionArticle 20 is by definition about systems already placed on the market or put into service, and that is exactly the group covered by the transitional rule of Article 111(2). That provision was replaced by Article 1, point (39)(a), of Regulation (EU) 2026/1744 and now reads: without prejudice to the application of Article 5 as referred to in Article 113, third paragraph, point (a), this Regulation applies to operators of high-risk AI systems, other than the systems referred to in paragraph 1 of that Article, that have been placed on the market or put into service before the date of application of Chapter III referred to in Article 113, only if, as from that date, those systems are subject to significant changes in their designs. The cut-off is therefore no longer a fixed date in paragraph 2: the date of 2 August 2026 that stood there until that amendment has been removed, and the amended paragraph names no date of its own. The carve-out in paragraph 1 covers systems that are components of the large-scale IT systems listed in Annex X; paragraph 1 was not amended and keeps a cut-off of its own. For systems intended to be used by public authorities the reprieve in paragraph 2 does not hold: there, compliance with the requirements and obligations is due by 2 August 2030 in any event. Which date of application of Chapter III is the cut-off is an open point: the object on Article 111 reads it as route dependent, so 2 December 2027 for the Annex III route and 2 August 2028 for the Annex I route, and marks that reading expressly as preliminary. That question is carried there, not here.

   As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

   Relation recorded on: Article 20: corrective actions and duty of information

   Consequence

   • ObligationArticle 20: corrective actions and duty of information

     praxikon:eu:ai-act:obligation:article-20-corrective-actions

2. Source

   Official fact on this object, with its locator.

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 23(1)-(7)

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   Via

   • Condition | allApplies to importers of high-risk AI systems. For the standalone Annex III route (Article 6(2)) the date is 2 December 2027; for the embedded Annex I route (Article 6(1)) the date is 2 August 2028.
   • ExceptionIf you put your own name or trade mark on the system, substantially modify it, or change the intended purpose so that it becomes high-risk, Article 25(1) treats you as a provider and the duties of Article 16 apply instead of those of Article 23.

   As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

   Relation recorded on: Article 23: obligations of importers

   Consequence

   • ObligationArticle 23: obligations of importers

     praxikon:eu:ai-act:obligation:article-23-importer-obligations

3. Source

   Official fact on this object, with its locator.

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 26(1)-(12)

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   Via

   • Condition | allApplies as soon as you use a high-risk AI system under your own authority (Article 3(4)), whether you built it yourself or procured it. For the standalone Annex III route (Article 6(2)) the date is 2 December 2027; for the embedded Annex I route (Article 6(1)) the date is 2 August 2028.
   • ExceptionArticle 2(10) excludes natural persons using an AI system in the course of a purely personal, non-professional activity. For deployers that are financial institutions subject to internal governance requirements under Union financial services law, the monitoring obligation in paragraph 5 is deemed fulfilled by complying with those rules, and the logs under paragraph 6 are maintained as part of the documentation kept under that law.

   As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

   Relation recorded on: Article 26: obligations of deployers of high-risk AI systems

   Consequence

   • ObligationArticle 26: obligations of deployers of high-risk AI systems

     praxikon:eu:ai-act:obligation:article-26-deployer-obligations

4. Source

   Official fact on this object, with its locator.

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 28(1), (3) and (5); Article 29(1) and (2); Article 30(1), (2) and (4)

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   • Digital Omnibus on AI 2026/1744

     Locator: Article 1, points (14) to (16), amending Articles 28, 29 and 30

     praxikon:eu:ai-act:source:reg-eu-2026-1744

     Open official source

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 31(1), (4), (5), (6), (8) and (11)

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 32; Article 33(1) to (4)

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 34(1) to (3); Article 35(1) and (2)

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 36(3), (5), (6) and (9)

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 37(1), (2) and (4); Article 38(1) to (3); Article 39

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   Via

   • Condition | allPractically engaged as soon as a notified body comes into the picture for your system. Within Annex III that is, under Article 43(1), only for the biometrics of point 1, and then only along the Annex VII procedure. Within Annex I, Section A, it happens through the sectoral conformity assessment of Article 43(3). For the systems of points 2 to 8 of Annex III, which follow the internal control of Annex VI, no notified body is involved and this Section has no direct bearing on you. The Section itself has applied since 2 August 2025 and therefore well before the underlying high-risk obligations bite: the notification chain has to exist before there is anything to assess.
   • Condition | allArticle 33(3) makes the agreement of the provider a condition for subcontracting: activities may be subcontracted or carried out by a subsidiary only with the agreement of the provider. That is a right you can exercise only if you ask about it, because the provision does not prescribe any active notice to you.
   • ExceptionArticle 39 rules out a free choice of a foreign body. Only conformity assessment bodies established under the law of a third country with which the Union has concluded an agreement may be authorised to carry out the activities of notified bodies, and then only where they meet the requirements laid down in Article 31 or ensure an equivalent level of compliance.
   • ExceptionThe presumption in Article 32 is narrow. A conformity assessment body is presumed to comply with the requirements of Article 31 in so far as the applicable harmonised standards cover those requirements and their references have been published in the Official Journal of the European Union. Without that publication the presumption does not operate, and it never reaches further than what the standard covers.

