Source: OJ L, 2024/1689, 12.7.2024

Current language: EN

Article 89 Monitoring actions


Summary What does Article 89 of the AI act regulation say?

This article sits within the section of the regulation that grants the AI Office its enforcement powers over general-purpose AI model providers, and it covers two distinct but related mechanisms.

First, it establishes the AI Office's broad monitoring and compliance powers over general-purpose AI model providers, including the ability to assess adherence to approved codes of practice.

Second, it creates a formal complaints channel specifically for downstream providers — those who build AI systems on top of general-purpose AI models — allowing them to report suspected infringements of the regulation directly to the AI Office.

Important points:

  • The AI Office has the power to monitor and enforce compliance by general-purpose AI model providers, including their adherence to approved codes of practice.
  • Downstream providers have the right to lodge a complaint against a general-purpose AI model provider for alleged infringement of this Regulation.
  • A complaint must be substantiated, identifying the provider's contact details, the relevant facts and provisions breached, and any other information the downstream provider considers relevant.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

    1. For the purpose of carrying out the tasks assigned to it under this Section, the AI Office may take the necessary actions to monitor the effective implementation and compliance with this Regulation by providers of general-purpose AI models, including their adherence to approved codes of practice.

    1. Downstream providers shall have the right to lodge a complaint alleging an infringement of this Regulation. A complaint shall be duly reasoned and indicate at least:

      1. the point of contact of the provider of the general-purpose AI model concerned;

      2. a description of the relevant facts, the provisions of this Regulation concerned, and the reason why the downstream provider considers that the provider of the general-purpose AI model concerned infringed this Regulation;

      3. any other information that the downstream provider that sent the request considers relevant, including, where appropriate, information gathered on its own initiative.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod