National-Level Risk Procedures for AI Systems

National-Level Risk Procedures for AI Systems

Legal Framework

The national-level risk procedure for AI systems is primarily governed by Articles 79 and 80 of the EU AI Act, read together with Article 75 on the national market surveillance framework. Article 79 establishes the core procedural mechanism: where a national market surveillance authority has sufficient reason to consider that a high-risk AI system presents a risk to health, safety, or fundamental rights despite being in conformity with the Act, it must conduct an evaluation of the system and require the relevant provider to take all appropriate corrective action within a reasonable period. The provider bears the burden of demonstrating compliance or implementing remediation. If the authority finds non-compliance, it must restrict or prohibit the system's availability on the market, withdraw or recall it, and notify the Commission and other Member States without delay.

Article 80 supplements this with the Union safeguard procedure, triggered when a Member State takes measures against a non-compliant system. The Commission must consult the provider and, where relevant, the importer or distributor, then issue a binding decision determining whether the national measure is justified. This creates a two-tier structure: national authorities act as first responders, while the Commission ensures uniformity across the internal market.

Article 81 further empowers natural or legal persons to submit complaints to competent authorities regarding suspected breaches, feeding the risk-identification pipeline.

Key Developments

The AI Act entered into force in August 2024, with enforcement phased through 2026 and 2027. No enforcement decisions under Articles 79 or 80 have yet issued, as the procedural framework becomes applicable only from August 2026 for most provisions. However, preparatory regulatory activity is already shaping expectations. The European AI Office has begun coordinating with national authorities to establish operational protocols, and several Member States are designating their market surveillance authorities under Article 75. The parallel development of GDPR enforcement by DPAs on AI-adjacent systems offers a practical preview: authorities have consistently demanded documented risk assessments, demonstrable mitigation measures, and timely cooperation as baseline expectations.

Practical Guidance

• Establish a documented internal risk-monitoring system that can trigger corrective action procedures on demand, satisfying Article 79's expectation that providers respond to authority inquiries within a reasonable period.
• Maintain real-time post-market monitoring infrastructure under Article 72, as the data generated feeds directly into the Article 79 procedure and determines whether authorities initiate formal evaluations.
• Designate a regulatory liaison function with authority to coordinate responses across multiple Member States, since Article 79 notifications propagate EU-wide and require synchronized corrective action.
• Prepare template corrective-action plans in advance, including product modification, withdrawal, and recall scenarios, so that responses to Article 79 demands can be issued immediately rather than drafted under pressure.
• Track complaints submitted under Article 81 as an early-warning indicator, since public complaints frequently precede formal authority interventions under Article 79.