   As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

   Relation recorded on: Articles 28 to 39: notifying authorities and notified bodies

   Consequence

   • ObligationArticles 28 to 39: notifying authorities and notified bodies

     praxikon:eu:ai-act:obligation:article-28-39-notified-bodies

5. Source

   Official fact on this object, with its locator.

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 46(1)-(2)

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 46(3)-(4)

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 46(5)-(7)

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   Via

   • Condition | any ofThe authorisation may be granted only for exceptional reasons of public security or the protection of life and health of persons, environmental protection or the protection of key industrial and infrastructural assets. That list is the entire basis: a commercial interest, a delivery deadline or a tender date is not in it.
   • Condition | allA duly justified request is required, the authorisation comes from a market surveillance authority, it concerns specific high-risk AI systems, and it operates solely within the territory of the Member State concerned. It is moreover for a limited period while the necessary conformity assessment procedures are being carried out, and the completion of those procedures shall be undertaken without undue delay.
   • Condition | allThe authorisation is issued only if the market surveillance authority concludes that the high-risk AI system complies with the requirements of Section 2. The derogation therefore concerns the procedure of Article 43 and not the substantive requirements of Articles 8 to 15: those must be met before the authorisation exists.
   • ExceptionParagraph 2 removes the prior authorisation in a duly justified situation of urgency for exceptional reasons of public security or in the case of a specific, substantial and imminent threat to the life or physical safety of natural persons. Only law-enforcement authorities and civil protection authorities may rely on it, and only for putting into service, provided that such authorisation is requested during or after the use without undue delay.
   • ExceptionParagraph 7 excludes this Article for high-risk AI systems related to products covered by Union harmonisation legislation listed in Section A of Annex I. There, only the derogations from the conformity assessment established in that Union harmonisation legislation shall apply. For a regulated product, Article 46 is therefore not a route.
   • ExceptionThe notification duty in paragraph 3 towards the Commission and the other Member States shall not cover sensitive operational data in relation to the activities of law-enforcement authorities. The authorisation itself stands; the flow of data around it is limited.

   As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

   Relation recorded on: Article 46: derogation from conformity assessment procedure

   Consequence

   • ObligationArticle 46: derogation from conformity assessment procedure

     praxikon:eu:ai-act:obligation:article-46-derogation-from-conformity-assessment

6. Source

   Official fact on this object, with its locator.

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 49(1)-(5)

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   Via

   • Condition | any ofParagraph 4 does not except the registration but relocates it: for the systems referred to in points 1, 6 and 7 of Annex III in the areas of law enforcement, migration, asylum and border control management, the registration referred to in paragraphs 1, 2 and 3 goes into a secure non-public section of the EU database, with a limited list of fields from Annex VIII and Annex IX, and only the Commission and the national authorities referred to in Article 74(8) have access to it.
   • Condition | any ofApplies where a provider or, where applicable, an authorised representative places on the market or puts into service a high-risk AI system listed in Annex III, and where that same party places on the market or puts into service an AI system for which it has concluded that it is not high-risk according to Article 6(3).
   • Condition | any ofApplies where a deployer that is a public authority, Union institution, body, office or agency, or a person acting on their behalf, puts into service or uses a high-risk AI system listed in Annex III.
   • Condition | allRegistration is a precondition and not a notification afterwards: paragraphs 1 and 2 attach to the moment before the system is placed on the market or put into service, paragraph 3 to the moment before it is put into service or used.
   • ExceptionThis is an exception to the route and not to the duty. Paragraphs 1 and 3 except the high-risk AI systems referred to in point 2 of Annex III from registration in the EU database, and paragraph 5 provides that those systems are registered at national level. For critical infrastructure the registration therefore does not fall away: it runs through the national register rather than through the Article 71 EU database.

   As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

   Relation recorded on: Article 49: registration in the EU database before the system reaches the market

   Consequence

   • ObligationArticle 49: registration in the EU database before the system reaches the market

     praxikon:eu:ai-act:obligation:article-49-registration

7. Source

   Official fact on this object, with its locator.

