# Authority Access Rights to AI Systems and Documentation — legal context bundle > Curated from overview.legal on 2026-08-22. Canonical page: https://overview.legal/topics/authority-access-rights-ai-systems > Sources are cited per item. Verify against the official texts before relying on them. This new topic would specifically address the rights and procedures for competent authorities to access AI systems, facilities, documentation, and data during oversight activities, which is a critical component of the cooperation framework but not fully captured by existing topics. ## Overview ## Legal Framework Authority access rights to AI systems and documentation operate at the intersection of the AI Act and Regulation (EU) 2019/1020 on market surveillance and compliance of products. The AI Act incorporates the market surveillance architecture of Regulation 2019/1020, which grants competent authorities broad powers to access premises, inspect facilities, request documentation, examine source code, and obtain data samples necessary to verify conformity with regulatory requirements. Article 85 of the AI Act establishes the right of any natural or legal person to lodge complaints with market surveillance authorities, creating a bottom-up trigger for oversight investigations. These complaints must be handled under the dedicated procedures established by national market surveillance authorities pursuant to Regulation 2019/1020. Recital 36 extends this framework specifically to biometric identification systems, requiring notification to both the market surveillance authority and the national data protection authority for each use of real-time biometric identification systems, with annual reporting obligations to the Commission. Recital 130 introduces a narrow exception: market surveillance authorities may authorize the placing on the market of AI systems that have not undergone conformity assessment under exceptional circumstances involving public security, protection of life, environmental protection, or critical infrastructure — underscoring that authority access rights include both enforcement and emergency authorization functions. ## Key Developments The AI Act's enforcement architecture remains in its early implementation phase, but the underlying market surveillance framework under Regulation 2019/1020 has generated established practice that directly informs AI system oversight. Market surveillance authorities have consistently exercised powers to demand technical documentation, access testing environments, and inspect product facilities — a pattern that will extend to AI system providers and deployers. The dual-track oversight model — where market surveillance authorities and national data protection authorities share competence for AI systems processing personal data — creates a practical requirement for coordinated authority access. Where an AI system implicates both conformity assessment failures and GDPR violations, organizations should expect parallel or joint inspections, document requests, and data access demands from both authority types. ## Practical Guidance - Maintain a continuously updated documentation repository covering technical files, conformity assessments, risk management documentation, and post-market monitoring logs, structured for rapid production to market surveillance authorities on demand. - Establish internal protocols designating responsible personnel and escalation chains for responding to authority access requests within the timelines expected under Regulation 2019/1020 procedures. - For providers of biometric identification systems, implement automated notification workflows to both the market surveillance authority and the national data protection authority, and maintain annual reporting records as required by Recital 36. - Prepare access-ready testing environments that allow authorities to inspect AI system behavior, including source code review capabilities, without exposing production data or trade secrets beyond what is legally required. - Document any reliance on the Recital 130 exceptional authorization pathway with detailed justification linking the deployment to public security, life protection, environmental protection, or critical infrastructure protection. ## Legislation (full text of key provisions) ### Right to lodge a complaint with a market surveillance authority *Source: AI Act, aiact-art-85-en, 2024-06-12 — https://overview.legal/posts/93389* Without prejudice to other administrative or judicial remedies, any natural or legal person having grounds to consider that there has been an infringement of the provisions of this Regulation may submit complaints to the relevant market surveillance authority.In accordance with Regulation (EU) 2019/1020, such complaints shall be taken into account for the purpose of conducting market surveillance activities, and shall be handled in line with the dedicated procedures established therefor by the market surveillance authorities. ### Recital 170 — complaint rights for AI regulation infringement *Source: AI Act, aiact-rec-170-en, 2024-06-12 — https://overview.legal/posts/94022* Union and national law already provide effective remedies to natural and legal persons whose rights and freedoms are adversely affected by the use of AI systems. Without prejudice to those remedies, any natural or legal person that has grounds to consider that there has been an infringement of this Regulation should be entitled to lodge a complaint to the relevant market surveillance authority. ### Recital 36 — biometric system use notification and reporting *Source: AI Act, aiact-rec-36-en, 2024-06-12 — https://overview.legal/posts/93754* In order to carry out their tasks in accordance with the requirements set out in this Regulation as well as in national rules, the relevant market surveillance authority and the national data protection authority should be notified of each use of the real-time biometric identification system. Market surveillance authorities and the national data protection authorities that have been notified should submit to the Commission an annual report on the use of real-time biometric identification systems. ### Recital 130 — rapid deployment of innovative AI systems *Source: AI Act, aiact-rec-130-en, 2024-06-12 — https://overview.legal/posts/93942* Under certain conditions, rapid availability of innovative technologies may be crucial for health and safety of persons, the protection of the environment and climate change and for society as a whole. It is thus appropriate that under exceptional reasons of public security or protection of life and health of natural persons, environmental protection and the protection of key industrial and infrastructural assets, market surveillance authorities could authorise the placing on the market or the putting into service of AI systems which have not undergone a conformity assessment. In duly justified situations, as provided for in this Regulation, law enforcement authorities or civil protection authorities may put a specific high-risk AI system into service without the authorisation of the market surveillance authority, provided that such authorisation is requested during or after the use without undue delay. ### Recital 159 — biometric AI surveillance authority powers *Source: AI Act, aiact-rec-159-en, 2024-06-12 — https://overview.legal/posts/94000* Each market surveillance authority for high-risk AI systems in the area of biometrics, as listed in an annex to this Regulation insofar as those systems are used for the purposes of law enforcement, migration, asylum and border control management, or the administration of justice and democratic processes, should have effective investigative and corrective powers, including at least the power to obtain access to all personal data that are being processed and to all information necessary for the performance of its tasks. The market surveillance authorities should be able to exercise their powers by acting with complete independence. Any limitations of their access to sensitive operational data under this Regulation should be without prejudice to the powers conferred to them by Directive (EU) 2016/680. No exclusion on disclosing data to national data protection authorities under this Regulation should affect the current or future powers of those authorities beyond the scope of this Regulation. ### Recital 156 — market surveillance and compliance enforcement framework *Source: AI Act, aiact-rec-156-en, 2024-06-12 — https://overview.legal/posts/93994* In order to ensure an appropriate and effective enforcement of the requirements and obligations set out by this Regulation, which is Union harmonisation legislation, the system of market surveillance and compliance of products established by Regulation (EU) 2019/1020 should apply in its entirety. Market surveillance authorities designated pursuant to this Regulation should have all enforcement powers laid down in this Regulation and in Regulation (EU) 2019/1020 and should exercise their powers and carry out their duties independently, impartially and without bias. Although the majority of AI systems are not subject to specific requirements and obligations under this Regulation, market surveillance authorities may take measures in relation to all AI systems when they present a risk in accordance with this Regulation. Due to the specific nature of Union institutions, agencies and bodies falling within the scope of this Regulation, it is appropriate to designate the European Data Protection Supervisor as a competent market surveillance authority for them. This should be without prejudice to the designation of national competent authorities by the Member States. Market surveillance activities should not affect the ability of the supervised entities to carry out their tasks independently, when such independence is required by Union law. ### Recital 161 — Union and national supervision responsibilities for general-purpose AI *Source: AI Act, aiact-rec-161-en, 2024-06-12 — https://overview.legal/posts/94004* It is necessary to clarify the responsibilities and competences at Union and national level as regards AI systems that are built on general-purpose AI models. To avoid overlapping competences, where an AI system is based on a general-purpose AI model and the model and system are provided by the same provider, the supervision should take place at Union level through the AI Office, which should have the powers of a market surveillance authority within the meaning of Regulation (EU) 2019/1020 for this purpose. In all other cases, national market surveillance authorities remain responsible for the supervision of AI systems. However, for general-purpose AI systems that can be used directly by deployers for at least one purpose that is classified as high-risk, market surveillance authorities should cooperate with the AI Office to carry out evaluations of compliance and inform the Board and other market surveillance authorities accordingly. Furthermore, market surveillance authorities should be able to request assistance from the AI Office where the market surveillance authority is unable to conclude an investigation on a high-risk AI system because of its inability to access certain information related to the general-purpose AI model on which the high-risk AI system is built. In such cases, the procedure regarding mutual assistance in cross-border cases in Chapter VI of Regulation (EU) 2019/1020 should apply mutatis mutandis. ### Recital 141 — real world testing conditions without sandbox *Source: AI Act, aiact-rec-141-en, 2024-06-12 — https://overview.legal/posts/93964* In order to accelerate the process of