European UnionAI Act, Article 20 (corrective actions and duty of information)
Regulation (EU) 2024/1689, Article 20
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting, Place of effect
- Obligation class
- Reporting, Disclosure
- Audit expectation
- none
As of .
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- If you are the provider of a high-risk AI system and consider, or have reason to consider, that a system you have placed on the market or put into service is not in conformity with the Regulation, immediately take the necessary corrective actions to bring it into conformity, withdraw it, disable it or recall it, as appropriate.NIST AI RMFMANAGE 2.4
- Inform the distributors of the system and, where applicable, its deployers, your authorised representative and importers accordingly.NIST AI RMFMANAGE 4.3
- Where the system presents a risk to the health or safety, or to fundamental rights, of persons within the meaning of Article 79(1) and you become aware of that risk, immediately investigate the causes, in collaboration with the reporting deployer where applicable, and inform the market surveillance authorities competent for the system and, where applicable, the notified body that issued its certificate under Article 44, in particular of the nature of the non-compliance and of any relevant corrective action taken.NIST AI RMFMANAGE 4.3NIST AI RMFMANAGE 2.3
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST AI RMF
- MANAGE 2.3Procedures are followed to respond to and recover from a previously unknown risk when it is identified.
- MANAGE 2.4Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.
- MANAGE 4.3Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented.
- NIST AI 600-1
- GAI-RISK-09Information Security
- MIT mitigations Draft
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.2.2-5AI-specific incident management and recovery plans that are created, tested and maintained.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Private right of actionNo
Penalty structure
Article 99(4)(a): non-compliance with the obligations of providers under Article 16 is fined up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. Article 16, point (j), requires a provider to take the necessary corrective actions and provide information as required in Article 20, the duty this row states; Article 99(6) requires the lower of the two amounts for an SME, including a start-up; Article 99(6a), inserted by Regulation (EU) 2026/1744, gives the same lower-of treatment to a small mid-cap enterprise, since both apply to paragraph 4 fines.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 3
Who enforces it
Settledness
- As of
- Open questions
- What makes a provider 'have reason to consider' under Article 20(1) that a high-risk AI system it has placed on the market is not in conformity, so that the duty to take corrective action immediately is triggered?
What it makes you log
Logging duty
Article 20 requires corrective action and notices to the supply chain and, where the system presents a risk, an investigation and a notice to the market surveillance authorities. It states no duty to create, keep or later produce a log or record of those steps; a provider's documentation duties are Articles 11, 17(1), point (k), and 18.
- Kind
- None
- As of
What this law does
A provider of a high-risk AI system that considers, or has reason to consider, that a system it has placed on the market or put into service is not in conformity with the Regulation must immediately take the necessary corrective actions to bring it into conformity, withdraw it, disable it or recall it, as appropriate. The provider must inform the distributors of the system and, where applicable, its deployers, the authorised representative and importers accordingly.
Where a high-risk AI system presents a risk within the meaning of Article 79(1) and its provider becomes aware of that risk, the provider must immediately investigate the causes, in collaboration with the reporting deployer where applicable, and inform the market surveillance authorities competent for the system and, where applicable, the notified body that issued a certificate for it under Article 44, in particular of the nature of the non-compliance and of any relevant corrective action taken.
Article 79(1) treats an AI system presenting a risk as a product presenting a risk under Regulation (EU) 2019/1020, in so far as it presents risks to the health or safety, or to fundamental rights, of persons.
Article 20 sits in Chapter III, Section 3, so like Article 12 it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) wrote into Article 113: for a system classified as high-risk under Article 6(2) and Annex III, and for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general application date.
Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by .
Article 20 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes biometric data.