# AI Corrective Powers — legal context bundle > Curated from overview.legal on 2026-08-22. Canonical page: https://overview.legal/topics/authority-intervention-corrective-powers-ai > Sources are cited per item. Verify against the official texts before relying on them. This new topic is needed to specifically address the corrective and intervention powers that authorities possess to protect fundamental rights, including emergency measures, system suspensions, and market restrictions that go beyond standard inspection and monitoring activities. ## Overview ## Legal Framework Article 20 of the AI Act mandates that Member States equip market surveillance authorities with robust corrective powers to address non-compliant AI systems. Recital 159 elaborates that authorities overseeing high-risk AI applications in biometrics, law enforcement, migration, and justice must possess effective investigative and corrective powers. These powers include the authority to access all processed personal data and any information necessary for the authority to perform its tasks. The independence of these supervisory bodies, grounded in Article 16(2) TFEU and Article 39 TEU, guarantees the reliability and effectiveness of oversight. Furthermore, authorities must possess the statutory competence to bring infringements before judicial bodies and initiate legal proceedings. This ensures that when standard monitoring identifies a violation, the authority can escalate the matter to the judiciary, bridging the gap between administrative oversight and judicial enforcement. ## Key Developments The CJEU ruling in Schrems (C-362/14) established a critical precedent that supervisory authorities must possess the power to initiate judicial proceedings against infringements of data protection laws. This judicial referral requirement necessitates that AI oversight bodies are not merely advisory but possess the structural capacity to enforce fundamental rights through emergency interventions, system suspensions, and market restrictions. Historically, certain national data protection authorities lacked explicit statutory powers to bring cases before the courts, a deficiency that required legislative correction following the Schrems decision. This evolution demonstrates that EU law demands authorities be fully empowered to act decisively. Consequently, when AI systems pose systemic risks to fundamental rights, authorities can bypass standard administrative procedures and directly implement restrictive measures or seek immediate judicial intervention to halt harmful processing. ## Practical Guidance - Maintain comprehensive logs of all personal data processed by AI systems and ensure immediate accessibility for authorities, fulfilling the access requirements mandated by Recital 159 of the AI Act. - Develop internal protocols for rapid compliance with emergency suspension orders, as market surveillance authorities can impose immediate restrictions on system deployment without prior negotiation. - Conduct periodic risk assessments specifically targeting high-risk AI applications, such as biometric identification and law enforcement tools, to mitigate the likelihood of forced corrective interventions. - Designate a legal liaison to manage communications with market surveillance authorities, ensuring timely responses to information requests and facilitating any necessary judicial proceedings initiated by the authority. - Ensure that AI system architecture includes built-in suspension mechanisms or kill switches to comply with potential authority-mandated shutdowns and market withdrawals. ## Legislation (full text of key provisions) ### Recital 164 — AI Office monitoring and enforcement powers *Source: AI Act, aiact-rec-164-en, 2024-06-12 — https://overview.legal/posts/94010* The AI Office should be able to take the necessary actions to monitor the effective implementation of and compliance with the obligations for providers of general-purpose AI models laid down in this Regulation. The AI Office should be able to investigate possible infringements in accordance with the powers provided for in this Regulation, including by requesting documentation and information, by conducting evaluations, as well as by requesting measures from providers of general-purpose AI models. When conducting evaluations, in order to make use of independent expertise, the AI Office should be able to involve independent experts to carry out the evaluations on its behalf. Compliance with the obligations should be enforceable, inter alia, through requests to take appropriate measures, including risk mitigation measures in the case of identified systemic risks as well as restricting the making available on the market, withdrawing or recalling the model. As a safeguard, where needed beyond the procedural rights provided for in this Regulation, providers of general-purpose AI models should have the procedural rights provided for in Article 18 of Regulation (EU) 2019/1020, which should apply mutatis mutandis, without prejudice to more specific procedural rights provided for by this Regulation. ### Recital 66 — risk management requirements for high-risk AI *Source: AI Act, aiact-rec-66-en, 2024-06-12 — https://overview.legal/posts/93814* Requirements should apply to high-risk AI systems as regards risk management, the quality and relevance of data sets used, technical documentation and record-keeping, transparency and the provision of information to deployers, human oversight, and robustness, accuracy and cybersecurity. Those requirements are necessary to effectively mitigate the risks for health, safety and fundamental rights. As no