development and the placing on the market of the high-risk AI systems listed in an annex to this Regulation, it is important that providers or prospective providers of such systems may also benefit from a specific regime for testing those systems in real world conditions, without participating in an AI regulatory sandbox. However, in such cases, taking into account the possible consequences of such testing on individuals, it should be ensured that appropriate and sufficient guarantees and conditions are introduced by this Regulation for providers or prospective providers. Such guarantees should include, inter alia, requesting informed consent of natural persons to participate in testing in real world conditions, with the exception of law enforcement where the seeking of informed consent would prevent the AI system from being tested. Consent of subjects to participate in such testing under this Regulation is distinct from, and without prejudice to, consent of data subjects for the processing of their personal data under the relevant data protection law. It is also important to minimise the risks and enable oversight by competent authorities and therefore require prospective providers to have a real-world testing plan submitted to competent market surveillance authority, register the testing in dedicated sections in the EU database subject to some limited exceptions, set limitations on the period for which the testing can be done and require additional safeguards for persons belonging to certain vulnerable groups, as well as a written agreement defining the roles and responsibilities of prospective providers and deployers and effective oversight by competent personnel involved in the real world testing. Furthermore, it is appropriate to envisage additional safeguards to ensure that the predictions, recommendations or decisions of the AI system can be effectively reversed and disregarded and that personal data is protected and is deleted when the subjects have withdrawn their consent to participate in the testing without prejudice to their rights as data subjects under the Union data protection law. As regards transfer of data, it is also appropriate to envisage that data collected and processed for the purpose of testing in real-world conditions should be transferred to third countries only where appropriate and applicable safeguards under Union law are implemented, in particular in accordance with bases for transfer of personal data under Union law on data protection, while for non-personal data appropriate safeguards are put in place in accordance with Union law, such as Regulations (EU) 2022/868 (42) and (EU) 2023/2854 (43) of the European Parliament and of the Council. ### Recital 153 — national competent authorities designation *Source: AI Act, aiact-rec-153-en, 2024-06-12 — https://overview.legal/posts/93988* Member States hold a key role in the application and enforcement of this Regulation. In that respect, each Member State should designate at least one notifying authority and at least one market surveillance authority as national competent authorities for the purpose of supervising the application and implementation of this Regulation. Member States may decide to appoint any kind of public entity to perform the tasks of the national competent authorities within the meaning of this Regulation, in accordance with their specific national organisational characteristics and needs. In order to increase organisation efficiency on the side of Member States and to set a single point of contact vis-à-vis the public and other counterparts at Member State and Union levels, each Member State should designate a market surveillance authority to act as a single point of contact. ### Recital 96 — fundamental rights impact assessment deployers *Source: AI Act, aiact-rec-96-en, 2024-06-12 — https://overview.legal/posts/93874* In order to efficiently ensure that fundamental rights are protected, deployers of high-risk AI systems that are bodies governed by public law, or private entities providing public services and deployers of certain high-risk AI systems listed in an annex to this Regulation, such as banking or insurance entities, should carry out a fundamental rights impact assessment prior to putting it into use. Services important for individuals that are of public nature may also be provided by private entities. Private entities providing such public services are linked to tasks in the public interest such as in the areas of education, healthcare, social services, housing, administration of justice. The aim of the fundamental rights impact assessment is for the deployer to identify the specific risks to the rights of individuals or groups of individuals likely to be affected, identify measures to be taken in the case of a materialisation of those risks. The impact assessment should be performed prior to deploying the high-risk AI system, and should be updated when the deployer considers that any of the relevant factors have changed. The impact assessment should identify the deployer’s relevant processes in which the high-risk AI system will be used in line with its intended purpose, and should include a description of the period of time and frequency in which the system is intended to be used as well as of specific categories of natural persons and groups who are likely to be affected in the specific context of use. The assessment should also include the identification of specific risks of harm likely to have an impact on the fundamental rights of those persons or groups. While performing this assessment, the deployer should take into account information relevant to a proper assessment of the impact, including but not limited to the information given by the provider of the high-risk AI system in the instructions for use. In light of the risks identified, deployers