AI Corrective Powers

Legal Framework

The corrective powers governing AI systems are anchored in several provisions of the AI Act that create layered obligations — from provider-initiated corrections to authority-imposed suspensions. Article 20 imposes the primary corrective duty on providers of high-risk AI systems, requiring immediate action upon discovering non-conformity:

"Providers of high-risk AI systems which consider or have reason to consider that a high-risk AI system that they have placed on the market or put into service is not in conformity with this Regulation shall immediately take the necessary corrective actions to bring that system into conformity, to withdraw it, to disable it, or to recall it, as appropriate."
— AI Act Art. 20(1)

This obligation cascades through the supply chain: providers must inform distributors, deployers, authorised representatives, and importers. Where a system presents a risk under Article 79(1), providers must investigate causes, collaborate with reporting deployers, and notify competent market surveillance authorities and notified bodies.

Article 44 governs the certificate regime that underpins market access. Notified bodies issue conformity certificates with defined validity periods — five years for Annex I systems, four years for Annex III systems. Crucially, Article 44(3) grants notified bodies the power to suspend, withdraw, or restrict certificates:

"Where a notified body finds that an AI system no longer meets the requirements set out in Section 2, it shall, taking account of the principle of proportionality, suspend or withdraw the certificate issued or impose restrictions on it, unless compliance with those requirements is ensured by appropriate corrective action taken by the provider of the system within an appropriate deadline set by the notified body."
— AI Act Art. 44(3)

Article 73 establishes the serious incident reporting framework, which triggers corrective scrutiny. Reporting timelines escalate based on severity: 15 days generally, 10 days for fatalities, and 2 days for widespread infringements.

Key Developments

The AI Act's corrective powers framework is newly enacted and largely untested. No case law yet interprets the boundaries of provider corrective duties or notified body suspension powers. The doctrinal foundations, however, draw on well-established principles from data protection law. The Court of Justice's ruling in Schrems (C-362/14) confirmed that supervisory authorities must possess the power to bring infringements before judicial authorities — a principle now embedded in the GDPR and carried forward into the AI Act's enforcement architecture.

The EDPS has already exercised analogous corrective powers in practice. In its 2019–2020 investigation of the European Commission's Intelligent Licensing Assistant, the EDPS issued recommendations that led the Commission to modify the system — demonstrating that supervisory intervention can achieve corrective outcomes without formal suspension. The EDPB's 2024–2027 strategy further signals that coordinated enforcement across data protection and AI regulation will increasingly involve corrective measures.

Status of the Debate

This topic is regulator-defined. The corrective powers framework is established by the AI Act's literal text but has not been tested through litigation or formal enforcement decisions. The proportionality principle embedded in Article 44(3) — requiring notified bodies to balance suspension against provider corrective deadlines — will likely be the first battleground. Open questions include: what constitutes an "appropriate deadline" for provider corrective action, and when do authorities escalate from corrective deadlines to outright market withdrawal. Resolution will come through the first wave of notified body decisions and subsequent appeals under the Article 44(4) appeal procedure, combined with market surveillance authority actions under Article 79.

Practical Guidance

• Establish internal trigger mechanisms: Providers must monitor for non-conformity signals and act "immediately" under Article 20(1). Implement automated detection and escalation protocols that map to the article's four corrective options: bring into conformity, withdraw, disable, or recall.

• Maintain a supply-chain notification chain: Article 20 requires informing distributors, deployers, authorised representatives, and importers. Pre-build contact registers and notification templates to satisfy the immediacy requirement.

• Prepare for incident reporting at three temporal tiers: Under Article 73, providers face 2-day, 10-day, and 15-day deadlines depending on incident severity. Draft tiered reporting procedures with pre-cleared templates for each scenario.

• Engage proactively with notified bodies on corrective deadlines: When a notified body identifies non-compliance under Article 44(3), providers can avoid certificate suspension by proposing a credible corrective action plan within the deadline set. Document proportionality arguments early.

• Track regulatory sandbox outputs: Article 57 sandboxes, operational by August 2026, will generate practical guidance on how authorities exercise corrective powers in controlled settings. Participation can provide early insight into enforcement thresholds.