Regulatory Inspection Preparation for AI: What Authorities Look For

Authority Powers Under the EU AI Act

Articles 74 through 76 of the EU AI Act grant market surveillance authorities extensive inspection powers for AI systems. Understanding these powers is essential for preparation.

• Access to the AI system, including its source code, documentation, training data, and logs (Art. 74(4))
• Request for technical documentation, test results, and conformity assessment records
• Power to require demonstrations of the AI system's functioning
• Authority to interview relevant personnel
• Power to order corrective actions, withdrawal from the market, or recall (Art. 76)
• Ability to impose administrative fines up to EUR 35 million or 7% of global turnover (Art. 99)

Common Inspection Triggers

What Authorities Examine

1. Conformity Assessment Records

Inspectors verify that conformity assessment was completed before market placement and that documentation per Annex IV is complete and current. Common deficiency: assessments completed but not updated after system modifications.

2. Risk Management System

Authorities examine the risk management process per Article 9 for completeness (all reasonably foreseeable risks identified), effectiveness (mitigation measures demonstrably reduce risk), and currency (updated based on operational experience and post-market monitoring data).

3. Data Governance

Article 10 compliance is assessed through examination of training data documentation, bias assessment records, data quality measures, and data protection safeguards. Inspectors may request evidence of data provenance and preprocessing methodology.

4. Human Oversight Implementation

Authorities verify that Article 14 human oversight measures are not merely designed but actually operational. This includes operator training records, override logs, and escalation decision documentation.

5. Incident History

All serious incidents and the organization's response are reviewed. Inspectors assess whether incidents were reported within required timescales (Art. 62), root causes were investigated, and corrective actions were implemented effectively.

Documentation Readiness Checklist

• Technical documentation per Annex IV, current and version-controlled
• Conformity assessment records including any notified body certificates
• EU Declaration of Conformity per Article 47
• Risk management records per Article 9
• Quality management system documentation per Article 17
• Post-market monitoring plan and records per Article 72
• Incident reports and corrective action records
• Automatic log records per Article 12
• Operator training records
• Data governance documentation per Article 10

Response Protocol

Upon Receiving an Inspection Notice

1. Notify legal counsel and the AI governance lead immediately
2. Assemble the inspection response team
3. Gather all documentation listed in the inspection notice
4. Brief relevant personnel on their roles and the scope of the inspection
5. Prepare a secure workspace for inspectors with access controls

During the Inspection

Cooperate fully with inspectors while protecting legitimate confidentiality interests. Article 78 permits providers to identify confidential business information and trade secrets, but this does not override the authority's right to access information needed for its assessment. Designate a single point of contact to coordinate all information requests.

Post-Inspection Actions

If the authority issues findings, respond within the prescribed timeframe. Develop a corrective action plan that addresses root causes rather than symptoms. Document all corrective actions and their verification. Failing to address inspection findings can escalate to formal enforcement proceedings under Article 76.

This article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.