Corrective Action
AI Corrective Action and Regulatory Escalation
What this control does
Coordinate actor-specific corrective action and regulatory escalation for AI non-conformity or risk, with clear responsibility and verified closure.
How to implement
Use this control when a relevant AI risk or non-conformity calls for corrective action by the responsible operator. Assign an incident or issue owner, identify affected systems and determine the required containment, correction, suspension, withdrawal or recall. Follow the actor-specific escalation and notification route without waiting for a periodic review. Preserve evidence, track actions and verify the basis for closure or restart. For notified-body certificate decisions use the Notified-Body Assessment and Certificate Management control; for GPAI Commission measures use the GPAI Regulatory Information, Evaluation and Remediation Response control. Those are distinct responsibilities.
Suggested timing and triggers
Immediately or without undue delay where the applicable duty requires; otherwise at the prescribed deadline; triggered by a relevant issue, risk or decision.
Evidence examples
Issue record with awareness time and affected-system scope Containment and notification decisions Corrective-action plan with owners and deadlines Investigation evidence and regulator correspondence Closure, restart or withdrawal records
How to check this control
Trace a significant issue from detection to the decision and completed action. Check notification timing and the affected-system scope. Verify that closure was supported by evidence rather than the planned completion date alone.
Related EU AI Act obligations
Article 20
Take Corrective Action and Provide Required Information for Non-Conforming or Risky High-Risk AI
Article 20(1)
Correct, Withdraw, Disable or Recall Non-Conforming High-Risk AI
Sub-obligation of Article 20: Take Corrective Action and Provide Required Information for Non-Conforming or Risky High-Risk AI
Article 20(1)
Inform Relevant Operators About High-Risk AI Corrective Action
Sub-obligation of Article 20: Take Corrective Action and Provide Required Information for Non-Conforming or Risky High-Risk AI
Article 20(2)
Investigate High-Risk AI Risks and Notify Relevant Authorities
Sub-obligation of Article 20: Take Corrective Action and Provide Required Information for Non-Conforming or Risky High-Risk AI
Article 23(2)
Do Not Place Non-Conforming or Falsified High-Risk AI on the Market and Report Relevant Risk
Sub-obligation of Article 23: Fulfil Importer Obligations Before and After Placing High-Risk AI on the EU Market
Article 24(4)
Take or Ensure Corrective Action for Distributed Non-Conforming High-Risk AI
Sub-obligation of Article 24: Fulfil Distributor Obligations for High-Risk AI Systems
Article 26(5), first subparagraph
Suspend High-Risk AI Use and Notify Required Parties When a Relevant Risk Is Identified
Sub-obligation of Article 26(5): Monitor High-Risk AI Operation and Escalate Risks or Serious Incidents
Article 73(6)
Investigate Serious Incidents, Reassess Risk and Take Corrective Action Without Delay
Sub-obligation of Article 73: Report and Investigate Serious Incidents Involving High-Risk AI
Article 75c(3)
Implement AI Office Non-Compliance Decisions and Report the Measures Taken
Sub-obligation of Articles 75a-75c: Comply With Binding AI Office Supervision, Investigation and Non-Compliance Requirements
_BestMeetsRequirements_Mid-Market_MeetsRequirements.svg)
_BestSupport_Enterprise_QualityOfSupport.svg)
_BestSupport_Mid-Market_QualityOfSupport.svg)
_BestSupport_QualityOfSupport.svg)
_BestUsability_Mid-Market_Total.svg)
_EasiestAdmin_EaseOfAdmin.svg)
_EasiestAdmin_Enterprise_EaseOfAdmin.svg)
_EasiestAdmin_Mid-Market_EaseOfAdmin.svg)
_EasiestSetup_EaseOfSetup.svg)
_EasiestSetup_Mid-Market_EaseOfSetup.svg)
_EasiestToDoBusinessWith_EaseOfDoingBusinessWith.svg)
_EasiestToDoBusinessWith_Enterprise_EaseOfDoingBusinessWith.svg)
_EasiestToDoBusinessWith_Mid-Market_EaseOfDoingBusinessWith.svg)
_EasiestToUse_Enterprise_EaseOfUse.svg)
_EasiestToUse_Mid-Market_EaseOfUse.svg)
_FastestImplementation_Mid-Market_GoLiveTime.svg)
_HighPerformer_Enterprise_HighPerformer.svg)
_HighPerformer_HighPerformer.svg)
_HighPerformer_Mid-Market_HighPerformer.svg)
_HighestUserAdoption_Mid-Market_Adoption.svg)
_MostImplementable_Mid-Market_Total.svg)
_UsersMostLikelyToRecommend_Mid-Market_Nps.svg)