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 60(1)-(4), Article 60(9), Article 113

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   Via

   • Condition | allApplies where you are a provider or prospective provider of an Annex III high-risk AI system and you want to test it in real world conditions outside an AI regulatory sandbox, before placing it on the market or putting it into service. If you are established outside the Union, Article 60(4), point (d), requires you to appoint a legal representative established in the Union; that is a different figure from the authorised representative under Article 22.
   • ExceptionArticle 60(1), third subparagraph, leaves Union and national law on real-world testing of high-risk systems related to products under the Annex I harmonisation legislation unaffected. Article 60(4), point (i), contains a law enforcement carve-out: where seeking informed consent would prevent the system from being tested, testing may proceed without consent, provided the testing and its outcome have no negative effect on the subjects and their personal data are deleted after the test. For the systems referred to in Annex III, points 1, 6 and 7, in law enforcement, migration, asylum and border control, registration runs through the secure non-public section of the EU database under Article 49(4), point (d). For the systems referred to in Annex III, point 2, Article 49(5) requires registration at national level.

   As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

   Relation recorded on: Article 60: testing in real world conditions outside a sandbox

   Consequence

   • ObligationArticle 60: testing in real world conditions outside a sandbox

     praxikon:eu:ai-act:obligation:article-60-real-world-testing

8. Source

   Official fact on this object, with its locator.

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 61(1) and (2)

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 60(2); Article 60(4), points (c), (h) and (i); Article 60(5); Article 113, second paragraph

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   Via

   • Condition | allApplies for the purpose of testing in real world conditions under Article 60, that is where you are a provider or prospective provider of a high-risk AI system listed in Annex III and you test that system in real world conditions outside an AI regulatory sandbox. Article 60(4), point (i), makes informed consent in accordance with Article 61 one of the cumulative conditions under which such testing is allowed. Consent is obtained per subject prior to their participation. Article 61 sits in Chapter VI, which is named in none of the three exceptions in the third paragraph of Article 113; the general date of application in the second paragraph therefore governs, 2 August 2026.
   • Condition | any ofIf under Article 60(2) you test in partnership with one or more deployers or prospective deployers, the condition stays with you as the provider, even where that party is the one in contact with the subject. Article 60(4), point (h), requires you and that party to conclude an agreement specifying your tasks and responsibilities; that is where you record who informs, who obtains the consent and who keeps the file.
   • ExceptionThe only exception sits not in Article 61 but in Article 60(4), point (i): in the case of law enforcement, where seeking informed consent would prevent the AI system from being tested in real world conditions, testing may proceed without that consent, provided the testing and its outcome have no negative effect on the subjects and their personal data are deleted after the test is performed. Outside that context there is no exception to consent; Article 61 contains none of its own.

   As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

   Relation recorded on: Article 61: informed consent of test subjects for testing in real world conditions

   Consequence

   • ObligationArticle 61: informed consent of test subjects for testing in real world conditions

     praxikon:eu:ai-act:obligation:article-61-informed-consent

9. Source

   Official fact on this object, with its locator.

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 73(1)-(11)

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   • EU Artificial Intelligence Act 2024/1689

     Locator: Article 113, second paragraph

     praxikon:eu:ai-act:source:reg-eu-2024-1689

     Open official source

   • Digital Omnibus on AI 2026/1744

     Locator: Article 1, point (40)(b), replacing Article 113, third paragraph, point (c)

     praxikon:eu:ai-act:source:reg-eu-2026-1744

     Open official source

   Via

   • Condition | allA serious incident occurs with a high-risk system: death or serious harm to health, serious and irreversible disruption of critical infrastructure, infringement of fundamental-rights protections or serious damage to property or environment.
   • ExceptionFor systems under sectoral reporting regimes with equivalent duties, reporting may run through that regime to avoid duplication.

   As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

   Relation recorded on: Article 73: serious incident reporting

   Consequence

   • ObligationArticle 73: serious incident reporting

     praxikon:eu:ai-act:obligation:article-73-incident-reporting

10. Source

    Official fact on this object, with its locator.

