AI Act, Articles 74(12) and (13) and 77 (market surveillance access to documentation, data sets and source code, and the access of authorities protecting fundamental rights)

Where relevant and limited to what is necessary to fulfil their tasks, and without prejudice to the powers under Regulation (EU) 2019/1020, market surveillance authorities must be granted full access by providers to the documentation and to the training, validation and testing data sets used for the development of high-risk AI systems, including, where appropriate and subject to security safeguards, through application programming interfaces or other technical means enabling remote access.

Market surveillance authorities must be granted access to the source code of a high-risk AI system upon a reasoned request, and only when access to the source code is necessary to assess the system's conformity with the requirements of Chapter III, Section 2 and testing or auditing procedures and verifications based on the data and documentation the provider supplied have been exhausted or proved insufficient.

Any information or documentation a market surveillance authority obtains under Article 74 is treated in accordance with the confidentiality obligations of Article 78.

Under Article 77(1), as replaced by Regulation (EU) 2026/1744, national public authorities or bodies that supervise or enforce the respect of obligations under Union law protecting fundamental rights, including the right to non-discrimination, have the power to request and access from the relevant market surveillance authority any information or documentation created or maintained pursuant to the Regulation, in accessible language and machine-readable format by electronic means, where access is necessary for effectively fulfilling their mandates within the limits of their jurisdiction.

Under Article 77(1a), inserted by Regulation (EU) 2026/1744, the market surveillance authority must grant the public authority or body referred to in Article 77(1) access to such information or documentation, including by requesting it from the provider or the deployer, where necessary and without undue delay.

Where the documentation is insufficient to ascertain whether an infringement of obligations under Union law protecting fundamental rights has occurred, the public authority or body referred to in Article 77(1) may make a reasoned request to the market surveillance authority to organise testing of the high-risk AI system through technical means, which the market surveillance authority must organise with the close involvement of the requesting authority or body within a reasonable time.

Article 74(12) and (13) and Article 77 concern high-risk AI systems, and the Digital Omnibus on AI (Regulation (EU) 2026/1744) moved Chapter III, Sections 1 to 3, which hold the Article 6 rules that classify a system as high-risk, to 2 December 2027 for a system classified under Article 6(2) and Annex III and to 2 August 2028 for one classified under Article 6(1) and Annex I. The Omnibus also rewrote Article 111(2) so that the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly, and the providers and deployers of a system intended for use by public authorities must take the necessary steps to comply by 2 August 2030.

Article 74(12) and (13) and Article 77 do not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Articles 74 and 77 sit in Chapter IX, to which Article 113 gives no date of its own, so they apply to the authorities from the Regulation's general application date of 2 August 2026.