other less trade restrictive measures are reasonably available those requirements are not unjustified restrictions to trade. ### Recital 159 — biometric AI surveillance authority powers *Source: AI Act, aiact-rec-159-en, 2024-06-12 — https://overview.legal/posts/94000* Each market surveillance authority for high-risk AI systems in the area of biometrics, as listed in an annex to this Regulation insofar as those systems are used for the purposes of law enforcement, migration, asylum and border control management, or the administration of justice and democratic processes, should have effective investigative and corrective powers, including at least the power to obtain access to all personal data that are being processed and to all information necessary for the performance of its tasks. The market surveillance authorities should be able to exercise their powers by acting with complete independence. Any limitations of their access to sensitive operational data under this Regulation should be without prejudice to the powers conferred to them by Directive (EU) 2016/680. No exclusion on disclosing data to national data protection authorities under this Regulation should affect the current or future powers of those authorities beyond the scope of this Regulation. ### Recital 156 — market surveillance and compliance enforcement framework *Source: AI Act, aiact-rec-156-en, 2024-06-12 — https://overview.legal/posts/93994* In order to ensure an appropriate and effective enforcement of the requirements and obligations set out by this Regulation, which is Union harmonisation legislation, the system of market surveillance and compliance of products established by Regulation (EU) 2019/1020 should apply in its entirety. Market surveillance authorities designated pursuant to this Regulation should have all enforcement powers laid down in this Regulation and in Regulation (EU) 2019/1020 and should exercise their powers and carry out their duties independently, impartially and without bias. Although the majority of AI systems are not subject to specific requirements and obligations under this Regulation, market surveillance authorities may take measures in relation to all AI systems when they present a risk in accordance with this Regulation. Due to the specific nature of Union institutions, agencies and bodies falling within the scope of this Regulation, it is appropriate to designate the European Data Protection Supervisor as a competent market surveillance authority for them. This should be without prejudice to the designation of national competent authorities by the Member States. Market surveillance activities should not affect the ability of the supervised entities to carry out their tasks independently, when such independence is required by Union law. ### Recital 155 — high-risk AI post-market monitoring systems *Source: AI Act, aiact-rec-155-en, 2024-06-12 — https://overview.legal/posts/93992* In order to ensure that providers of high-risk AI systems can take into account the experience on the use of high-risk AI systems for improving their systems and the design and development process or can take any possible corrective action in a timely manner, all providers should have a post-market monitoring system in place. Where relevant, post-market monitoring should include an analysis of the interaction with other AI systems including other devices and software. Post-market monitoring should not cover sensitive operational data of deployers which are law enforcement authorities. This system is also key to ensure that the possible risks emerging from AI systems which continue to ‘learn’ after being placed on the market or put into service can be more efficiently and timely addressed. In this context, providers should also be required to have a system in place to report to the relevant authorities any serious incidents resulting from the use of their AI systems, meaning incident or malfunctioning leading to death or serious damage to health, serious and irreversible disruption of the management and operation of critical infrastructure, infringements of obligations under Union law intended to protect fundamental rights or serious damage to property or the environment. ## Guidance ### EDPB Strategy 2024-2027 *Source: EDPB, edpb-strategy-2024-2027-en, 2024-04-18 — https://overview.legal/posts/125760 — original: https://www.edpb.europa.eu/documents/reports-statements-and-letters/edpb-strategy-2024-2027_en* The mission and legal task of the European Data Protection Board (EDPB) is to ensure the consistent application of EU data protection rules and to promote effective cooperation among data protection authorities throughout the European Economic Area (EEA). Since their entries into application in 2018, the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED) have strengthened, modernised and harmonised data protection across the European Economic Area (EEA). Awareness… ### Report of the work undertaken by the ChatGPT Taskforce *Source: EDPB, report-of-the-work-undertaken-by-the-chatgpt-taskforce-en, 2024-05-24 — https://overview.legal/posts/125752 — original: https://www.edpb.europa.eu/documents/task-force-report/report-of-the-work-undertaken-by-the-chatgpt-taskforce_en* Report of the work undertaken by the ChatGPT Taskforce 23 May 2024 Final 2 Final 3 D ISCLAIMER The positions presented in this document result from the coordination of the members of the ChatGPT taskforce with a view to handling investigations regarding the service ChatGPT provided by the US based company OpenAI OpCo, LLC . They reflect the common denominator agreed by the S upervisory A uthorities in their interpretation of the applicable provisions of the GDPR in relation to the matters that… ### Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (LED) under Article 62 *Source: EDPB, contribution-of-the-edpb-to-the-european-commissions-en, 2021-12-14 — https://overview.legal/posts/125973 — original: https://www.edpb.europa.eu/documents/reports-statements-and-letters/contribution-of-the-edpb-to-the-european-commissions_en* Adopted Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive ( LED ) under Article 62 Adopted on 14 December 2021 2 3 The European Data Protection Board Having regard to Articles 51(1)(a)(b) and (h) of the Directive ( EU ) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal da ta by competent authorities for the purposes of the… ## Enforcement decisions ### EDPS finds Commission infringed purpose limitation and data transfer rules in Microsoft *Source: EDPS, 2024-03-08 — https://overview.legal/posts/125645 — original: https://gdprhub.eu/index.php?title=EDPS_-_2021-0518* Facts — Following an investigation in 2019-2020, the EDPS issued recommendations and the Commission modified the ILA. The EDPS investigated whether these modifications were sufficient to bring processing in compliance with data protection requirements and found infringements. Data accessed by Microsoft include identity and contact data of users (when signing on to the service and when checking the licenses), data generated by the users while using the software and data generated by Microsoft based on the usage of the software. The EDPS found that the processing presents significant risks as it monitors the behaviour of users, combines datasets and uses artificial intelligence. Reference date is the 12th May 2021, the date when the investigation was launched. Some measures were taken meanwhile by the Commission, which were taken into account in the recommendations issued. Holding — The EDPS found infringements with regards to purpose limitation, transfers to a third country and further, unathorised disclosure of personal data. Purpose limitation: The EDPS found that it was not sufficiently defined in the International License Agreement (ILA) which types of personal data are to be processed for which purposes. Instead, there was only a list of purposes stating that Microsoft uses these data for: troubleshooting billing remunerating Microsoft staff, internal reporting and business modelling, financial reporting following the use of the system for own reasons (analytics) to improve the service security risk management protection of intellectual property These stated purposes were considered to be too vague and general pursuant to the Art 29 WP. The Commission and Microsoft could not demonstrate that all these data were necessary and that a less intrusive collection of data would be insufficient to achieve the purposes cited. In addition, some of these purposes were actually not in the interest of the Commission but for purposes of individual to Microsoft (like remuneration of their personnel). In this case, the processor acts as controller; thus, these purposes and the data used for this purposes should have been precisely defined. Also, if data were used for purposes other than for which they were collected, the compatibility of these new purposes with the original ones should have been assessed. As a processor, Microsoft should have processed the personal data on documented instructions by the Commission. This was not ensured as the Commission did not issue sufficiently clear documented instructions to Microsoft. For example, though the Commission gave instructions for analytics and improvement of the service, these instructions were not sufficiently detailed and precise and did not exclusively concern uses of data for the purposes of the controller. Some instructions were given orally, but this was not enabled by the ILA and the oral instructions were not documented. The Commission did not assess whether it is necessary and proportionate to transmit data to Microsoft Ireland and its sub-processors. Further details of this infringement are given under the part on further unauthorised disclosure or personal data. Transfer to third countries : The Commission transferred personal data to Microsoft, a company established in the US. This raises questions about adequacy for such transfers to a third country. After the reference date, the Commission adopted the Transatlantic Data Privacy Framework (TDPF), which is an adequacy decision in respect of recipients in the US who register under this framework. The EDPS found that even when the software and data storage is property of Microsoft, it is directly transferred to these subcontractors and cannot therefore be covered by the TDPF to Microsoft US and onward transfer from Microsoft US to other subcontractors under SCCs. The EDPS found that in was not clearly specified in the ILA what types of personal data can be transferred to which recipients in which third country. The Commission also did not appraise the transfers and therefore could not determine whether any supplementary measures are necessary. In addition, the Commission should have performed a data transfer impact assessment and (as there are no SCCs applicable by EUIs as exporters) should have submitted the DPAs with these processors or subprocessors in third countries to the EDPS for approval. Because it failed to do this, the Commission did not implement effective supplementary measures for these transfers. Another issue was that the “EU storage guarantee” offered by Microsoft did not cover all types of data. Some data may be accessible to recipients in third