Source: OJ L, 2024/1689, 12.7.2024

Current language: EN

Article 21 Cooperation with competent authorities


Summary What does Article 21 of the AI act regulation say?

This article establishes the obligation of providers of high-risk AI systems to cooperate with competent authorities upon request.

It covers two types of disclosure: providing documentation to demonstrate compliance with the requirements for high-risk AI systems, and granting access to the system's automatically generated logs.

The article also links to the confidentiality protections in Article 78, ensuring that information shared with authorities is handled appropriately.

Important points:

  • Providers of high-risk AI systems must provide all information and documentation necessary to demonstrate conformity to a competent authority upon a reasoned request, in an official Union language as indicated by the Member State.
  • Providers must also grant access to automatically generated logs upon a reasoned request, but only to the extent those logs are under their control.
  • Competent authorities are required to treat any information obtained under this article in accordance with the confidentiality obligations set out in Article 78.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

    1. Providers of high-risk AI systems shall, upon a reasoned request by a competent authority, provide that authority all the information and documentation necessary to demonstrate the conformity of the high-risk AI system with the requirements set out in Section 2, in a language which can be easily understood by the authority in one of the official languages of the institutions of the Union as indicated by the Member State concerned.

    1. Upon a reasoned request by a competent authority, providers shall also give the requesting competent authority, as applicable, access to the automatically generated logs of the high-risk AI system referred to in Article 12(1), to the extent such logs are under their control.

    1. Any information obtained by a competent authority pursuant to this Article shall be treated in accordance with the confidentiality obligations set out in Article 78.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod