{"slug":"eu-ai-act-art-20-corrective-actions-and-information","id":"AIPT-OBL-0026","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0026","title":"Providers must take corrective action and inform the supply chain about non-conforming high-risk AI","short_title":"Corrective actions and duty of information","category":"incident_handling","summary":"A provider that considers, or has reason to consider, that a high-risk system it has placed on the market is not in conformity must immediately correct it, withdraw it, disable it or recall it as appropriate, and inform the distributors, deployers, authorised representative and importers. Where the system presents a risk to health, safety or fundamental rights and the provider becomes aware of that risk, it must immediately investigate the causes together with the reporting deployer and inform the market surveillance authorities and, where relevant, the notified body.\n","practical_action":"Add a non-conformity and recall procedure for AI products with a supply-chain notification list and an authority-notification step.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Article 20","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["provider"],"sectors":["cross_sector"],"use_cases":["hiring_and_hr","finance_and_credit","safety_critical"],"applicability":[{"description":"Providers of high-risk AI systems already on the market or in service.","actors":["provider"],"conditions":null}],"evidence_examples":[{"title":"Corrective action and recall procedure for AI systems","description":null,"artifact_type":"document"},{"title":"Non-conformity investigation record","description":"Root cause, action taken, parties notified and dates.","artifact_type":"record"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 10.2; Annex A.8.4","note":"Nonconformity and corrective action; communication of incidents.","confidence_level":"high","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MANAGE 2.4, MANAGE 4.3","note":"Mechanisms to deactivate or supersede systems and respond to incidents.","confidence_level":"high","is_original":true}],"controls":[{"slug":"ai-incident-management-and-reporting","title":"AI incident management and regulatory reporting","kind":"process","relationship":"satisfies","note":"Investigation, corrective action and notification of authorities and the supply chain.","confidence_level":"high","url":"https://aipolicytracker.org/controls/ai-incident-management-and-reporting"},{"slug":"model-release-and-change-management-gate","title":"Model release and change-management gate","kind":"process","relationship":"supports","note":"Withdrawal, disabling and re-release pass through the gate.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/model-release-and-change-management-gate"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-20-corrective-actions-and-information","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}}