AI Act investigations: preparing an evidence pack for the first information request
A market surveillance authority sends a reasoned request about a high-risk AI system, and the provider hands over a file that demonstrates conformity with Chapter III Section 2. Art. 21(1) of Regulation (EU) 2024/1689 sets that duty, Art. 21(2) extends it to the logs under Art. 12, and Art. 74(12) gives the authority full access to documentation and data sets. The duties apply from the Annex III application date in the regulation data Deferred. The page gives the assembly sequence, its artifacts, and what follows if nothing is ready.
Where this starts
The system is listed in Annex III, the provider chose internal control under Annex VI as Art. 43(2) allows for Annex III points 2 to 8, and no notified body has ever read the file. The first outside reader is the authority. Art. 21(1) requires the provider to give, on a reasoned request, all the information and documentation necessary to demonstrate conformity with Chapter III Section 2, in a language the authority can easily understand as indicated by the Member State. Art. 16(k) restates the same duty among the provider obligations, and Art. 16(d) and (e) require the provider to keep the documentation under Art. 18 and the logs under Art. 19. Art. 18(1) sets the keeping period at ten years after placing on the market or putting into service for the technical documentation under Art. 11, the quality management system documentation under Art. 17 and the EU declaration of conformity. Art. 19(1) sets a minimum of six months for the automatically generated logs under the provider's control, subject to other Union or national law.
The powers behind the request are wider than the documentation. Art. 74(1) extends Regulation (EU) 2019/1020 to AI systems, and Art. 74(12) requires the provider to grant the market surveillance authority full access to the documentation and to the training, validation and testing data sets, where appropriate through APIs or other remote means. Art. 74(13) adds access to the source code on a reasoned request, on two cumulative conditions: the access is necessary to assess conformity with Chapter III Section 2, and the testing or auditing procedures based on the data and documentation the provider supplied have been exhausted or proved insufficient. Art. 77(1) lets a national authority that protects fundamental rights request the same documentation in an accessible language and format, and Art. 77(3) lets that authority ask the market surveillance authority to organise testing of the system through technical means where the documentation is insufficient. The two conditions in Art. 74(13) make the documentation and the data sets the first stage of any review. Regulation (EU) 2026/1744 moved the Annex III application date and, in the words of the regulation entry, left the obligations unchanged in content.
An organisation that built the system in-house holds the provider role under Art. 3(3), so the same request reaches an enterprise governance function with a portfolio of systems as reaches a product company with one. Where a system was kept out of Annex III under an Art. 6(3) condition, Art. 6(4) requires the provider to give the documented assessment to the national competent authority on request, so that record belongs in the same pack. The request names systems, versions and a period, and the pack answers system by system: which article, which element, which document, which version, where in the Annex IV file. The obligation records for Art. 11, Art. 12 and Art. 13 give the elements, and PR-11-DOC v1.0 gives the consistency checks an authority's reading would apply.
The sequence
The work runs in the order below, from the request record to the dry run, and each step leaves a named record in the file.
Record the authority, the legal basis cited, the systems named, the language required and the period set.
Record Request record: authority, legal basis cited, systems and versions named, language indicated, period stated
[Art. 21(1) and Art. 21(2)]
Confirm the Annex III point and the Annex VI route for each system the request names.
Record Classification reference and route selection record per named system
[Art. 6(2) and Art. 43(2); PR-43-MOCK steps 2 to 4]
Freeze the document set with an identifier and a content hash for each document version.
Record Frozen input set: one identifier and one content hash per document version
[PR-11-DOC steps 5 and 6]
Mark each Annex IV sub-point present, partial, absent or not applicable, with the location of the content.
Record Annex IV gap table: present, partial, absent or not applicable per sub-point, with location
[Art. 11(1) and Annex IV sections 1 to 9; PR-11-DOC steps 7 to 13]
Compare each declared metric, version and statement with the test reports and the deployed artefact.
Record Declared metric to test report consistency table; instructions-for-use consistency report; version and architecture reconciliation record
[Annex IV section 2(g) and Art. 13(3)(b)(ii); PR-11-DOC steps 20 to 35]
Reconstruct a sampled decision from the logs alone and read the retention configuration of each log store.
