EU AI Act Article 21: Cooperation With Competent Authorities

When a national competent authority sends a reasoned request, the clock starts. Article 21 of Regulation (EU) 2024/1689 obliges a provider of a high-risk AI system to hand over all the information and documentation needed to demonstrate the system's conformity — in an official language of the requesting member state — and to give access to the automatically generated logs where it controls them. This is the duty that turns your technical file from a shelf document into something an inspector can act on.

The point of Article 21 is enforceability: the whole compliance regime only works if authorities can actually see the evidence. A perfect Annex IV file you will not produce on request is, for enforcement purposes, no file at all.

Stand-alone high-risk systems are bound from 2 December 2027 under the Digital Omnibus agreed in May 2026 (Annex I product-embedded systems from 2 August 2028). That deferral is now adopted — the European Parliament passed it on 16 June 2026 and the Council on 29 June 2026 — pending only Official Journal publication, expected before 2 August 2026.

---

What a Provider Must Produce

On a reasoned request from a competent authority, the provider must:

• Provide all information and documentation necessary to demonstrate the high-risk system's conformity with the Chapter III, Section 2 requirements — in practice the Annex IV technical documentation (drawn up under Article 11), the EU Declaration of Conformity, the conformity-assessment records, and the QMS documentation;
• Provide it in a language that can be easily understood by the authority — an official EU language of the member state concerned;
• Grant access to the automatically generated logs referred to in Article 12, where those logs are under the provider's control.

"Reasoned request" matters. The authority must state why it is asking — Article 21 is not a fishing licence. But once the reasons are given, the obligation is hard-edged: produce the evidence, in the right language, within the period stated.

---

Logs: Article 12 vs Article 19

Two log duties are easy to confuse. Article 12 requires the high-risk system to be designed to automatically record events (logs) over its lifetime — the technical capability. Article 19 requires the provider to keep the logs it generates for at least six months. Article 21 is the access duty: when an authority asks, the provider must let it into the Article 12 logs it controls. Design them (Article 12), keep them (Article 19), hand them over on request (Article 21).

---

The Deployer's Cooperation Duty — Article 26(12)

Article 21 binds the provider. Deployers have their own cooperation obligation in Article 26(12): a deployer must cooperate with the relevant competent authorities on any action they take in relation to the high-risk system. Where the deployer controls the logs (it often does, once a system is in operational use), it keeps them under Article 26 for an appropriate period — at least six months — and produces them when asked. So both ends of the supply chain owe cooperation; the provider owns the conformity evidence, the deployer owns the operational record.

---

Where Article 21 Sits in Market Surveillance

Article 21 is the provider-facing trigger; the authority's powers come from Article 74 onward. Market surveillance authorities designated under the framework can require documents, carry out evaluations, and — under Article 79 — act against a system that presents a risk, including ordering corrective action, restriction, withdrawal or recall. The Article 74+ powers also reach into source code in the limited, reasoned circumstances the Regulation allows, where documentation and logs are insufficient to assess conformity. Article 21 is the everyday version of all this: most of the time, cooperation means producing the file and the logs, fast and in the right language.

---

Worked Example

Routalyze Oy (a fictional Finnish provider, ~120 employees, ~€24M turnover) supplies a high-risk AI system that ranks job applicants (Annex III point 4, employment). A market surveillance authority in another member state opens a review and sends a reasoned request.

• What it must produce: the Annex IV technical documentation, the Article 47 Declaration of Conformity, the Article 43 conformity-assessment records, and access to the Article 12 logs Routalyze controls.
• Language: the requesting authority is German — so the documentation must be supplied in German, "easily understood" by that authority, not only in Routalyze's working English.
• Logs: the deployer-employers run the system day to day and hold the operational logs; under Article 26(12) they cooperate and produce their records, while Routalyze produces the logs from the parts it controls.
• Exposure: failing to cooperate — refusing, stalling, or supplying an incomplete file — sits in the €15M or 3% tier (Article 99(4)). Supplying incorrect, incomplete or misleading information to the authority is the separate €7.5M or 1% tier (Article 99(5)) — never 1.5%. Under Article 99(6), a company Routalyze's size pays the lower of the percentage or the fixed sum.

The verdict: the German-language point and the log-access point are where real requests stall. A file that exists only in English, or logs you cannot extract on demand, fail Article 21 even if the underlying system is fully conformant.

---

How Confir Helps

Confir assembles and retains the Article 11 / Annex IV documentation and the Article 47 / Annex V Declaration of Conformity per system, with an immutable audit log, so an Article 21 request becomes a retrieval rather than a scramble. It records the role split — provider versus deployer — so each party knows which evidence and which logs it must produce. The engine is rule-based and deterministic: the documentation pack is reproducible, and every entry traces back to the rule that required it.

---

Related guides

• Provider obligations checklist (Article 16)
• Deployer obligations explained (Article 26)
• Technical documentation and Annex IV
• Article 21 cooperation in the text
• Corrective actions and recall (Article 20)