countries. The “EU Data Boundary” also has numerous exceptions and exclusions which cover customer data, service generated data, diagnostic data and professional services data. Further unauthorised disclosure or personal data: A specific reference was made to Article 9 Regulation (EU) 2018/1725, which concerns transmission of personal data by EU institutions to recipients established in the EU. According to the EDPS, this article is also applicable to transmission of personal data to processors of EUIs. Therefore all transmission of personal data should be in the public interest and if the data subject’s legitimate interests may be prejudiced, the controller has to weigh the competing interests and establish that it is proportionate to transmit the personal data. The purpose of management and functioning of the Commission, use of products the staff is familiar with etc. was not found to be the purpose of processing of the personal data by MS. As long as the purposes are not specified, specific and explicit, it is not possible to do this balancing. In addition, the EDPS found that the Commission did not ensure that transfers take place “solely to allow tasks within the competence of the controller to be carried out”. The EDPS determined that organisational and contractual measures to restrict/prevent access of third country authorities were not sufficient, and that further technical measures are thus necessary. The EDPS also found that the organisational measures applied are only limiting transfers but does not ensure that transfers are protected. Further, the encryption is only found to be an adequate measure if the controller is in control of the encryption key. In this case, customers control the keys, but Microsoft has access to the encryption key, and thus, even when law does not oblige it to decrypt the data on an authority request, it may do it voluntarily. Also, the ILA does not detail encryption of data other than “customer data”, i.e. diagnostic data, service generated data or professional services data. The contract also enabled the processor not to notify the Commission about a request of disclosure also when EU or Member State law did not prohibit this notification and enabled recipients in third countries not to notify requests for disclosure also when the law prohibiting it did not constitute a necessary and proportionate measure in a democratic society respecting the essence of the fundamental rights and freedoms recognised by the Charter. ## Literature ### The Path of Formulating the Basic Law of Artificial Intelligence in China — Analysis of the Desirability of the EU Artificial Intelligence Act *Source: Studies in Law and Justice, 2023-09-01 — https://overview.legal/posts/132567 — original: https://doi.org/10.56397/slj.2023.09.09* The European Commission released the proposed Regulation on Artificial Intelligence (the EU AI Act) on 21 April 2021, which reflects the EU’s leadership orientation in establishing norms and standards in emerging fields, and also reflects the urgent need for legal unity of the EU as a unified market entity. The Act sets out harmonized rules for the development, placing on the market, and use of AI in the European Union. The ideas of a risk-based approach and experimental governance are of great ### Training national judges for digital competition law: the DMA, private enforcement, and the infrastructure of judicial capacity *Source: Journal of European Competition Law & Practice, 2026-05-27 — https://overview.legal/posts/53835 — original: https://doi.org/10.1093/jeclap/lpag040* The EU has adopted a dense digitalization ‘acquis’, including the Digital Markets Act (DMA), the Digital Services Act (DSA), Data Act, and Artificial Intelligence (AI) Act. Yet these regimes also create a ‘judicial’ order.1 National courts review National Competition Authorities' (NCAs) decisions, hear injunction and damages actions, manage disclosure and confidentiality, apply the principles of equivalence and effectiveness, and decide whether to refer questions to the Court of Justice. In digi ## Related topics - **Artificial Intelligence** — https://overview.legal/topics/ai AI systems and their implications for data protection - **AI Act Formal Non-Compliance** — https://overview.legal/topics/formal-non-compliance-ai-act This topic is needed to specifically address formal non-compliance under the AI Act, covering the determination, notification, and enforcement procedures specif - **Monitoring Actions under AI Act** — https://overview.legal/topics/monitoring-actions-ai-act The content specifically addresses 'Monitoring actions' as a distinct topic under the AI Act, which encompasses systematic oversight procedures, compliance veri - **Authority Powers for Fundamental Rights Protection** — https://overview.legal/topics/authority-powers-fundamental-rights-protection This new topic is needed because the content specifically addresses the powers and authorities granted to competent authorities to protect fundamental rights in - **Post-Market Monitoring for AI Systems** — https://overview.legal/topics/post-market-monitoring-ai Risk management systems require ongoing post-market monitoring to identify and respond to risks that emerge during real-world deployment. This is a distinct and - **Risk Management System** — https://overview.legal/topics/risk-management-system This new topic is needed because risk management systems are a distinct and mandatory requirement under the AI Act, encompassing systematic processes for identi --- Generated by overview.legal · https://overview.legal/topics/authority-intervention-corrective-powers-ai · 2026-08-22