Monitoring Actions under AI Act

Legal Framework

Monitoring actions under the AI Act are governed by three interlocking provisions. Article 89 AI Act establishes the core monitoring framework, empowering authorities to conduct systematic oversight of AI systems on the market. Article 20 AI Act addresses corrective actions and the duty of information, requiring providers to take remedial measures when non-compliance is identified and to inform competent authorities accordingly. Article 72 AI Act imposes post-market monitoring obligations specifically on providers of high-risk AI systems, mandating a documented post-market monitoring plan that tracks system performance throughout its lifecycle.

The doctrinal commentary underscores that Article 16(3) requires an independent authority to oversee compliance—a requirement anchored in Article 16(2) TFEU and Article 39 TEU. The independence guarantee ensures the effectiveness and reliability of supervisory oversight over AI systems. Member States must also provide in national law for the supervisory authority's power to bring infringements before judicial authorities and initiate judicial proceedings. This obligation is not novel: the CJEU confirmed in Schrems (C-362/14, 6 October 2015) that such a power existed even under the Privacy Directive 1995, and it carries forward into the AI Act's enforcement architecture.

Key Developments

The Schrems ruling established a critical enforcement principle: supervisory authorities must possess genuine judicial referral powers, not merely administrative sanctioning authority. National implementations that fail to grant this competence are deficient. The Dutch experience illustrates the gap—the data protection authority historically lacked explicit judicial referral authority under the Wbp, prompting legislative amendment to align with the Schrems standard.

The CJEU's settled case law on institutional independence sets a demanding threshold: monitoring authorities must be structurally insulated from external influence, whether political, economic, or operational. This means that national authorities designated under the AI Act cannot be subordinate to government ministries or industry stakeholders in their decision-making on compliance. The independence requirement directly shapes how Member States must configure their AI market surveillance authorities when transposing the regulation.

Practical Guidance

• Establish a post-market monitoring plan for every high-risk AI system before market placement, as required by Article 72, documenting performance metrics, incident detection mechanisms, and corrective action triggers throughout the system's lifecycle.
• Implement corrective action procedures consistent with Article 20, including defined timelines for remediation and a clear duty-of-information protocol specifying which authorities must be notified when non-compliance is identified.
• Verify that the designated national authority possesses judicial referral powers in national implementing legislation—relying solely on administrative enforcement risks falling short of the standard articulated in Schrems.
• Ensure the monitoring authority's structural independence by confirming that appointments, budget, and decision-making processes are insulated from external interference, as required by Article 16(3) and CJEU jurisprudence on supervisory independence.
• Document compliance verification processes to a standard that withstands judicial scrutiny, maintaining records that demonstrate both technical conformity and fundamental rights impact assessment, given that monitoring actions may ultimately be adjudicated before national courts.