Market Surveillance Authority

National authority responsible for carrying out market surveillance activities on AI systems, including inspections, testing, enforcement, and ensuring compliance with EU AI Act requirements within a Member State.

Semantic Classification

Content

• National authority responsible for carrying out market surveillance activities on AI systems, including inspections, testing, enforcement, and ensuring compliance with EU AI Act requirements within a Member State.

  Source

  Primary: EU AI Act Article 74 Reference: Market Surveillance Regulation (EU) 2019/1020

  Regulatory Context

  Market surveillance authorities are the front-line enforcement bodies for the EU AI Act at national level. Each Member State designates one or more authorities to monitor AI systems, investigate non-compliance, and take corrective action to protect health, safety, and fundamental rights.

  Designation and Organisation (Article 74)

  Member State Responsibility

  Each Member State must designate market surveillance authority with:

• Legal mandate: National law establishing authority and powers

• Competence: Technical expertise in AI systems

• Resources: Sufficient staff, budget, equipment

• Independence: Operational autonomy from political/economic interests

  Multiple Authorities Possible

  Member States may designate:

• Horizontal authority: Covering all AI systems

• Sectoral authorities: Specialised by domain (finance, healthcare, law enforcement)

  Coordination requirement: Clear division of responsibilities, single point of contact

  Notification to Commission

  Member States inform Commission of:

• Designated authorities

• Scope of responsibilities

• Contact information

  Powers and Responsibilities (Articles 74-77)

  Market Surveillance Activities

  1. Compliance Monitoring

• Market overview: Track AI systems placed on market

• Risk assessment: Identify high-risk non-compliant systems

• Sectoral analysis: Monitor AI use in critical domains

  2. Inspections and Testing (Article 75)

  Powers:

• Enter premises: Providers, importers, distributors

• Access documentation: Technical documentation, logs, quality management records

• Examine AI systems: Test functionality, performance, safety

• Take samples: For laboratory testing

• Interview personnel: Question staff on compliance

  Warrant: May require judicial authorisation depending on Member State law

  3. Information Requests (Article 76)

  Require operators to provide:

• Technical documentation

• EU Declaration of Conformity

• Quality management system documentation

• Post-market monitoring data

• Serious incident reports

  Timeframe: Reasonable deadline set by authority

  Language: In language easily understood by authority

  Enforcement Measures (Article 77)

  Non-Compliance Finding

  When AI system does not comply with Act, authority may:

  Provisional Measures

• Corrective action order: Require provider to bring into compliance within deadline

• Market restriction: Prohibit making available until compliant

• Withdrawal order: Require removal from market

• Recall order: Require return of already deployed systems

  Definitive Measures (Article 77(2))

  If non-compliance persists or serious:

• Market prohibition: Ban system from EU market

• Public warning: Alert deployers and public to risks

• Administrative fines: Penalties per Article 99

  Risk Assessment Approach

  Measures proportionate to:

• Severity: Health, safety, fundamental rights impact

• Likelihood: Probability of harm occurring

• Scope: Number of affected persons

• Provider cooperation: Willingness to remedy

  Serious Incident Response (Article 73, 77)

  Upon Receiving Incident Report

• Immediate assessment: Determine severity and scope

• Provider contact: Request additional information

• Cross-border notification: Alert other Member States if multi-state impact

• Public communication: Warn deployers if imminent danger

  Investigation

• Root cause analysis: Identify failure reason

• Systemic assessment: Determine if similar systems affected

• Corrective measure evaluation: Verify provider’s remediation adequate

  Cross-Border Coordination

  Multi-State Incidents (Article 77(6))

  When AI system affects multiple Member States:

• Lead authority: Member State where provider established

• Cooperation: Share investigation findings

• Harmonised action: Coordinated enforcement measures

• AI Office involvement: Complex cases requiring EU-level coordination

  Mutual Assistance

  Authorities assist each other by:

• Information exchange: Share compliance data, testing results

• Joint investigations: Collaborative inspections

• Enforcement support: Recognise and enforce other authorities’ decisions

  Dispute Resolution

  If authorities disagree on:

• Jurisdiction

• Compliance interpretation

• Enforcement approach

  Resolution: AI Board mediation, Commission arbitration

  Relationship to Other Bodies

  AI Office (Article 64)

• GPAI supervision: AI Office handles general-purpose AI models

• Coordination: AI Office coordinates multi-state surveillance

• Guidance: AI Office provides interpretative guidance

• Reporting: Authorities report enforcement to AI Office

  AI Board (Articles 65-66)

