Article 76 — Supervision of testing in real-world conditions by market surveillance authorities (EU AI Act)

Article 76 of Regulation (EU) 2024/1689 — Supervision of testing in real-world conditions by market surveillance authorities. Official text, practical interpretation, key obligations and compliance implications.

Official Text Summary

Article 76 of Regulation (EU) 2024/1689 confers specific supervisory powers on market surveillance authorities over the testing of high-risk AI systems in real-world conditions as provided for under Article 60. The article establishes that where such testing takes place on the territory of a Member State, the competent market surveillance authority for that territory holds jurisdiction to oversee the conduct of the test and to verify that all conditions prescribed by Article 60 are being met throughout the testing period.

Authorities are empowered to request access to all documentation underpinning the real-world test, including the testing plan, the informed consent procedures applied to participants, and any records generated by the AI system during operation. Where the authority identifies circumstances suggesting that the testing gives rise to a risk — particularly to the health, safety, or fundamental rights of natural persons — it may order the suspension or definitive termination of the testing activity. Such decisions must be communicated promptly to the European Commission and to the market surveillance authorities of other Member States through the Union's existing product safety information and communication infrastructure.

The article also addresses coordination between authorities when testing spans multiple Member States, designating the authority of the Member State where the provider is established as lead supervisor, while preserving the right of each concerned authority to take protective measures on its own territory. This mirrors the coordinated enforcement model applied under other Union harmonisation legislation and ensures that cross-border real-world tests do not fall into a supervisory vacuum.

What This Means in Practice

For providers and deployers conducting real-world condition testing of high-risk AI systems, Article 76 means that testing is not a self-regulated activity: a designated market surveillance authority retains continuous oversight authority from the moment testing begins until it concludes.

In practical terms, an AI provider running a pilot of, for example, a medical-diagnosis support system on patients in two Member States must identify the lead supervisory authority — typically the authority in the Member State where the provider is established — and must ensure that all test documentation required under Article 60 is available for inspection on short notice. If the authority requests access to system logs, the informed consent register, or the incident management records, these must be produced within the timeframe specified by the authority, which may be as short as a few days in urgent situations.

Deployers (hospitals, recruitment agencies, credit institutions, or other organisations that integrate a provider's system) share the compliance burden. They must cooperate with supervisory inspections and must not obstruct authority access to test sites or system interfaces.

Where testing generates a serious incident — a harm, near-miss, or unexpected adverse outcome involving a participant — the notification obligations of Article 73 are triggered in parallel, and the market surveillance authority supervising under Article 76 becomes an immediate recipient of that notification. Organisations should therefore integrate their incident response procedures with their testing governance frameworks before testing begins, not after an incident occurs.

Multinational testing programmes should appoint a single internal compliance owner responsible for coordinating across Member State authorities, and should map in advance which authority holds lead jurisdiction and which hold concurrent territorial powers.

Key Obligations

• Providers and deployers must maintain all real-world testing documentation — including the testing plan, participant consent records, risk management records, and system operation logs — in a form that is immediately accessible to the competent market surveillance authority for the duration of the test.
• Upon request by the market surveillance authority, providers and deployers must supply any information, data, or access necessary for the authority to assess compliance with the conditions set out in Article 60, within the timeframe specified by the authority.
• Where testing spans multiple Member States, the provider must engage the lead supervisory authority (the authority of the Member State of establishment) and ensure that all concerned territorial authorities are informed and can exercise protective measures within their jurisdiction.
• Where a market surveillance authority orders the suspension or termination of real-world testing, the provider and deployer must comply immediately and must cease all testing activities on Union territory until the authority lifts the measure or the matter is resolved through the applicable review procedure.
• Any serious incident occurring during real-world condition testing must be notified to the supervising market surveillance authority in accordance with the timelines and procedures established under Article 73, without waiting for the conclusion of an internal investigation.
• Providers and deployers must cooperate in good faith with market surveillance inspections, including providing on-site access to facilities, personnel, and AI system interfaces when requested.

Relationship to Other Articles

Article 76 sits at the intersection of several interlocking provisions of Regulation (EU) 2024/1689. Its primary connection is with Article 60, which defines the substantive conditions under which real-world condition testing of high-risk AI systems is authorised; Article 76 is the enforcement counterpart that gives those conditions binding force through supervisory oversight.

It draws on the general market surveillance framework established by Articles 74 and 75, which define the powers and procedures available to market surveillance authorities across all categories of AI system, and should be read alongside those articles to understand the full scope of investigatory and corrective powers available.

The article connects to Article 73 on serious incident reporting, since incidents arising during supervised testing immediately activate that article's notification chain. Article 57 on AI regulatory sandboxes is a related but distinct provision: sandboxes operate under national competent authority supervision with special derogations, whereas Article 76 governs testing in real-world conditions under the standard market surveillance regime.

Articles 85 and 86 on penalties and access to justice are relevant downstream: a failure to cooperate with Article 76 supervision can constitute a compliance breach attracting administrative fines under the Act's penalty framework.

Compliance Timeline

Regulation (EU) 2024/1689 entered into force on 1 August 2024, marking the start of the phased application schedule. Article 76, as part of Title IX on post-market monitoring and market surveillance, falls within the provisions that become fully applicable to high-risk AI systems in the second and third application phases.

For high-risk AI systems listed in Annex III (standalone high-risk applications), full market surveillance obligations — including Article 76 supervision of real-world testing — apply from 2 August 2026. For high-risk AI systems that are safety components of products regulated by existing Union harmonisation legislation listed in Annex I (such as medical devices and machinery), the applicable date is 2 August 2027.

Providers planning real-world condition testing of high-risk systems should treat August 2026 as the hard deadline for having compliant testing governance frameworks in place, including documented procedures for authority access, incident escalation, and cross-border coordination. Given that testing programmes often run for six to twelve months before a system reaches deployment, governance frameworks should realistically be designed and tested no later than early 2026 to avoid delays to market entry.