The EU AI Act has entered a more operational phase.
On 20 October 2026, the European Commission published a dedicated request channel that enables national authorities responsible for protecting fundamental rights to seek information and documentation from the European AI Office when it acts as the market-surveillance authority for an AI system.
This may look like a procedural update. For organizations building, providing or deploying AI in Europe, it carries a larger message: governance claims must be supported by evidence that can be located, reviewed and released when an authority asks for it.
The Commission has now specified where a request goes, what the requesting authority must explain and how the AI Office will process it.
The age of the AI policy PDF is ending. The age of evidence retrieval has begun.
What the Commission published
The new Article 77 request channel allows national authorities or bodies charged with protecting fundamental rights, including non-discrimination, to submit requests to the AI Office for information and documents created or maintained under the AI Act.
The channel applies when the AI Office acts as the market-surveillance authority for systems under its competence. The Commission identifies two relevant categories:
- AI systems based on a general-purpose AI model when the model and the system are developed by the same provider or business group, subject to the conditions and exceptions in the Act.
- AI systems that constitute, or are integrated into, a designated very large online platform or very large online search engine.
The requesting authority must identify itself, formulate the request clearly and explain why access is necessary to fulfil its legal mandate. If the request concerns the testing of a high-risk AI system, the authority must also explain why information already obtained is insufficient.
Requests may be submitted in any official EU language. The AI Office will examine them under Article 77 and may seek the relevant information or documentation from the AI-system provider. The Commission says requests will be handled confidentially.
What changed, and what did not
The publication does not amend the EU AI Act. It introduces no new category of high-risk system, no additional documentation requirement and no new compliance deadline.
Article 77 already provides the legal basis for fundamental-rights authorities to obtain access to certain documentation where access is necessary for their mandate. The Commission’s new channel turns that authority into a usable administrative process.
That distinction matters.
The binding obligation still comes from the AI Act. The page, form and submission instructions are official implementation guidance. They explain how an existing statutory power can now be exercised through the AI Office.
The Commission’s broader AI Act enforcement framework, also updated on 20 October, confirms the division of responsibility among the AI Office, national competent authorities and the European Data Protection Supervisor. It also describes the AI Office’s investigative powers, including requests for information, model access, evaluations, interviews and inspections within its remit.
For governance teams, the operational consequence is straightforward: the probability of a real evidence request is no longer an abstract compliance scenario.
Why this matters for enterprise AI governance
Many organizations have governance artifacts. Far fewer can produce a complete, current and approved evidence package under pressure.
A regulator or fundamental-rights authority will not be satisfied by a responsible-AI statement on a website. The organization may need to establish which system is involved, who owns it, which model it uses, why it was classified as it was, what risks were assessed, how human oversight works, what testing was completed and what changed after deployment.
That evidence often sits across legal, compliance, data science, cybersecurity, procurement, enterprise architecture and the business unit operating the system. If those teams use different inventories, names and control taxonomies, the response process can expose the governance failure before the documents are even reviewed.
This is where enterprise architecture becomes part of regulatory readiness. Authorities ask for documents. Organizations must understand the system, its dependencies, its accountable owners and the decisions that produced those documents.
The evidence package organizations should be able to retrieve
The exact documents will depend on the organization’s role, the system and the applicable AI Act provisions. A defensible evidence package may include:
- The AI-system record, intended purpose, role classification and accountable owner.
- The rationale for the organization’s provider, deployer, importer or distributor status.
- The high-risk or non-high-risk classification decision and supporting analysis.
- Risk-management records and identified impacts on health, safety and fundamental rights.
- Data-governance, data-quality and representativeness evidence.
- Technical documentation, instructions for use and relevant system logs.
- Human-oversight design, authority, competence and intervention records.
- Testing results for accuracy, robustness, cybersecurity, bias and foreseeable misuse.
- Fundamental-rights and data-protection impact assessments where applicable.
- Post-market monitoring, incident escalation and corrective-action records.
- Supplier, model and downstream dependency documentation.
- The approval trail showing who reviewed each material decision and when.
Possessing these files is only the first test. Organizations should be able to connect each item to the correct AI system, requirement, control, owner, version and approval decision.
Five questions every AI governance diagnostic should now ask
- Can we determine whether the AI Office or a national authority has jurisdiction over each system?
- Can we retrieve the relevant evidence without assembling it manually across disconnected teams?
- Can we prove that the evidence corresponds to the current production system and model version?
- Who has authority to validate and release information to a regulator or fundamental-rights authority?
- Have we rehearsed the request as an operational scenario, including confidentiality, legal review and response ownership?
An organization that cannot answer these questions has a response-readiness gap, even when its policies look complete.
What leaders should do now
Verify
Map the organization’s AI systems to the applicable supervisory authority. Confirm which systems may fall within the AI Office’s direct market-surveillance competence and which remain under national authorities. Legal counsel should validate this assessment against Articles 75 and 77 and the organization’s specific role.
Update
Add regulatory evidence requests to the AI governance operating model. Update the evidence index, RACI, escalation procedure, disclosure log and document-approval workflow. Add an explicit diagnostic control for evidence retrieval and version integrity.
Test
Run a short tabletop exercise. Select one AI system and simulate an Article 77-related request. Measure how long it takes to identify the system, assemble the evidence, confirm its accuracy and obtain release approval. Record every missing artifact and ownership conflict.
Train
Teach business owners, model teams, compliance professionals and enterprise architects how an evidence request moves through the organization. Training should cover the difference between having a policy, operating a control and proving that the control operated.
Track
Monitor the Commission’s request form, any procedural updates, enforcement activity and future guidance on high-risk systems. Organizations should also track changes in the allocation of authority between the AI Office and national market-surveillance bodies.
Impact assessment: Medium, with a high signal for evidence readiness
This development merits a Medium impact rating.
It does not expand the legal duties imposed on providers or deployers, and it creates no immediate implementation deadline. A full redesign of an AI governance framework is therefore unnecessary.
Its practical signal is stronger than its legal novelty. The Commission has converted an existing power into a defined access route. Organizations in scope should update their diagnostics, enforcement-readiness training and evidence-response procedures now.
The next governance failure may not begin with a defective model. It may begin with a simple request that the organization cannot answer coherently.
Editorial classification
- Binding legal requirement: Article 77 of Regulation (EU) 2024/1689 and the related provisions governing access to documentation and market surveillance.
- Official implementation guidance: The Commission’s request channel, form and submission instructions published on 20 October 2026.
- Voluntary standards guidance: No amendment, corrigendum or revision to ISO/IEC 42001, ISO/IEC 42005 or ISO/IEC TS 42119-2 was identified in connection with this update.
Sources
- European Commission, AI Act request channel for national fundamental rights authorities, published 20 October 2026.
- European Commission, The enforcement framework of the AI Act, last updated 20 October 2026.