• Member representation: Authorities represent Member States on AI Board

• Best practices: Share experiences via AI Board

• Guidelines: Implement AI Board recommendations

  Notified Bodies (Articles 29-39)

• Verification: Check validity of notified body certificates

• Investigation: Question notified body findings if non-compliance suspected

• Coordination: Work with notifying authority on notified body issues

  Sectoral Regulators

  Coordinate with:

• Financial supervisors: Banking, insurance, securities AI

• Healthcare authorities: Medical device AI

• Data protection authorities: GDPR compliance

• Consumer protection agencies: Unfair commercial practices

  Information Systems

  EU Database for Standalone High-Risk AI (Article 71)

  Authorities have access to:

• Registered high-risk AI systems

• Provider information

• Conformity certificates

• Post-market monitoring plans

  Authorities:

• Verify registration: Check provider compliance

• Update entries: Enforcement actions, serious incidents

• Query database: Identify similar systems, patterns

  Law Enforcement Database (Article 49)

  For law enforcement, migration, border AI:

• Public logging of use cases

• Transparency mechanism

• Authority oversight tool

  Information Exchange Platform

  Authorities use secure platform for:

• Incident sharing

• Investigation coordination

• Best practice dissemination

  Resources and Capacity Building

  Technical Expertise Requirements

  Market surveillance authorities need staff with:

• AI knowledge: Machine learning, neural networks, algorithms

• Sector expertise: Healthcare, finance, law enforcement domains

• Legal skills: AI Act interpretation, enforcement procedures

• Testing capabilities: Evaluation tools, benchmarking methodologies

  Commission Support (Article 78)

  Commission provides:

• Training programmes: AI Act implementation, technical assessment

• Testing facilities: Access to AI evaluation infrastructure

• Guidance materials: Enforcement manuals, compliance checklists

• Funding: Digital Europe Programme, Horizon Europe

  International Cooperation

  Authorities engage with:

• Non-EU regulators: US FTC/NIST, UK AI Safety Institute, Singapore IMDA

• Standards bodies: ISO, IEC, IEEE

• Research institutions: Universities, AI safety organisations

  Penalties (Article 99)

  Authorities may impose administrative fines:

  Prohibited Practices (Article 99(3))

  Up to €35 million or 7% of global annual turnover

  High-Risk Obligations (Article 99(4))

  Up to €15 million or 3% of global annual turnover

  Information Obligations (Article 99(5))

  Up to €7.5 million or 1.5% of global annual turnover**

  Considerations

• Infringement severity and duration

• Provider cooperation

• Mitigating measures taken

• Economic benefit derived

• SME status (reduced penalties)

  Transparency and Accountability

  Public Reporting

  Authorities publish:

• Annual reports: Enforcement activities, key findings

• Non-compliance cases: Anonymised case studies (learning tool)

• Statistical data: Number of inspections, penalties, serious incidents

  Stakeholder Engagement

  Authorities consult with:

• Industry associations: Compliance challenges, guidance needs

• Civil society: Fundamental rights concerns

• Consumer organisations: Deployer protection

• Research community: Technical developments

  Complaint Mechanisms (Article 85)

  Individuals and organisations may:

• Lodge complaints: Report suspected AI Act violations

• Provide evidence: Support investigations

• Receive feedback: Informed of outcomes (subject to confidentiality)

  Practical Implications

  For Providers

• Primary contact: National authority where provider established

• Cooperation: Respond promptly to information requests

• Proactive engagement: Seek clarification before enforcement

• Documentation: Maintain records accessible for inspections

  For Deployers

• Report incidents: Serious incidents to relevant authority

• Complaint channel: Report suspected provider non-compliance

• Compliance verification: Check provider’s authority interactions

  For Member States

• Resource allocation: Adequate authority staffing and budget

• Coordination: Clear responsibilities among authorities

• Training: Ongoing AI expertise development

  Related Concepts

• AI Office (AI-0132): EU-level GPAI supervision

• National Competent Authority (AI-0136): Broader governance role

• Notified Body (AI-0134): Third-party conformity assessor

• Serious Incident (AI-0123): Reporting trigger

  See Also

• EU AI Act Articles 74-78 (Market Surveillance)

• Market Surveillance Regulation (EU) 2019/1020

• Commission Draft Guidelines on High-Risk AI Classification (published for consultation May 2026; market surveillance framework obligations taking full effect August 2026)

Provenance