Article 20
UpcomingConditional timingTake Corrective Action and Provide Required Information for Non-Conforming or Risky High-Risk AI
Applies to Provider; High-Risk AI.
- Actors
- Provider
- AI class
- High-Risk AI
- Themes
- Monitoring, Reporting & ImprovementGovernance & Accountability
Tracker Networks Guidance
If your organization is the provider and considers, or has reason to consider, that a high-risk AI system it placed on the market or put into service is non-conforming, act immediately to correct, withdraw, disable or recall it as appropriate and inform the relevant operators. If the system presents a risk within Article 79(1), investigate the causes and inform the competent market-surveillance authority and, where applicable, the notified body. For Article 6(1)/Annex I systems, also check Article 2(13) for any permitted limitation based on equivalent or higher sectoral requirements.
Official text
1. Providers of high-risk AI systems which consider or have reason to consider that a high-risk AI system that they have placed on the market or put into service is not in conformity with this Regulation shall immediately take the necessary corrective actions to bring that system into conformity, to withdraw it, to disable it, or to recall it, as appropriate. They shall inform the distributors of the high-risk AI system concerned and, where applicable, the deployers, the authorised representative and importers accordingly. 2. Where the high-risk AI system presents a risk within the meaning of Article 79(1) and the provider becomes aware of that risk, it shall immediately investigate the causes, in collaboration with the reporting deployer, where applicable, and inform the market surveillance authorities competent for the high-risk AI system concerned and, where applicable, the notified body that issued a certificate for that high-risk AI system in accordance with Article 44, in particular, of the nature of the non-compliance and of any relevant corrective action taken.
Timing depends on the system
- 2 Dec 2027 — Article 6(2) / Annex III high-risk AI
- 2 Aug 2028 — Article 6(1) / Annex I Section A high-risk AI
- 2 Dec 2027 — Pre-existing Annex III high-risk AI type/model first placed on the market or put into service before 2027-12-02
- 2 Aug 2028 — Pre-existing Article 6(1) / Annex I high-risk AI type/model first placed on the market or put into service before 2028-08-02
- 2 Aug 2030 — Pre-existing high-risk AI intended to be used by public authorities
Suggested controls
Related risks
Failure to Correct or Report Non-Conforming High-Risk AI
Non-conformity or material risk may not trigger timely containment, investigation, corrective action and notifications.
Sub-obligations
These are independently assessable parts of the parent requirement.
Article 20(1)
UpcomingCorrect, Withdraw, Disable or Recall Non-Conforming High-Risk AI
Tracker Networks Guidance
When a provider identifies non-conformity in a high-risk AI system it placed on the market or put into service, immediately take the corrective action appropriate to the situation, which may include bringing the system into conformity, withdrawing it, disabling it or recalling it.
Official text
Article 20(1)Official source 1. Providers of high-risk AI systems which consider or have reason to consider that a high-risk AI system that they have placed on the market or put into service is not in conformity with this Regulation shall immediately take the necessary corrective actions to bring that system into conformity, to withdraw it, to disable it, or to recall it, as appropriate. They shall inform the distributors of the high-risk AI system concerned and, where applicable, the deployers, the authorised representative and importers accordingly.
Suggested controls
Related risks
Failure to Correct or Report Non-Conforming High-Risk AI
Non-conformity or material risk may not trigger timely containment, investigation, corrective action and notifications.
Article 20(1)
UpcomingInform Relevant Operators About High-Risk AI Corrective Action
Tracker Networks Guidance
Inform distributors and, where applicable, deployers, the authorised representative and importers about the non-conformity and the corrective action taken.
Official text
Article 20(1)Official source 1. Providers of high-risk AI systems which consider or have reason to consider that a high-risk AI system that they have placed on the market or put into service is not in conformity with this Regulation shall immediately take the necessary corrective actions to bring that system into conformity, to withdraw it, to disable it, or to recall it, as appropriate. They shall inform the distributors of the high-risk AI system concerned and, where applicable, the deployers, the authorised representative and importers accordingly.
Suggested controls
Related risks
Failure to Correct or Report Non-Conforming High-Risk AI
Non-conformity or material risk may not trigger timely containment, investigation, corrective action and notifications.
AI Value Chain Compliance Failure
Suppliers, importers, distributors or authorised representatives may not provide the information, controls or cooperation needed for high-risk AI compliance.
Article 20(2)
UpcomingInvestigate High-Risk AI Risks and Notify Relevant Authorities
Tracker Networks Guidance
If the provider becomes aware that the high-risk AI system presents a risk within Article 79(1), immediately investigate the causes, collaborating with the reporting deployer where applicable, and inform the competent market-surveillance authority and any notified body that issued the relevant certificate.
Official text
Article 20(2)Official source 2. Where the high-risk AI system presents a risk within the meaning of Article 79(1) and the provider becomes aware of that risk, it shall immediately investigate the causes, in collaboration with the reporting deployer, where applicable, and inform the market surveillance authorities competent for the high-risk AI system concerned and, where applicable, the notified body that issued a certificate for that high-risk AI system in accordance with Article 44, in particular, of the nature of the non-compliance and of any relevant corrective action taken.
Suggested controls
AI Corrective Action and Regulatory Escalation
Coordinate actor-specific corrective action and regulatory escalation for AI non-conformity or risk, with clear responsibility and verified closure.
Regulatory Information and Cooperation Process
Respond to reasoned regulator requests with controlled, complete and retrievable compliance information and logs.
Related risks
Failure to Correct or Report Non-Conforming High-Risk AI
Non-conformity or material risk may not trigger timely containment, investigation, corrective action and notifications.
Regulatory Cooperation Failure
The organisation may be unable to provide complete, timely and understandable information, records or cooperation to competent authorities.
_BestMeetsRequirements_Mid-Market_MeetsRequirements.svg)
_BestSupport_Enterprise_QualityOfSupport.svg)
_BestSupport_Mid-Market_QualityOfSupport.svg)
_BestSupport_QualityOfSupport.svg)
_BestUsability_Mid-Market_Total.svg)
_EasiestAdmin_EaseOfAdmin.svg)
_EasiestAdmin_Enterprise_EaseOfAdmin.svg)
_EasiestAdmin_Mid-Market_EaseOfAdmin.svg)
_EasiestSetup_EaseOfSetup.svg)
_EasiestSetup_Mid-Market_EaseOfSetup.svg)
_EasiestToDoBusinessWith_EaseOfDoingBusinessWith.svg)
_EasiestToDoBusinessWith_Enterprise_EaseOfDoingBusinessWith.svg)
_EasiestToDoBusinessWith_Mid-Market_EaseOfDoingBusinessWith.svg)
_EasiestToUse_Enterprise_EaseOfUse.svg)
_EasiestToUse_Mid-Market_EaseOfUse.svg)
_FastestImplementation_Mid-Market_GoLiveTime.svg)
_HighPerformer_Enterprise_HighPerformer.svg)
_HighPerformer_HighPerformer.svg)
_HighPerformer_Mid-Market_HighPerformer.svg)
_HighestUserAdoption_Mid-Market_Adoption.svg)
_MostImplementable_Mid-Market_Total.svg)
_UsersMostLikelyToRecommend_Mid-Market_Nps.svg)