Authority Access Rights to AI Systems and Documentation

Legal Framework

Authority access rights to AI systems and documentation operate at the intersection of the AI Act and Regulation (EU) 2019/1020 on market surveillance and compliance of products. The AI Act incorporates the market surveillance architecture of Regulation 2019/1020, which grants competent authorities broad powers to access premises, inspect facilities, request documentation, examine source code, and obtain data samples necessary to verify conformity with regulatory requirements.

Article 85 of the AI Act establishes the right of any natural or legal person to lodge complaints with market surveillance authorities, creating a bottom-up trigger for oversight investigations. These complaints must be handled under the dedicated procedures established by national market surveillance authorities pursuant to Regulation 2019/1020. Recital 36 extends this framework specifically to biometric identification systems, requiring notification to both the market surveillance authority and the national data protection authority for each use of real-time biometric identification systems, with annual reporting obligations to the Commission.

Recital 130 introduces a narrow exception: market surveillance authorities may authorize the placing on the market of AI systems that have not undergone conformity assessment under exceptional circumstances involving public security, protection of life, environmental protection, or critical infrastructure — underscoring that authority access rights include both enforcement and emergency authorization functions.

Key Developments

The AI Act's enforcement architecture remains in its early implementation phase, but the underlying market surveillance framework under Regulation 2019/1020 has generated established practice that directly informs AI system oversight. Market surveillance authorities have consistently exercised powers to demand technical documentation, access testing environments, and inspect product facilities — a pattern that will extend to AI system providers and deployers.

The dual-track oversight model — where market surveillance authorities and national data protection authorities share competence for AI systems processing personal data — creates a practical requirement for coordinated authority access. Where an AI system implicates both conformity assessment failures and GDPR violations, organizations should expect parallel or joint inspections, document requests, and data access demands from both authority types.

Practical Guidance

• Maintain a continuously updated documentation repository covering technical files, conformity assessments, risk management documentation, and post-market monitoring logs, structured for rapid production to market surveillance authorities on demand.
• Establish internal protocols designating responsible personnel and escalation chains for responding to authority access requests within the timelines expected under Regulation 2019/1020 procedures.
• For providers of biometric identification systems, implement automated notification workflows to both the market surveillance authority and the national data protection authority, and maintain annual reporting records as required by Recital 36.
• Prepare access-ready testing environments that allow authorities to inspect AI system behavior, including source code review capabilities, without exposing production data or trade secrets beyond what is legally required.
• Document any reliance on the Recital 130 exceptional authorization pathway with detailed justification linking the deployment to public security, life protection, environmental protection, or critical infrastructure protection.