EU AI Act Art. 20: corrective actions and duty of information

A provider with reason to consider a high-risk system non-conforming immediately brings it into conformity, withdraws, disables or recalls it and informs distributors and deployers; where the system presents a risk, it investigates and informs the market-surveillance authority

By Jorge García Aibar Reviewed 2026-09-24

From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-EUAIA-ART20. Drawn from chapter 08.

Text alternative

Clause: EU AI Act, Art. 20.
Duty holder: Provider.
Applies from: 2027-12-02, Deferred.
Artefact: CAPA record.
Layers: Layer 01, Layer 05.
Evidence record: Evidence record v1.
Record schema: Evidence record.
The same topic in 17 other frameworks; the crosswalk section below links each clause.

When this obligation applies The first date in the row's status, then each later step: filled once its date has passed, outlined while it is still ahead of the review date.

Data table: the dates

Dates of AIGE-OBL-EUAIA-ART20
Date	Step	Detail
2027-12-02	Deferred	Annex III
2028-08-02	High-risk (Annex I)	Applies to Annex I embedded (product safety-component) systems
2030-08-02	Later step	Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))

Id

AIGE-OBL-EUAIA-ART20

Instrument

EU AI Act (post-Omnibus) law

Compared side by side

ISO 42001 vs EU AI Act · NIST AI RMF vs EU AI Act

Clause

Art. 20

Duty holder

Provider

Authority

National MSA

Applies from

2027-12-02 Deferred · Annex III

Later dates

2028-08-02 Applies to Annex I embedded (product safety-component) systems
2030-08-02 Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))

System class

High-risk (Annex III) · High-risk (Annex I)

The artefact that evidences it

CAPA record; withdraw, disable or recall runbook; notification of distributors and deployers.

What this obligation connects to Solid edges are direct relations, dashed ones looser (a case that cites the same article, a framework whose clauses only touch the topic); patterns and controls take the colour of their stack layer. Select a node to open it; the lists below give every relation in full.

Data table: every relation

Relations of AIGE-OBL-EUAIA-ART20
Family	Item	Relation
Patterns	Deactivation, Localisation & Retirement Runbook	Direct
Open controls	AIGE-CTL-DEPLOY-012 Deactivation triggers, degraded modes and suspension	Direct
Same crosswalk topic	AI Verify 9.5.4, 1.5.1, 1.6.1, 5.11.1, 9.4.1, 5.14.1, 6.5.1, 4.6.1	Core clause
Same crosswalk topic	CSA AICM SEF-07, SEF-08, AIS-06, CCC-01, DSP-02	Core clause
Same crosswalk topic	China GenAI Measures GenAI Art. 14, GenAI Art. 15	Core clause
Same crosswalk topic	EU AI Act Art. 72, Art. 73, Art. 26(5), Art. 55, Art. 3(49), Art. 26, Art. 25, Art. 43(4), Art. 79, Art. 86	Core clause
Same crosswalk topic	G7 Code G7 Action 2, G7 Action 4	Core clause
Same crosswalk topic	GAO AI Accountability 4.1, 4.2, 4.4, 4.5	Core clause
Same crosswalk topic	GDPR Arts. 33–34	Core clause
Same crosswalk topic	GPAI Code Safety C9, Safety 3.5	Core clause
Same crosswalk topic	ISO 42001 A.8, 10.2, A.6.2.5, A.6.2.6, A.9	Core clause
Same crosswalk topic	Korea AI Act Art. 32(1)	Core clause
Same crosswalk topic	NIST AI RMF MANAGE 4, MANAGE 4.3, MANAGE 2.4, GOVERN 4.3, MANAGE 4.1, GOVERN 1.7	Core clause
Same crosswalk topic	Singapore Agentic Agentic 2.3.3	Core clause
Same crosswalk topic	Singapore GenAI GenAI 4	Core clause
Same crosswalk topic	TC260 Framework 3.0 TC260 5.3.7, TC260 5.3.18, TC260 App. 2 II.6, TC260 5.3, TC260 5.3.19	Core clause
Same crosswalk topic	China Algo. Rec. AlgoRec Art. 7	Related clause
Same crosswalk topic	CoE Convention CoE Art. 16(2)(g)	Related clause
Same crosswalk topic	OECD AI Principles OECD 1.4	Related clause

Patterns that build it

Deactivation, Localisation & Retirement Runbook (layer 4 and 2)

The same topic in other frameworks

From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.

Incident response and monitoring

EU AI Act Art. 72 Post-market monitoring by providers and post-market monitoring plan (core)
EU AI Act Art. 73 Reporting of serious incidents (core)
ISO 42001 A.8 Information for interested parties (core)
ISO 42001 10.2 Nonconformity and corrective action (core)
NIST AI RMF MANAGE 4 MANAGE 4: Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored (core)
TC260 Framework 3.0 TC260 5.3.7 Real-time risk monitoring (core)
TC260 Framework 3.0 TC260 5.3.18 Incident reporting (core)
China GenAI Measures GenAI Art. 14 Handle and report unlawful content (core)
China GenAI Measures GenAI Art. 15 Complaint and reporting mechanism (core)
EU AI Act Art. 26(5) Deployer monitoring, informing the provider and suspending use (core)
GPAI Code Safety C9 Commitment 9: Serious incident reporting (core)
GDPR Arts. 33–34 Notification and communication of a personal data breach (core)
NIST AI RMF MANAGE 4.3 MANAGE 4.3: Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented (core)
CSA AICM SEF-07 Incident Management and Response (core)
CSA AICM SEF-08 Security Breach Notification (core)
Korea AI Act Art. 32(1) Safety duties for AI above the compute threshold (core)
Singapore GenAI GenAI 4 Incident Reporting (core)
Singapore Agentic Agentic 2.3.3 When deploying, continuously monitor and test (core)
G7 Code G7 Action 2 Identify and mitigate vulnerabilities, incidents and misuse after deployment (core)
G7 Code G7 Action 4 Responsible information sharing and reporting of incidents (core)
GAO AI Accountability 4.1 Planning: develop plans for continuous or routine monitoring of the AI system (core)
GAO AI Accountability 4.2 Drift: establish the range of data and model drift that is acceptable (core)
AI Verify 9.5.4 Accountability: enable an incident management process to report and respond to actions or decisions that affect the AI system's outcome (core)
AI Verify 1.5.1 Transparency: communicate to end users whenever an incident has occurred (core)
EU AI Act Art. 55 Obligations for providers of general-purpose AI models with systemic risk
TC260 Framework 3.0 TC260 App. 2 II.6 Emergency plans
China Algo. Rec. AlgoRec Art. 7 Security management and emergency response
EU AI Act Art. 3(49) Definition of serious incident
GPAI Code Safety 3.5 Measure 3.5: Post-market monitoring
NIST AI RMF MANAGE 2.4 MANAGE 2.4: Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use
NIST AI RMF GOVERN 4.3 GOVERN 4.3: Organizational practices are in place to enable AI testing, identification of incidents, and information sharing
AI Verify 1.6.1 Transparency: give end users and external parties the means to report adverse impacts, with whistleblower protection
AI Verify 5.11.1 Security: monitor AI system outputs and behaviour after deployment and alert system owners to issues

Deployment, change and decommissioning

EU AI Act Art. 26 Obligations of deployers of high-risk AI systems (core)
ISO 42001 A.6.2.5 AI system deployment (core) (clause not verified)
ISO 42001 A.6.2.6 AI system operation and monitoring (core) (clause not verified)
NIST AI RMF MANAGE 2.4 MANAGE 2.4: Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use (core)
NIST AI RMF MANAGE 4.1 MANAGE 4.1: Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management (core)
NIST AI RMF GOVERN 1.7 GOVERN 1.7: Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness (core)
CSA AICM AIS-06 Secure Application Deployment (core)
AI Verify 9.4.1 Accountability: a policy to deactivate, decommission and phase out AI systems safely (core)
AI Verify 5.14.1 Security: proper and secure disposal of data and models (core)
AI Verify 6.5.1 Robustness: review changes in code, input data and output data to decide when a new robustness review is due (core)
EU AI Act Art. 25 Responsibilities along the AI value chain
EU AI Act Art. 43(4) New conformity assessment on substantial modification
EU AI Act Art. 79 Procedure at national level for dealing with AI systems presenting a risk
EU AI Act Art. 86 Right to explanation of individual decision-making
ISO 42001 A.9 Use of AI systems
CSA AICM CCC-01 Change Management Policy and Procedures
CSA AICM DSP-02 Secure Disposal
Singapore Agentic Agentic 2.3.3 When deploying, continuously monitor and test
CoE Convention CoE Art. 16(2)(g) Testing before first use and when significantly modified
OECD AI Principles OECD 1.4 Robustness, security and safety
TC260 Framework 3.0 TC260 5.3 Operators' safety guidelines
TC260 Framework 3.0 TC260 5.3.19 Re-assessment on material change
GAO AI Accountability 4.4 Ongoing assessment: assess the utility of the AI system to ensure its relevance to the current context
GAO AI Accountability 4.5 Scaling: identify conditions, if any, under which the AI system may be scaled or expanded beyond its current use
AI Verify 4.6.1 Safety: deployment strategies such as blue-green and canary deployments

Open controls that evidence it

Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.

AIGE-CTL-DEPLOY-012 Deactivation triggers, degraded modes and suspension (Deployment and monitoring profile)

Source

Chapter 08, section EU AI Act, post-Omnibus, checked against its sources on the review date above.

Machine-readable

This obligation: /api/v1/obligations/aige-obl-euaia-art20.json
The register: /api/v1/obligations.json · CSV
Schema and stability promise: open data and API

Cite this obligation

García Aibar, J. (2026). EU AI Act Art. 20: corrective actions and duty of information (AIGE-OBL-EUAIA-ART20). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-euaia-art20. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{EU AI Act Art. 20: corrective actions and duty of information (AIGE-OBL-EUAIA-ART20)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-euaia-art20},
  note         = {Version 0.5.0}
}