Article 74(12)-(13)
UpcomingConditional timingProvide Market-Surveillance Authorities Required Access to High-Risk AI Documentation, Data Sets and Source Code
Applies to Provider; High-Risk AI.
- Actors
- Provider
- AI class
- High-Risk AI
- Themes
- Risk & AssuranceGovernance & Accountability
Tracker Networks Guidance
Provide market-surveillance authorities the access necessary for supervision, including documentation and training, validation and testing data sets and, when the statutory conditions are met, source code.
Official text
12. Without prejudice to the powers provided for under Regulation (EU) 2019/1020, and where relevant and limited to what is necessary to fulfil their tasks, the market surveillance authorities shall be granted full access by providers to the documentation as well as the training, validation and testing data sets used for the development of high-risk AI systems, including, where appropriate and subject to security safeguards, through application programming interfaces (API) or other relevant technical means and tools enabling remote access. 13. Market surveillance authorities shall be granted access to the source code of the high-risk AI system upon a reasoned request and only when both of the following conditions are fulfilled: (a) access to source code is necessary to assess the conformity of a high-risk AI system with the requirements set out in Chapter III, Section 2; and (b) testing or auditing procedures and verifications based on the data and documentation provided by the provider have been exhausted or proved insufficient.
Timing depends on the system
- 2 Dec 2027 — Article 6(2) / Annex III high-risk AI
- 2 Aug 2028 — Article 6(1) / Annex I Section A high-risk AI
- 2 Dec 2027 — Pre-existing Annex III high-risk AI type/model first placed on the market or put into service before 2027-12-02
- 2 Aug 2028 — Pre-existing Article 6(1) / Annex I high-risk AI type/model first placed on the market or put into service before 2028-08-02
- 2 Aug 2030 — Pre-existing high-risk AI intended to be used by public authorities
Suggested controls
Related risks
Regulatory Cooperation Failure
The organisation may be unable to provide complete, timely and understandable information, records or cooperation to competent authorities.
Sub-obligations
These are independently assessable parts of the parent requirement.
Article 74(12)
UpcomingProvide Full Access to High-Risk AI Documentation and Development Data Sets When Required
Tracker Networks Guidance
Grant market-surveillance authorities access, limited to what is necessary for their tasks, to relevant documentation and training, validation and testing data sets, including through suitable technical means such as APIs where appropriate.
Official text
Article 74(12)Official source 12. Without prejudice to the powers provided for under Regulation (EU) 2019/1020, and where relevant and limited to what is necessary to fulfil their tasks, the market surveillance authorities shall be granted full access by providers to the documentation as well as the training, validation and testing data sets used for the development of high-risk AI systems, including, where appropriate and subject to security safeguards, through application programming interfaces (API) or other relevant technical means and tools enabling remote access.
Suggested controls
Regulatory Information and Cooperation Process
Respond to reasoned regulator requests with controlled, complete and retrievable compliance information and logs.
Regulatory Access and Source-Code Response
Provide controlled regulator access to AI documentation, development data sets, source code and model access when legally required.
Related risks
Inadequate High-Risk AI Technical Documentation
Required technical documentation may be incomplete, outdated or insufficient to demonstrate compliance.
Regulatory Cooperation Failure
The organisation may be unable to provide complete, timely and understandable information, records or cooperation to competent authorities.
Article 74(13)
UpcomingProvide High-Risk AI Source Code Upon a Qualifying Reasoned Request
Tracker Networks Guidance
Provide source-code access when the authority's reasoned request satisfies the statutory conditions that source code is necessary for conformity assessment and less intrusive testing/audit approaches have been exhausted or are insufficient.
Official text
Article 74(13)Official source 13. Market surveillance authorities shall be granted access to the source code of the high-risk AI system upon a reasoned request and only when both of the following conditions are fulfilled: (a) access to source code is necessary to assess the conformity of a high-risk AI system with the requirements set out in Chapter III, Section 2; and (b) testing or auditing procedures and verifications based on the data and documentation provided by the provider have been exhausted or proved insufficient.
Suggested controls
Related risks
Regulatory Cooperation Failure
The organisation may be unable to provide complete, timely and understandable information, records or cooperation to competent authorities.
_BestMeetsRequirements_Mid-Market_MeetsRequirements.svg)
_BestSupport_Enterprise_QualityOfSupport.svg)
_BestSupport_Mid-Market_QualityOfSupport.svg)
_BestSupport_QualityOfSupport.svg)
_BestUsability_Mid-Market_Total.svg)
_EasiestAdmin_EaseOfAdmin.svg)
_EasiestAdmin_Enterprise_EaseOfAdmin.svg)
_EasiestAdmin_Mid-Market_EaseOfAdmin.svg)
_EasiestSetup_EaseOfSetup.svg)
_EasiestSetup_Mid-Market_EaseOfSetup.svg)
_EasiestToDoBusinessWith_EaseOfDoingBusinessWith.svg)
_EasiestToDoBusinessWith_Enterprise_EaseOfDoingBusinessWith.svg)
_EasiestToDoBusinessWith_Mid-Market_EaseOfDoingBusinessWith.svg)
_EasiestToUse_Enterprise_EaseOfUse.svg)
_EasiestToUse_Mid-Market_EaseOfUse.svg)
_FastestImplementation_Mid-Market_GoLiveTime.svg)
_HighPerformer_Enterprise_HighPerformer.svg)
_HighPerformer_HighPerformer.svg)
_HighPerformer_Mid-Market_HighPerformer.svg)
_HighestUserAdoption_Mid-Market_Adoption.svg)
_MostImplementable_Mid-Market_Total.svg)
_UsersMostLikelyToRecommend_Mid-Market_Nps.svg)