EU AI Act Article 21: A Provider's Duty to Cooperate With Competent Authorities
Article 21 EU AI Act: on a reasoned request, high-risk AI providers hand over conformity docs in an EU official language plus log access. €15M/3% fines.
A national authority sends you a letter. It states a reason — a post-market signal, a complaint, a concern about your high-risk AI system — and asks you to demonstrate that the system conforms to the law. Under Article 21 of Regulation (EU) 2024/1689 you cannot ignore it, stall it, or answer in your own preferred language. You must produce the conformity documentation and give access to the system's logs, in a language the authority easily understands.
This guide covers Article 21 strictly as the provider's affirmative duty to respond to a reasoned request: what you hand over, in which EU language, how it operationalises the authority's market-surveillance powers, and how confidentiality protects what you share.
What Article 21 Actually Requires
Article 21 imposes a single, focused obligation. On a reasoned request from a competent authority, the provider of a high-risk AI system must hand over all the information and documentation necessary to demonstrate the conformity of that system with the high-risk requirements in Articles 8 to 15 — in a language the requesting authority easily understands. Three elements are load-bearing: the trigger is the reasoned request (no request, no duty); the deliverable is conformity documentation plus access to the automatically generated logs under Article 12; the form is an official language of the Union designated by the Member State concerned.
Keep the scope narrow. Article 21 is a duty to respond and produce. It is not the authority's own investigation powers — those live in the market-surveillance provisions at Article 74 and Regulation (EU) 2019/1020 — nor the importer's pre-market verification under Article 23, a different actor's check at a different moment. Article 21 is the provider, after the fact, answering a question formally put to it.
This is a continuing obligation: it attaches to provider status under Article 16 and does not lapse once the system is on the market. A reasoned request can land years into a system's life.
Who Must Cooperate, and Who Is a Competent Authority
The duty sits on the provider of a high-risk AI system — the entity that develops the system, or has it developed, and places it on the market or puts it into service under its own name or trademark.
Where the provider is established outside the EU, the request runs through the Article 22 authorised representative, who answers reasoned requests and provides the conformity documentation and log access on the provider's behalf, acting as the EU-based contact point for the authority.
A competent authority here means the national competent authorities designated by Member States, including the market surveillance authorities that police the AI Act at national level. This guide does not re-explain their full powers — see what a market surveillance authority is and can do.
What "reasoned request" means in practice
The word reasoned is doing real work. The authority must state a reason — the basis on which the information is sought — and that reason bounds the request: you respond to the basis given, not to an open-ended fishing expedition. A request tied to a specific accuracy concern does not licence a demand for your entire commercial history.
Keep the honest-scope point in view. Most general-purpose business AI is not high-risk. Article 21 bites only when a provider has placed a high-risk system on the market — one caught by Annex III, or embedded in an Annex I regulated product. If your system is neither, Article 21 does not reach you.
What You Must Hand Over: Documentation and Log Access
Cooperation under Article 21 has two limbs: the documentary record and the operational evidence. The documentary set centres on material that demonstrates conformity: the Article 11 technical documentation — the Annex IV package — together with the records that evidence Articles 8 to 15: risk management, data governance, accuracy, robustness and cybersecurity, human oversight, transparency, and record-keeping. The point is to let the authority assess, on paper, whether the system meets the high-risk requirements.
The second limb is access to the automatically generated logs referred to in Article 12, to the extent those logs are under the provider's control. Logs let an authority reconstruct how the system behaved over its lifetime, not merely what its documentation claims. State the caveat plainly: log access is owed only where the logs are under the provider's control. Logs generated and held by a deployer fall under the deployer's own retention duties (Article 19, Article 26), not Article 21 — a provider cannot be ordered to produce logs it never held.
| Deliverable | Grounding article | Plain-language description |
|---|---|---|
| Technical documentation | Article 11 / Annex IV | The structured file describing the system, its development, data governance, and risk records |
| Conformity evidence for the high-risk requirements | Articles 8 to 15 | Records showing risk management, data governance, accuracy, oversight and transparency are met |
| Automatically generated logs (where under provider control) | Article 12 | Lifetime event records that let an authority reconstruct system behaviour |
| Language of the response | Article 21 | An EU official language easily understood by the requesting authority |
| Channel for non-EU providers | Article 22 | The authorised representative answers on the provider's behalf |
| Underlying status that anchors the duty | Article 16 | Provider obligations — the stack Article 21 cooperation supports |
The Language and Format Point
Article 21 specifies that the response must be in a language that can be easily understood by the requesting authority — in practice, an official language of the Union designated by the Member State concerned. English is not a safe default if the authority works in another language.
The practical consequence is planning. A provider operating across several Member States may need to produce conformity documentation in more than one EU official language, and should build translation lead time into its response capability before a request lands. A reasoned request carries a deadline; discovering that the Annex IV file exists only in English, with a four-week translation queue, turns a retrieval task into a missed one.
The documentation must also be intelligible and usable for assessing conformity — not a raw data dump. Keeping the Annex IV file maintained and current, rather than reconstructed after a request arrives, is the difference between a clean response and a scramble.
