EU AI Act Art.20: Corrective actions and duty of information
Article 20 of the EU AI Act binds the operator (see the article). It requires A provider that considers, or has reason to consider, that a high-risk AI system it has placed on the market. This page states what it requires, who it binds and the evidence to keep. Browsing is free; the conformance kit is USD 499.
Specifics
| Instrument | Regulation (EU) 2024/1689 (the EU AI Act), as amended by Regulation (EU) 2026/1744 |
|---|---|
| Article | Art.20 |
| Binds | Operator (see the article) |
| Group | High-Risk Operator Obligations |
| Evidence items | 5 |
| Linked NIST AI RMF controls | 6 |
| Linked ISO/IEC 42001 controls | 1 |
| Last updated |
Who does Art.20 bind?
The article binds the operator (see the article). The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.
Applies with the high-risk regime: 2 December 2027 for stand-alone systems listed in Annex III, and 2 August 2028 for AI embedded in regulated products listed in Annex I (Article 113, as amended by Regulation (EU) 2026/1744). See the full timeline.
What does Art.20 require?
A provider that considers, or has reason to consider, that a high-risk AI system it has placed on the market or put into service is not in conformity with the Regulation must immediately take the necessary corrective action to bring it into conformity, withdraw it, disable it or recall it as appropriate, and must inform the distributors of that system and, where applicable, the deployers, the authorised representative and the importers. Where the system presents a risk within the meaning of Art.79(1) and the provider becomes aware of it, the provider must immediately investigate the causes, in collaboration with the reporting deployer where applicable, and inform the competent market surveillance authorities and, where a certificate was issued for the system, the notified body concerned, of the nature of the non-compliance and of any corrective action taken.
This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.20 (Regulation (EU) 2024/1689 on EUR-Lex).
What evidence should we keep for Art.20?
| Category | Evidence to keep |
|---|---|
| Corrective action | A non-conformity procedure naming the bring-into-conformity, withdraw, disable and recall options and who decides between them |
| Corrective action | Non-conformity records showing the date the provider first had reason to consider the system non-conforming and the date action followed |
| Corrective action | Notification records to distributors, deployers, the authorised representative and importers |
| Corrective action | Root cause investigation records for risk cases, showing collaboration with the reporting deployer |
| Corrective action | Notifications to the market surveillance authority and to the certifying notified body, stating the nature of the non-compliance |
What does a linked control mean here?
A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.
Which NIST AI RMF controls line up with Art.20?
6 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | NIST AI RMF | Confidence |
|---|---|---|
AIRMF-GV-1.7 | Processes and procedures are in place for decommissioning and phasing out of AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness Withdrawal on non-conformity is triggered by defect, not by planned decommissioning. | medium |
AIRMF-GV-5.2 | Mechanisms are established to enable AI actors to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation Corrective action closes the loop on non-conformity, not on adjudicated feedback. | medium |
AIRMF-GV-6.2 | Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk Withdrawal and recall exist but no redundancy or fallback for third-party failure is required. | medium |
AIRMF-MN-2.3 | Procedures are followed to respond to and recover from a previously unknown risk when it is identified Immediate corrective action and causal investigation on a newly discovered non-conformity is this procedure. | high |
AIRMF-MN-2.4 | Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use Withdraw, disable or recall on non-conformity is the supersede, disengage or deactivate mechanism. | high |
AIRMF-MS-4.3 | Measurable performance improvements or declines based on consultations with relevant AI actors including affected communities, and field data about context-relevant risks and trustworthiness characteristics, are identified and documented Corrective action follows a detected decline but no baseline comparison is required. | medium |
Which ISO/IEC 42001 controls line up with Art.20?
1 control in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | ISO/IEC 42001 | Confidence |
|---|---|---|
A.8.4 | Communication of incidents Non conformity must be notified to distributors, deployers, representatives and importers. | high |
What does the conformance kit add for Art.20?
The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.