Who enforces the AI Act: market surveillance authorities, notifying authorities and the AI Office

What the source says

Art. 70(1) requires each Member State to establish or designate at least one notifying authority and at least one market surveillance authority, and requires them to act independently, impartially and without bias. The notifying authority assesses, designates and monitors conformity assessment bodies under Art. 28; the market surveillance authority supervises operators and systems on the market. Art. 70(2) requires each Member State to inform the Commission of its authorities and their tasks and to designate one market surveillance authority as its single point of contact; the Commission publishes the list of single points of contact.

Art. 74(1) extends Regulation (EU) 2019/1020 on market surveillance to AI systems, with its references to economic operators and products read as the operators and systems in Art. 2(1). Art. 74(3), 74(6), 74(8) and 74(9) then assign the authority by the kind of system, as the table below shows. Art. 74(12) grants the market surveillance authority full access, from the provider, to the documentation and to the training, validation and testing data sets, including through application programming interfaces. Art. 74(13) adds the source code on a reasoned request, where the procedures based on the data and documentation supplied have been exhausted or proved insufficient.

Art. 75, in the text amended by Regulation (EU) 2026/1744, makes the AI Office exclusively competent for two groups of systems. Point (a) covers a system based on a general-purpose AI model where the model and the system are developed by the same provider, with four exceptions: systems related to Annex I products, systems in Annex III point 2, systems provided by law enforcement authorities, border management authorities and financial institutions within Art. 74(6), and systems in Annex III point 8 as regards the administration of justice. Point (b) covers a system that constitutes or is integrated into a very large online platform or search engine designated under Regulation (EU) 2022/2065. The competence applies to the providers of those systems, and Art. 75(1a) routes their serious incident reports to the AI Office by derogation from Art. 73.

Art. 79(1) defines an AI system presenting a risk by reference to Art. 3(19) of Regulation (EU) 2019/1020, as regards health, safety or fundamental rights. Art. 79(2) requires the authority to evaluate the system "in respect of its compliance with all the requirements and obligations laid down in this Regulation" and, on a finding of non-conformity, to require the operator to take corrective action, withdraw the system or recall it within the period the paragraph sets. Art. 79(5) allows provisional measures to prohibit or restrict making available, to withdraw or to recall where the operator does not act. Art. 79(6) requires the notification to the Commission and the other Member States to name the non-conformity: a prohibited practice under Art. 5, a Chapter III requirement, a shortcoming in the standards or common specifications referred to in Art. 40 and 41, or an Art. 50 duty. Art. 99(1) leaves the rules on penalties and other enforcement measures, including warnings and non-monetary measures, to the Member States; Art. 99(3) to 99(5) set the three Union-level ceilings that the Art. 99 guide tabulates with the action that follows each tier.

What changes for a provider or deployer

The Art. 79(2) evaluation reads the whole set of requirements and obligations, and Art. 74(12) fixes what the reader receives. The high-risk obligations those authorities evaluate apply from the Annex III date 2027-12-02Deferred. Art. 26(5) requires a deployer with reason to consider that the system presents a risk within the meaning of Art. 79(1) to inform the provider and the market surveillance authority without undue delay and to suspend use; the Art. 26 obligation page lists that route as a process element. Art. 9(2) point (c) requires the post-market monitoring data under Art. 72 to feed the provider's risk management cycle; the Art. 9 obligation page lists the analysis record among the artifacts an evaluation asks for.

Art. 99(7) names, among the circumstances an authority weighs, the degree of cooperation with the national competent authorities, the degree of responsibility in view of the technical and organisational measures implemented, and the manner in which the infringement became known, in particular whether the operator notified it. Each of those is a dated record. AIAssuranceLabs tests against the requirements an Art. 79(2) evaluation covers and prepares the evidence within the limits at what we cannot do; corrective action, withdrawal and notification remain the operator's acts. The pre-conformity mock assessment runs PR-43-MOCK v1.0 as a dry run of the Annex VI or Annex VII route and produces the dry-run review report, the findings register with severity and article reference, the evidence-pack index with gaps marked, and the remediation plan. The findings register shows which requirement has evidence, which has a gap, and when each gap was found.

What to do now

1. Identify the market surveillance authority for each system: the sectoral authority under Art. 74(3), the financial supervisor under Art. 74(6), the data protection authority under Art. 74(8), the AI Office under Art. 75(1), or the single point of contact on the Commission's list under Art. 70(2).
2. Record the identification with the classification memo, so that the Art. 26(5) notification and the Art. 73 report have an addressee.
3. Assemble the Art. 74(12) file: the Annex IV technical documentation, the training, validation and testing data sets, and the Art. 12 logs; the information request scenario gives the assembly sequence.
4. Write the deployer route from an observed risk to suspension and notification under Art. 26(5), with the persons who execute it.
5. Run the Annex VI or Annex VII dry run under PR-43-MOCK v1.0 and close the findings register entries in severity order.
6. Read the Art. 99(3) to 99(5) tiers and the Art. 99(7) factors in the Art. 99 guide and keep the factor record it describes.

Related pages

The obligation pages, the protocol, the guide and the services below carry the detail for each step above.

Obligations

• Art. 9
• Art. 26

Protocols

• PR-43-MOCK v1.0

Guides

• Fines under the AI Act: Article 99 and the action that follows each tier

Services

• Pre-conformity mock assessment
• Classification and readiness assessment

ICP hubs

• Enterprises
• Annex III providers

Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.

Ask about scopehello@aiassurancelabs.com