How Article 21 Connects to Market-Surveillance Powers (Article 74)
Article 21 is the provider-side mirror of the authority's powers. Article 74 confers on market surveillance authorities the powers of Regulation (EU) 2019/1020 over AI systems; Article 21 is the duty that makes those powers operable.
The enforcement arc usually runs as follows. A reasoned request under Article 21 is often the first formal step — the authority asks you to demonstrate conformity. If you do, the matter may close. If conformity is not demonstrated, the authority can escalate to the corrective and restrictive measures available under the market-surveillance framework: corrective action, restricting availability, or withdrawing the system from the market.
The trigger frequently comes from elsewhere in your own obligation stack. Information surfaced through Article 72 post-market monitoring and Article 73 serious-incident reporting can prompt or shape a reasoned request — a serious incident you report can be the very signal that leads an authority to ask you to demonstrate conformity. Your cooperation file should align with those duties.
Confidentiality Protection for What You Share (Article 78)
Disclosure is not forfeiture. Article 78 obliges competent authorities — and other parties involved in applying the Regulation — to respect the confidentiality of information and data obtained in carrying out their tasks, expressly including intellectual property rights, trade secrets, and source code, subject to limited exceptions.
The practical reassurance for providers: cooperating under Article 21 does not mean handing your trade secrets to competitors or to the public. The Regulation builds in a confidentiality regime for material given to authorities — you can share what conformity assessment requires while the sensitive core stays protected. State the boundary honestly, though: the protections are subject to defined limits — for example, where disclosure is necessary to protect public security or fundamental rights, or where it is required by Union or national law. Article 78 is a strong shield, not an absolute one.
The drafting takeaway: mark sensitive material as confidential and understand the Article 78 regime before a request arrives, but do not treat confidentiality as a refusal mechanism. You cannot invoke trade-secret protection to decline a lawful reasoned request — only to constrain how the material is then handled.
Worked Example: Responding to a Reasoned Request
Lumenra Diagnostics is a 90-person, EU-established provider of medical-imaging software. Its AI triage tool flags suspected findings on chest scans and is embedded in a medical device regulated under the Medical Devices Regulation (Regulation (EU) 2017/745). Because the system sits in an Annex I Section A product, its conformity assessment is routed through the sectoral act under Article 43(3) — Lumenra does not apply Articles 8 to 15 directly as if the system were stand-alone Annex III.
A national market surveillance authority issues a reasoned request, citing a post-market signal — a cluster of flagged false negatives surfaced through Lumenra's own monitoring. Lumenra walks the response:
- It assembles the Article 11 / Annex IV technical documentation and the conformity evidence drawn from the medical-device route.
- It exports the relevant Article 12 logs under its control, letting the authority reconstruct how the triage tool behaved.
- The requesting Member State's official language is not English, so Lumenra produces a translated package within the stated window — lead time it had already planned for.
- It flags its proprietary model details and source code as confidential, relying on Article 78, so those details do not enter the public domain.
Because Lumenra had maintained a current, deterministic compliance record rather than reconstructing one, the request was a retrieval exercise, not a fire drill. The authority reviewed the package, confirmed the corrective steps underway, and closed the matter.
Penalties and Where Article 21 Sits in the Provider Stack
Failure to comply with provider obligations, including the duty to cooperate, falls under Article 99(4): fines up to €15 million or 3% of total worldwide annual turnover, whichever is higher.
Supplying incorrect, incomplete, or misleading information to authorities in reply to a request sits in the lower tier under Article 99(5): up to €7.5 million or 1% of total worldwide annual turnover, whichever is higher.
For SMEs and start-ups, Article 99(6) caps the fine at the lower of the fixed amount and the percentage, a genuine proportionality protection. The penalty framework has been applicable since 2 August 2025 — the enforcement machinery is already live.
A timeline caveat applies to the obligations this duty backstops. High-risk obligations for stand-alone Annex III systems originally carried a statutory application date of 2 August 2026. The Digital Omnibus — adopted by the European Parliament on 16 June 2026 and by the Council on 29 June 2026 — defers that date to 2 December 2027, pending Official Journal publication as a formality. Plan against 2 December 2027.
Map Article 21 to its neighbours. It is the cooperation node on the Article 16 provider obligation stack — the duty that makes the rest of the stack auditable. It is mirrored by Article 22 for non-EU providers and sits alongside Article 23, the importer's pre-market verification.
How Confir Helps
Confir keeps your conformity record assembled before a reasoned request ever arrives. When you answer Confir's intake questions, the platform maps your system against the high-risk requirements and records the Annex IV documentation, the conformity evidence, and the cross-references to Articles 8 to 15 as a structured, timestamped file. The synthesis engine is deterministic and rule-based — no model inference, no hallucination — so the same intake produces the same finding.
If a reasoned request lands, responding under Article 21 becomes a retrieval task: the documentation is current, the article mapping explicit, and the file can be exported for translation rather than reconstructed under deadline.
Related guides
- the full Article 16 provider obligation stack
- importer verification duties under Article 23
- what a market surveillance authority is and can do
- post-market monitoring obligations (Article 72)
- serious-incident reporting (Article 73)
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →