Regulatory Cooperation
Regulatory Information and Cooperation Process
What this control does
Respond to reasoned regulator requests with controlled, complete and retrievable compliance information and logs.
How to implement
Assign a lead for each regulator request or reporting duty and identify the legal basis, recipient, scope and response deadline. Collect accurate information from accountable owners, check completeness and protect confidential material through appropriate handling arrangements. Obtain necessary approvals without delaying a mandatory response. Record what was sent, by whom and when, and track follow-up. Use the relevant specialist control for the technical assessment, incident response or corrective action; correspondence alone does not satisfy those duties.
Suggested timing and triggers
At each request, notification or reporting trigger; within the applicable deadline; periodic readiness exercises set by the organization.
Evidence examples
Request or reporting log with authority, basis and deadline Approved response package and source records Completeness, confidentiality and authorization checks Transmission and receipt evidence Follow-up requests and completed actions
How to check this control
Select a response and reconcile it to the request and supporting records. Check the deadline, approval and evidence of receipt. Confirm that an omitted item was identified and resolved rather than hidden in an incomplete response.
Related EU AI Act obligations
Article 5(4)
Notify Relevant Authorities of Each Permitted Use
Sub-obligation of Article 5(1)(h), 5(2)-(7): Do Not Use Real-Time Remote Biometric Identification in Public Spaces for Law Enforcement Except Where Specifically Permitted
Article 17(1)(j)-(k)
Maintain QMS Procedures for Regulatory Communications and Record-Keeping
Sub-obligation of Article 17; Article 63(1)-(2): Maintain a Quality Management System for High-Risk AI
Article 20(2)
Investigate High-Risk AI Risks and Notify Relevant Authorities
Sub-obligation of Article 20: Take Corrective Action and Provide Required Information for Non-Conforming or Risky High-Risk AI
Article 21
Provide High-Risk AI Compliance Information and Logs to Competent Authorities on Request
Article 22(3)(c)-(d)
Provide Compliance Information, Logs and Cooperation to Competent Authorities
Sub-obligation of Article 22(3)-(4): Perform Required High-Risk AI Authorised Representative Duties
Article 22(4)
Terminate the Mandate and Notify Authorities if the Provider Is Non-Compliant
Sub-obligation of Article 22(3)-(4): Perform Required High-Risk AI Authorised Representative Duties
Article 23(6)-(7)
Provide High-Risk AI Information to and Cooperate With Competent Authorities
Sub-obligation of Article 23: Fulfil Importer Obligations Before and After Placing High-Risk AI on the EU Market
Article 24(5)-(6)
Provide Distributor Compliance Information and Cooperate With Competent Authorities
Sub-obligation of Article 24: Fulfil Distributor Obligations for High-Risk AI Systems
Article 26(10), sixth subparagraph
Submit Annual Reports on Post-Remote Biometric Identification Use
Sub-obligation of Article 26(10): Apply Required Safeguards When Using High-Risk AI for Post-Remote Biometric Identification in Law Enforcement
Article 26(12)
Cooperate With Competent Authorities on High-Risk AI Use
Article 27(3)
Notify the Market-Surveillance Authority of the FRIA Results
Sub-obligation of Article 27: Conduct a Fundamental Rights Impact Assessment Before Applicable High-Risk AI Deployment
Article 52(1)
Notify the Commission When a GPAI Model Meets the Systemic-Risk Threshold
Article 53(3)
Cooperate With the Commission and Competent Authorities on GPAI Compliance
Article 53(4)
Demonstrate Alternative Adequate GPAI Compliance Where Approved Codes or Harmonised Standards Are Not Used
Article 54(3)(c)
Provide GPAI Compliance Information and Documentation to the AI Office on Request
Sub-obligation of Article 54(3)-(5): Perform Required GPAI Authorised Representative Duties
Article 54(3)(d), 54(4)
Cooperate With the AI Office and Competent Authorities on GPAI Matters
Sub-obligation of Article 54(3)-(5): Perform Required GPAI Authorised Representative Duties
Article 54(5)
Terminate the GPAI Mandate and Notify the AI Office When the Provider Is Non-Compliant
Sub-obligation of Article 54(3)-(5): Perform Required GPAI Authorised Representative Duties
Article 55(2)
Demonstrate Alternative Adequate Compliance for Systemic-Risk GPAI Where Codes or Standards Are Not Used
Article 73(6)
Cooperate With Authorities During Serious-Incident Investigations and Preserve the System for Causal Evaluation
Sub-obligation of Article 73: Report and Investigate Serious Incidents Involving High-Risk AI
Article 34(3)
Provide Relevant Assessment Documentation to the Notifying Authority on Request
Sub-obligation of Article 34: Perform Notified-Body AI Conformity Assessment Activities in Accordance With the Act
Article 45(1)
Report Required Certificate, Approval and Notification Information to the Notifying Authority
Sub-obligation of Article 45: Meet Notified-Body Information-Sharing and Reporting Obligations
Article 60(8)
Notify the Market-Surveillance Authority of Testing Suspension, Termination and Final Outcomes
Sub-obligation of Article 60: Conduct High-Risk AI Real-World Testing Only Under the Article 60 Conditions
Article 74(12)
Provide Full Access to High-Risk AI Documentation and Development Data Sets When Required
Sub-obligation of Article 74(12)-(13): Provide Market-Surveillance Authorities Required Access to High-Risk AI Documentation, Data Sets and Source Code
Article 75a(3)
Provide Complete and Accurate Information When the AI Office Issues a Binding Request
Sub-obligation of Articles 75a-75c: Comply With Binding AI Office Supervision, Investigation and Non-Compliance Requirements
Article 79(2), 79(4)
Cooperate With Market-Surveillance Risk Evaluations and Implement Required Corrective Action
Article 91(1), 91(3)-(5)
Provide GPAI Documentation and Information Requested by the Commission or AI Office
Article 83(1)
Remedy Specified Formal High-Risk AI Non-Compliance Within the Authority's Deadline
_BestMeetsRequirements_Mid-Market_MeetsRequirements.svg)
_BestSupport_Enterprise_QualityOfSupport.svg)
_BestSupport_Mid-Market_QualityOfSupport.svg)
_BestSupport_QualityOfSupport.svg)
_BestUsability_Mid-Market_Total.svg)
_EasiestAdmin_EaseOfAdmin.svg)
_EasiestAdmin_Enterprise_EaseOfAdmin.svg)
_EasiestAdmin_Mid-Market_EaseOfAdmin.svg)
_EasiestSetup_EaseOfSetup.svg)
_EasiestSetup_Mid-Market_EaseOfSetup.svg)
_EasiestToDoBusinessWith_EaseOfDoingBusinessWith.svg)
_EasiestToDoBusinessWith_Enterprise_EaseOfDoingBusinessWith.svg)
_EasiestToDoBusinessWith_Mid-Market_EaseOfDoingBusinessWith.svg)
_EasiestToUse_Enterprise_EaseOfUse.svg)
_EasiestToUse_Mid-Market_EaseOfUse.svg)
_FastestImplementation_Mid-Market_GoLiveTime.svg)
_HighPerformer_Enterprise_HighPerformer.svg)
_HighPerformer_HighPerformer.svg)
_HighPerformer_Mid-Market_HighPerformer.svg)
_HighestUserAdoption_Mid-Market_Adoption.svg)
_MostImplementable_Mid-Market_Total.svg)
_UsersMostLikelyToRecommend_Mid-Market_Nps.svg)