What Article 21 Requires
Article 21 sits within Chapter III, Section 3 of the EU AI Act, which sets out obligations for providers and other parties involved with high-risk AI systems. Article 21(1) requires providers to give a competent authority, upon a reasoned request, all information and documentation necessary to demonstrate conformity with the requirements set out in Chapter III, Section 2. This documentation must be provided in a language the requesting authority can easily understand, or in an official EU language indicated by the relevant Member State. Article 21(2) adds a distinct obligation: providers must give the requesting authority access to the automatically generated logs referenced in Article 12(1), to the extent those logs are under the provider's control. The Act entered into force in August 2024, with obligations for high-risk AI systems phased in through 2026, which means organizations building toward compliance now need to treat Article 21 readiness as an ongoing operational capability rather than a one-time filing exercise.
Scope of Authority Requests: Documentation and Logs
The two categories of material an authority can request under Article 21 are conformity documentation and system logs, and each carries different preparation demands. Conformity documentation traces back to the technical documentation obligations in Article 11, which must already exist for a high-risk system to be placed on the market. The practical question for compliance teams is whether that documentation is current, complete, and translatable on short notice.
Log access under Article 21(2) is narrower in scope. It applies only to logs generated automatically under Article 12, and only to the extent those logs are under the provider's control. This control qualifier matters for any organization using third-party models, outsourced components, or agentic systems where actions may be executed by components outside direct organizational ownership. If a provider cannot access or reconstruct logs from a delegated component, it cannot fulfill this part of Article 21 for that component, which makes contractual and technical log-access arrangements across the AI supply chain a practical prerequisite rather than an afterthought.
Confidentiality and Shared Responsibility
Information a competent authority obtains under Article 21 must be handled according to the confidentiality obligations set out in Article 78, which compliance teams should understand before preparing any disclosure of sensitive technical or business information. Because Article 21 does not itself specify a fixed response deadline, any timeframe is set within the individual reasoned request, so internal service-level tracking against those request-specific deadlines is necessary rather than reliance on a single statutory clock.
Responsibility for Article 21 compliance also needs to be explicitly assigned in value chains involving multiple parties, since providers, deployers, and third-party component suppliers may each hold different pieces of the required documentation or logs. Preparing conformity evidence and rationale in advance, rather than assembling it only after a request arrives, is the more defensible posture and reduces the risk of incomplete or delayed responses.