should determine measures to be taken in the case of a materialisation of those risks, including for example governance arrangements in that specific context of use, such as arrangements for human oversight according to the instructions of use or, complaint handling and redress procedures, as they could be instrumental in mitigating risks to fundamental rights in concrete use-cases. After performing that impact assessment, the deployer should notify the relevant market surveillance authority. Where appropriate, to collect relevant information necessary to perform the impact assessment, deployers of high-risk AI system, in particular when AI systems are used in the public sector, could involve relevant stakeholders, including the representatives of groups of persons likely to be affected by the AI system, independent experts, and civil society organisations in conducting such impact assessments and designing measures to be taken in the case of materialisation of the risks. The European Artificial Intelligence Office (AI Office) should develop a template for a questionnaire in order to facilitate compliance and reduce the administrative burden for deployers. ## Guidance ### Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework *Source: EDPB, statement-32024-on-data-protection-authorities-role-in-the-en, 2024-07-16 — https://overview.legal/posts/125732 — original: https://www.edpb.europa.eu/documents/reports-statements-and-letters/statement-32024-on-data-protection-authorities-role-in-the_en* Final 1 Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework Adopted on 16 July 2024 The European Data Protection Board has adopted the following statement: 1 BACKGROUND AND PURPO SE OF THIS STATEMENT 1. On 12 July 2024, Regulation (EU) 2024/1689 laying down harmonised rules on a rtificial i ntelligence (Artificial Intelligence Act, hereinafter the “ AI Act ”) and amending certain Union Legislative Acts was published in the Official Journal 1 . 2.… ### EDPB Annual Report 2021 *Source: EDPB, edpb-annual-report-2021-en, 2022-05-12 — https://overview.legal/posts/125941 — original: https://www.edpb.europa.eu/documents/reports-statements-and-letters/edpb-annual-report-2021_en* Enhancing the depth and breadth of data protection 2 EDPB Annual Report 2021 2 ENHANCING THE DEPTH AND BREADTH OF DATA PROTECTION An Executive Summary of this report, which provides an overview of key EDPB activities in 2021, is also available. Further details about the EDPB can be found on our website at edpb.europa.eu. 3 EDPB Annual Report 2021 3 GLOSSARY 7 FOREWORD 10 2021 - HIGHLIGHTS 13 3.1. STRATEGY 2021-2023 AND WORK PROGRAMME 2021-2022 13 3.2. EDPB OPINIONS ON DRAFT UK ADEQUACY… ### EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space *Source: EDPB, edpb-edps-joint-opinion-032022-on-the-proposal-for-a-regulation-on-en, 2022-07-12 — https://overview.legal/posts/125922 — original: https://www.edpb.europa.eu/documents/legislative-opinion/edpb-edps-joint-opinion-032022-on-the-proposal-for-a-regulation-on_en* Adopted 1 EDPB - EDPS Joint Opinion 03 /2022 on the Proposal for a Regulation on the European Health Data Space Adopted on 12 July 2022 Adopted 2 Adopted 3 Executive Summary With this Joint Opinion, the EDPB and the EDPS aim to draw attention to a number of overarching concerns on the Proposal on the European Health Data Space and urge the co - legislature to take decisive action. The EDPB and the EDPS note that the Proposal ai ms at supporting individuals to take control of their own health… ## Literature ### Use of Artificial Intelligence Tools by Law Enforcement Services in Light of the Artificial Intelligence Act *Source: Zeszyt Prawniczy UAM, 2025-12-22 — https://overview.legal/posts/132565 — original: https://doi.org/10.14746/zpuam.2025.15.4* Celem artykułu jest wskazanie przestępstw, w przypadku których służby państwowe mogą korzystać z systemów zdalnej identyfikacji biometrycznej w czasie rzeczywistym w przestrzeni publicznej. Zostanie to uczynione przez analizę przesłanek umożliwiających posługiwanie się tą technologią oraz przyrównanie ich do czynów zabronionych przez polski kodeks karny. Rezultatem powyższego jest stworzenie katalogu przestępstw, odnośnie do których służby mogą zastosować system zdalnej identyfikacji biometryczn ## Related topics - **Monitoring** — https://overview.legal/topics/monitoring Systematic observation and tracking of individuals - **Post-Market Monitoring for AI Systems** — https://overview.legal/topics/post-market-monitoring-ai Risk management systems require ongoing post-market monitoring to identify and respond to risks that emerge during real-world deployment. This is a distinct and - **AI Incident Notification** — https://overview.legal/topics/serious-incident-notification-ai The AI Act establishes specific procedures for notifying authorities about serious incidents and anomalies in high-risk AI systems, which requires dedicated cov - **Interim Measures under AI Act** — https://overview.legal/topics/interim-measures-ai-act This new topic is needed to specifically address interim measures provisions in the AI Act, which allow authorities to take temporary protective actions against - **Market Surveillance and Control of AI Systems** — https://overview.legal/topics/market-surveillance-control-ai This new topic is needed to comprehensively cover the specific procedures, mechanisms, and authorities involved in market surveillance and control of AI systems - **Conformity Body Notification** — https://overview.legal/topics/conformity-assessment-body-notification This new topic is needed because the content specifically addresses the application and notification procedures for conformity assessment bodies under the AI Ac --- Generated by overview.legal · https://overview.legal/topics/authority-access-rights-ai-systems · 2026-08-22