Article 21: cooperation with competent authorities

The surroundings of Article 21, verbatim. Article 22(3), point (c), requires the authorised representative to provide a competent authority, upon a reasoned request, with all the information and documentation necessary to demonstrate conformity with the requirements set out in Section 2, including access to the logs referred to in Article 12(1) to the extent such logs are under the control of the provider; the final subparagraph of that paragraph provides that the mandate shall empower the authorised representative to be addressed, in addition to or instead of the provider, by the competent authorities. Article 19(1) provides that the provider keeps the logs under its control for a period appropriate to the intended purpose, of at least six months. Article 26(6) imposes the same period of at least six months on the deployer for the logs under its control. Article 99(5) subjects the supply of incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request to administrative fines of up to EUR 7 500 000 or, if the offender is an undertaking, up to 1 % of total worldwide annual turnover for the preceding financial year, whichever is higher.

The surroundings as Regulation (EU) 2026/1744 left them. Article 1, point (34), amends Article 77. The heading now reads "Powers of authorities protecting fundamental rights and cooperation with market surveillance authorities". Paragraph 1 now provides that national public authorities or bodies which supervise or enforce the respect of obligations under Union law protecting fundamental rights, including the right to non-discrimination, have the power to request and access any information or documentation created or maintained pursuant to this Regulation from the relevant market surveillance authority, in accessible language and machine-readable format by electronic means, where access to that information or documentation is necessary for effectively fulfilling their mandates within the limits of their jurisdiction, and that the Article is without prejudice to the competences, tasks, powers and independence of those authorities or bodies. The restriction to the systems listed in Annex III, the requirement of an accessible format and the after-the-fact notification of the market surveillance authority are gone. Inserted paragraph 1a provides that the market surveillance authority grants that access, including by requesting the information or documentation from the provider or the deployer where necessary and without undue delay. Inserted paragraph 1b requires market surveillance authorities and those authorities or bodies to cooperate closely and to provide each other with mutual assistance, including exchange of information. Article 99(4) still does not list Article 21 after the amendment: Article 1, point (38)(b), only inserts a point (da) there on the obligations of providers and operators pursuant to Article 25(2) and (4).

The timeline this object rests on is stated in so many words in the amended Regulation. Article 1, point (40)(b), replaces Article 113, third paragraph, point (c), so that Chapter III, Sections 1, 2 and 3, with the exception of Article 6(5), applies from 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III, and from 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I. Article 1, point (39)(a), replaces Article 111(2), so that the grace period is tied to the date of application of Chapter III referred to in Article 113 and no longer to 2 August 2026, while retaining 2 August 2030 for systems intended to be used by public authorities. Article 1, point (2)(a), replaces Article 2(2), so that for systems classified as high-risk under Article 6(1) related to products covered by Annex I, Section B, only Article 6(1), Article 60a and Articles 102 to 112 apply; Article 21 is not on that list. Article 1, point (41), deletes point 1 of Annex I, Section A, and adds Regulation (EU) 2023/1230 on machinery to Annex I, Section B.

Most of what is requested here already exists under the Regulation: the technical documentation of Article 11, the logs of Articles 12 and 19, the quality management system of Article 17, the conformity file of Article 43. Two things are genuinely additional. Article 19 requires you to keep the logs; Article 21(2) requires you to give an authority access to them, which is a different act. And the language rule of paragraph 1 is additional, because you deliver in an official language of the institutions of the Union chosen by the Member State concerned, not in the language you find most convenient. There is nothing to agree there; find out which language the Member State concerned has indicated and budget translation capacity for a technical file. Three further things go wrong in practice. Your documentation exists but is spread across teams and systems, so assembling it takes weeks. Your documentation belongs to a different system version than the one the question is about, in which case you demonstrate the conformity of something else. And the logs are gone: Article 19(1) and Article 26(6) ask for at least six months, so a request arriving later can meet an empty drawer. A provider established in a third country should also expect the request to land with its authorised representative: Article 22(3), point (c), imposes nearly the same delivery on him and the mandate empowers him to be addressed in addition to or instead of the provider. Article 21 is not the only channel either, but that second channel now runs differently. Under amended Article 77(1) a fundamental rights body requests information or documentation from the relevant market surveillance authority rather than directly from you, in accessible language and machine-readable format, and the restriction to Annex III systems has gone. Under inserted paragraph 1a that market surveillance authority may then request the material from you or from the deployer without undue delay. So expect a fundamental rights question to reach you as a request from the market surveillance authority, in a format a machine can read, and with its own route to testing under Article 77(3). On paragraph 3, finally, no comfortable story: Article 78 protects what you hand over only in accordance with Union or national law, carves out the cases of Article 5 of Directive (EU) 2016/943 for trade secrets and source code, and in paragraph 4 leaves the exchange of information, the dissemination of warnings and information duties under national criminal law unaffected. It is a rule on handling, not a shield.