Legalithm logo
Chapter III, Section 3 — Obligations of providers and deployers of high-risk AI systems and other partiesArticle 21

Article 21: Cooperation with Competent Authorities

Applies from 2 Aug 20263 min readEUR-Lex verified Apr 2026

Article 21 requires providers of high-risk AI systems, upon a reasoned request from a national competent authority, to provide all information and documentation necessary to demonstrate conformity with Chapter III, Section 2 requirements, in an official Union language determined by the requesting authority. Providers must also cooperate with authorities on any action taken in relation to the system. This is the general cooperation backbone that supports Article 74 market surveillance and Article 79 enforcement procedures.

Start free assessmentAll articles

Who does this apply to?

  • -Providers of high-risk AI systems responding to authority requests
  • -Authorised representatives cooperating on behalf of third-country providers
  • -National competent authorities exercising their oversight powers

Scenarios

A French market surveillance authority sends a reasoned request to a provider asking for Annex IV technical documentation and test results in French.

The provider must provide the requested documentation in French within a reasonable timeframe. Non-cooperation can trigger enforcement under Article 79.
Ref. Art. 21

A provider receives simultaneous requests from authorities in three Member States after a cross-border incident.

Article 21 requires cooperation with each authority. The authorised representative (Article 22) may coordinate responses.
Ref. Art. 21 + Art. 22

What Article 21 requires (plain terms)

Upon a reasoned request from a national competent authority, the provider must:

1. Provide all information and documentation necessary to demonstrate conformity with Section 2 requirements 2. Provide it in an official Union language determined by the requesting authority 3. Grant access to automatically generated logs (to the extent under the provider's control) 4. Cooperate with the authority on any action taken regarding the AI system

This is a reactive duty (triggered by authority request), complementing the proactive duties in Article 20 (self-correction) and Article 73 (incident reporting).

How Article 21 connects to the rest of the Act

  • Article 16(j) — Cooperation is a lettered provider obligation.
  • Article 18 — Documentation that must be available for authority requests.
  • Article 19 — Logs that must be available for authority requests.
  • Article 22 — Authorised representative as the authority contact.
  • Article 74 — Market surveillance framework creating the authority powers.
  • Article 79 — Enforcement procedure where non-cooperation escalates.

Compliance checklist

  • Establish an authority request handling procedure with defined response timelines.
  • Ensure documentation can be produced in any official EU language (translation capacity).
  • Designate an internal point of contact for authority interactions.
  • If using an authorised representative: ensure they can access and forward documentation.
  • Document all authority requests and responses for audit trail.
  • Brief legal counsel when a reasoned request is received — it may signal an enforcement action.
Read the official text on EUR-Lex

Prepare for authority cooperation—free assessment.

Start Free Assessment

Frequently asked questions

Can the provider refuse a request?

Article 21 creates a legal obligation to cooperate upon reasoned request. Non-cooperation can trigger enforcement escalation under Articles 79 and 99.

Must everything be translated?

The authority determines the official Union language. Documentation must be provided in that language. Plan for translation capacity across EU languages where you operate.

What information must providers share with authorities under Article 21?

Upon a reasoned request from a market surveillance authority, providers must provide all information and documentation necessary to demonstrate conformity. This includes access to automatically generated logs, source code if legally required, and relevant technical documentation. Information must be provided in a language easily understood by the authority.