Record Decision reconstruction record; retention rows of the log completeness test report
[Art. 12(2) and Art. 21(2); PR-12-LOG steps 24 to 25 and 29 to 35]
Build the traceability matrix with one row per obligation element and its evidence location in the file.
Record Obligation to test to evidence traceability matrix
[PR-11-DOC step 43]
Assemble the evidence pack with its index and list each gap with the step that supplies it.
Record Evidence pack index: item, version, source, Annex IV section, status; gap list with the protocol step that supplies each missing item
[Art. 21(1) and Art. 74(12); PR-11-DOC steps 44 and 45]
Dry-run the pack as the authority would read it and record each finding with its article reference.
Record Findings register with severity and article reference; evidence-pack index with gaps marked
[Art. 74(12); PR-43-MOCK]
Evidence this situation ends with
| Artifact | Answers | Produced by |
|---|---|---|
| Annex IV technical documentation set (Annex IV sections 1 to 9) | Art. 11(1): documentation that demonstrates conformity with Chapter III Section 2 | the provider |
| Annex IV gap and consistency report | Art. 11(1) and Annex IV: presence and location of each sub-point | PR-11-DOC v1.0 |
| Declared metric to test report consistency table | Annex IV section 2(g) and section 3: declared values match dated and signed test reports | PR-11-DOC v1.0 |
| Instructions-for-use to technical documentation consistency report | Art. 13(3): each statement matches its Annex IV section | PR-11-DOC v1.0 |
| Decision reconstruction record | Art. 12(2) and Art. 21(2): a sampled decision reconstructed from the logs alone | PR-12-LOG v1.0 |
| Log retention policy | Art. 19(1) and Art. 26(6): retention period for logs under provider and deployer control | the provider |
| Obligation to test to evidence traceability matrix | Chapter III Section 2: each element mapped to its test and its evidence location | PR-11-DOC v1.0 |
| Evidence pack index with gaps marked | Art. 21(1) and Art. 74(12): the set handed over, with version and hash per file | PR-43-MOCK v1.0 |
Each artifact type is specified with a synthetic sample on the deliverables page: the pack and its index follow the evidence pack specification, the matrix follows the traceability matrix specification, and the dry-run findings follow the findings register specification on the same page. The traceability matrix template prefills the rows from the obligation records.
If nothing is done
Art. 79(2) of Regulation (EU) 2024/1689 requires a market surveillance authority that has sufficient reason to consider that a system presents a risk to evaluate it against all the requirements of the Regulation, and, where the system does not meet them, to require the operator to take corrective action, withdraw the system or recall it within a period the authority may prescribe, no longer than the shorter of fifteen working days or the period in the relevant Union harmonisation legislation. Where the operator does not act within that period, Art. 79(5) requires the authority to take provisional measures that prohibit or restrict the system on its national market, withdraw it or recall it. Under Art. 99(4)(a), a failure to meet the provider obligations in Art. 16, which include keeping the documentation and logs and demonstrating conformity on request, sits in the second penalty tier, and under Art. 99(5) incorrect, incomplete or misleading information supplied to a national competent authority in reply to a request sits in a tier of its own; Art. 99(7)(f) counts the degree of cooperation with the authority when the fine is set. The action that follows on the provider's side is to answer within the period with the frozen set, its index and the gap list, and to open corrective action under Art. 20(1) for each gap the dry run classified as blocking, since Art. 20(1) requires a provider that has reason to consider a placed system not in conformity to act immediately.
Services, guides and tools for this situation
The technical documentation and evidence-pack preparation service runs the gap, consistency and assembly steps within the limits at what we cannot do, and the pre-conformity mock assessment service runs the dry run that reads the pack as an authority would.
- Guides
- ICP hubs
Questions
Which market surveillance authorities enforce the AI Act?
Art. 70(1) of Regulation (EU) 2024/1689 requires each Member State to designate at least one market surveillance authority, and the Commission publishes the list of single points of contact under Art. 70(2). Art. 74(3) makes the sectoral authority responsible for Annex I Section A systems. Art. 74(8) assigns Annex III point 1 systems used for law enforcement, border management or justice, and points 6 to 8, to the data protection authority or an equivalent designated authority. Art. 75 gives the AI Office competence over general-purpose AI systems.
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.