    • Digital Omnibus on AI 2026/1744

      Locator: Regulation (EU) 2026/1744, Article 1, point (31), Article 75(1a) and (1e)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    • Condition | allApplies to providers of AI systems that fall under the competence of the AI Office pursuant to Article 75(1) and that are classified as high-risk. The replaced paragraph 1 carries two independent routes, and the four carve-outs at (i) to (iv) sit inside point (a) alone. Along point (a) Annex I systems fall outside the competence, as do point 2 of Annex III and point 8 as regards the administration of justice; point 8(b), on influencing elections and referenda, is not carved out. Point (b) is a route of its own: a system that constitutes, or is integrated into, a designated very large online platform or very large online search engine falls under the competence of the AI Office even where one of the carve-outs in point (a) applies. Anyone testing point (a) alone places such a system outside this obligation wrongly. Those duties start to apply when Chapter III, Sections 1 to 3, becomes applicable, and that date depends on the route: 2 December 2027 for the route of Article 6(2) and Annex III, and 2 August 2028 for the route of Article 6(1) and Annex I, which point (b) can bring into view. The deadline_at field carries the earlier of the two.

    Relation recorded on: Article 75(1a) and (1e): reporting to and assessment by the AI Office

    Consequence

    • ObligationArticle 75(1a) and (1e): reporting to and assessment by the AI Office

      praxikon:eu:ai-act:obligation:article-75-ai-office-high-risk-duties

11. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 75(2)-(3)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Regulation (EU) 2026/1744, Article 1, point (31), Article 75(1)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Regulation (EU) 2026/1744, Article 1, point (31), Article 75(1b) to (1d) and (2a)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Regulation (EU) 2026/1744, Article 1, point (32), Article 75a

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Regulation (EU) 2026/1744, Article 1, point (32), Articles 75b, 75c and 75d

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    • Condition | any ofApplies to AI systems based on a general-purpose AI model where the model and the system are developed by the same provider or by providers forming part of the same undertaking, and to AI systems that constitute or are integrated into a very large online platform or very large online search engine designated in accordance with Regulation (EU) 2022/2065. The exclusive competence applies to the providers of those systems, and to deployers only where they are also the provider or form part of the same undertaking as the provider.
    • Condition | allThe allocation of competence itself operates from 2 August 2026, because Article 75 sits in Chapter IX. It covers the obligations that apply at that moment, such as the prohibition in Article 5, the transparency duties of Article 50 and the obligations for general-purpose AI models. The two literal duties the amending regulation places on the provider, the reporting route of paragraph 1a and the fees of paragraph 1e, attach to high-risk status and therefore follow 2 December 2027; they sit in the separate object article-75-ai-office-high-risk-duties.
    • ExceptionParagraph 1, point (a) carves four groups out of the exclusive competence of the AI Office: AI systems related to products covered by the Union harmonisation legislation listed in Annex I, systems referred to in point 2 of Annex III, systems provided by law enforcement authorities, border management authorities and financial institutions insofar as they fall under Article 74(6), and systems referred to in point 8 of Annex III as regards the administration of justice. Who is competent instead differs per group and is not always "the market surveillance authority": for financial institutions Article 74(6) points to the national authority responsible for their financial supervision, and for law enforcement, border management and the administration of justice Article 74(8) has the Member State designate either the data protection supervisory authority or another authority under the same conditions. Which body that is per Member State does not follow from the Regulation.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Relation recorded on: Article 75: market surveillance, mutual assistance and the powers of the AI Office

    Consequence

    • ObligationArticle 75: market surveillance, mutual assistance and the powers of the AI Office

      praxikon:eu:ai-act:obligation:article-75-market-surveillance-assistance

12. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 78(1)-(5)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    • Condition | allApplies to all information and data obtained by the Commission, the market surveillance authorities, the notified bodies and any other natural or legal person involved in the application of this Regulation in carrying out their tasks and activities. The protection operates in accordance with Union or national law and not on its own.
    • Condition | allParagraph 2 limits what an authority may request: only data that is strictly necessary for the assessment of the risk posed by AI systems and for the exercise of its powers in accordance with this Regulation and with Regulation (EU) 2019/1020. Two follow-on duties attach to that: adequate and effective cybersecurity measures, and deletion as soon as the data is no longer needed for the purpose for which it was obtained.
    • ExceptionThe protection of intellectual property, confidential business information and trade secrets, including source code, applies except in the cases referred to in Article 5 of Directive (EU) 2016/943. Point (a) of paragraph 1 says so in as many words.
    • ExceptionParagraph 4 provides that paragraphs 1, 2 and 3 do not affect the rights or obligations of the Commission, the Member States and their relevant authorities, or those of notified bodies, with regard to the exchange of information and the dissemination of warnings, including in the context of cross-border cooperation, nor the obligations of the parties concerned to provide information under criminal law of the Member States. Confidentiality under this article is therefore not a duty of silence between authorities.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Relation recorded on: Article 78: confidentiality of what you submit to an authority

    Consequence

    • ObligationArticle 78: confidentiality of what you submit to an authority

      praxikon:eu:ai-act:obligation:article-78-confidentiality