AI Act, Article 21(1) and (3) (provider's information and documentation to a competent authority on a reasoned request, and confidentiality)

Upon a reasoned request by a competent authority, a provider of a high-risk AI system must provide that authority all the information and documentation necessary to demonstrate the conformity of the system with the requirements set out in Section 2. The provider must give that information and documentation in a language which can be easily understood by the authority, in one of the official languages of the institutions of the Union as indicated by the Member State concerned.

Any information obtained by a competent authority pursuant to Article 21 must be treated in accordance with the confidentiality obligations set out in Article 78. Article 16, point (k), separately lists as an obligation of the provider that it demonstrate, upon a reasoned request of a national competent authority, the conformity of the high-risk AI system with the requirements set out in Section 2.

Article 21(2) separately requires the provider itself, upon a reasoned request by a competent authority, to give that authority access to the automatically generated logs of the high-risk AI system referred to in Article 12(1), to the extent such logs are under its control. Article 21 sits in Chapter III, Section 3, which is headed Obligations of providers and deployers of high-risk AI systems and other parties.

Under Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744, Chapter III, Sections 1, 2 and 3, with the exception of Article 6(5), apply from 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for a system classified as high-risk under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030.

For an AI system classified as high-risk under Article 6(1) and related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, Article 2(2), as replaced by Regulation (EU) 2026/1744, applies only Article 6(1), Article 60a and Articles 102 to 112, and applies Articles 57, 58 and 59 only in so far as the requirements for high-risk AI systems under the Regulation have been integrated in that Union harmonisation legislation.

Article 99(6a), inserted by Regulation (EU) 2026/1744, provides that in the case of small mid-cap enterprises each fine referred to in paragraphs 4 and 5 of Article 99 is up to the percentages or amount referred to there, whichever is lower.

Under Article 2(13), inserted by Regulation (EU) 2026/1744, the application of specific requirements or obligations laid down in Articles 9 to 15 and 17 to 25 to a high-risk AI system referred to in Article 6(1) may be limited where and to the extent that Union harmonisation legislation listed in Section A of Annex I lays down requirements or obligations providing an equivalent or higher level of protection of health, safety or fundamental rights, and the limitation does not reduce the overall level of protection provided for by the Regulation.

By 2 August 2027, the Commission is to adopt delegated acts under Article 97 specifying the high-risk AI systems concerned, the requirements or obligations that may be limited, the conditions under which the limitation applies, and the scope of the limitation.