Article 90 — Right to be heard and access to the file (EU AI Act)

Article 90 of Regulation (EU) 2024/1689 — Right to be heard and access to the file. Official text, practical interpretation, key obligations and compliance implications.

Official Text Summary

Article 90 of Regulation (EU) 2024/1689 establishes two interrelated procedural rights that apply when national market surveillance authorities take enforcement measures against operators of AI systems.

First, the right to be heard: any natural or legal person who is the subject of a decision or restrictive measure adopted by a competent national authority must be afforded the opportunity to submit observations within a reasonable period before that decision is finalised. Authorities may not adopt binding enforcement measures without first providing this procedural safeguard, except where urgency requires immediate action to protect public safety or other overriding interests expressly foreseen by the Regulation.

Second, the right of access to the file: any party directly concerned by an enforcement proceeding may request access to the file compiled by the authority in relation to that proceeding. This right enables affected operators to review the evidence, assessments, and documentation on which the authority intends to base its decision, allowing them to respond effectively and contest any inaccuracies.

Both rights are subject to necessary limitations: confidential business information, personal data protected under Regulation (EU) 2016/679 (GDPR), and material relating to ongoing investigations or third-party rights may be withheld or redacted. Where such restrictions are applied, the authority must inform the party concerned and provide a justification. The article reflects the general principles of good administration embedded in Article 41 of the EU Charter of Fundamental Rights and ensures that market surveillance under the AI Act is conducted in a manner consistent with the rule of law.

What This Means in Practice

Article 90 creates direct procedural obligations for national market surveillance authorities and corresponding procedural rights for AI system operators — primarily providers, but also deployers, importers, and distributors who may be subject to enforcement action.

For providers and other operators, Article 90 means that if a national authority is considering a corrective measure — such as requiring a system to be withdrawn from the market, restricted in use, or modified — you have the right to know about it in advance and to respond. In practical terms, this typically means the authority will issue a formal notification setting out its preliminary findings and the measure it intends to impose, and will give you a defined window (commonly 10 to 30 days, subject to national procedural law) to submit written observations or, where national law provides, to present your case orally.

Access to the file means you can formally request the documentation the authority holds — conformity assessment records, test results, incident reports, correspondence, expert opinions — and verify whether the factual basis for the proposed action is accurate. Where documents are withheld, you should receive a summary or explanation sufficient to enable a meaningful defence.

Concrete example: A provider of a high-risk AI system used in recruitment receives notification that a market surveillance authority has found the system's documentation does not meet the requirements of Article 11. Before the authority issues a mandatory corrective order, the provider has the right to be heard, to review the authority's technical file, and to submit evidence that documentation requirements have in fact been met or that remediation steps are already under way.

Organisations should establish internal escalation procedures so that legal and compliance teams can respond within the authority's stated deadline and compile the evidence needed to exercise these rights effectively.

Key Obligations

• Authorities must notify before acting: Market surveillance authorities are required to inform the party concerned of their preliminary findings and the nature of the measure under consideration before adopting any binding enforcement decision, except in cases of urgency justified under the Regulation.
• Minimum period for observations: Authorities must allow a reasonable and, where relevant, specified period for the affected party to submit written observations or otherwise be heard before a decision is finalised.
• File access must be granted on request: Upon request from the party concerned, authorities must provide access to the enforcement file, including the evidence and assessments relied upon, subject to permissible restrictions.
• Restrictions must be justified: Any limitation on access to the file — for reasons of confidentiality, personal data protection, or ongoing investigations — must be explicitly justified and communicated to the party concerned; blanket redaction or refusal is not permissible.
• Urgency exception is bounded: Where immediate action is taken without prior hearing due to urgency, the authority must provide the opportunity to be heard as soon as reasonably practicable after the measure is adopted.
• Procedural rights apply to all directly concerned parties: The rights under Article 90 are not limited to the provider alone; any natural or legal person directly affected by a measure — including deployers subject to joint or secondary liability provisions — may invoke them.

Relationship to Other Articles

Article 90 sits at the heart of the enforcement architecture of Title IX (Post-Market Monitoring, Information Sharing, and Market Surveillance) and must be read in conjunction with several other provisions.

It is the procedural companion to Article 91 (Right to an effective judicial remedy), which provides the downstream protection: if the right to be heard under Article 90 is respected, any subsequent judicial challenge to the authority's decision has a firmer procedural record to stand on.

It connects closely to Articles 74–78, which define the powers, coordination obligations, and general conduct requirements of national competent authorities, establishing the institutional framework within which Article 90 rights are exercised.

Article 79 (Corrective and restrictive measures) and Article 80 (Information sharing between authorities) describe the types of decisions and measures that trigger the procedural protections of Article 90. Understanding the scope of those measures clarifies when the right to be heard arises.

Article 94 (Penalties) is also relevant: enforcement proceedings that could lead to significant fines or restrictions must comply with Article 90 safeguards, and failure to observe them could vitiate the penalty decision.

Finally, Article 90 reflects and implements Article 41 of the EU Charter of Fundamental Rights (right to good administration), giving that Charter provision concrete procedural form in the AI Act enforcement context.

Compliance Timeline

The EU AI Act entered into force on 1 August 2024, twenty days after its publication in the Official Journal of the European Union on 12 July 2024. Its provisions apply on a phased schedule:

• 1 February 2025 — Prohibitions on unacceptable-risk AI practices (Title II, Articles 5) became applicable. Enforcement of these provisions, including proceedings where Article 90 rights could be invoked, was possible from this date.
• 2 August 2025 — Provisions on general-purpose AI models (Title VIII) and governance obligations became applicable. Market surveillance activities relating to GPAI providers may trigger Article 90 proceedings from this date.
• 2 December 2026 — The main obligations for high-risk AI systems listed in Annex I (safety-component AI systems) apply. Enforcement actions against providers and deployers of these systems, with the full Article 90 procedural protections, become fully operative.
• 2 August 2027 — Remaining high-risk AI system obligations (Annex III systems already placed on the market) apply. Article 90 rights are fully operative across the entire scope of the Regulation from this date.

Organisations operating AI systems subject to the Regulation should ensure that internal legal and compliance functions are prepared to invoke Article 90 rights — including responding to authority notifications and requesting file access — from the date the relevant provisions apply to their systems. National procedural rules may supplement the timelines and mechanics of the hearing process, so engagement with national competent authorities and legal counsel familiar with domestic administrative law is advisable.