Market Surveillance Authorities: How Enforcement Works

Market surveillance is the operational backbone of the European regulatory state. For professionals building and deploying AI systems, connected devices, medical technologies, and digital platforms, it is the mechanism through which legal obligations become practical reality. It is not a theoretical exercise; it is a structured, risk-based process of oversight that begins well before a product enters the market and continues throughout its lifecycle. Understanding how Market Surveillance Authorities (MSAs) think, what powers they wield, and how they coordinate across borders is essential for any entity operating within the Single Market. This article explains the institutional architecture, the procedural steps of oversight, and the practical realities of an investigation, drawing on the frameworks of the AI Act, the GDPR, the NIS2 Directive, the Data Act, and the existing New Legislative Approach (NLA) for product safety.

The European regulatory landscape for high-tech systems is a complex tapestry of harmonized rules and national enforcement traditions. At the EU level, legislation sets the standards, defines the obligations, and establishes the principles of supervision. At the national level, MSAs—often multiple agencies per Member State with distinct competencies—are responsible for implementation. They are the public authorities that check whether a company’s documentation matches reality, whether a system behaves as promised in the market, and whether risks are being managed effectively. For any regulated entity, the relationship with these authorities is not adversarial by default, but it is fundamentally asymmetrical: the authority holds the mandate to protect the public interest, while the company holds the information and the responsibility to be compliant. The art of compliance lies in anticipating the MSA’s perspective and building systems that are not only technically robust but also auditable and transparent to regulators.

The Institutional Landscape: Who Watches the Market?

Market surveillance is not a single, monolithic European body. It is a distributed network of national authorities, sometimes coordinated by EU-level agencies. The structure depends on the sector and the specific legislation. For product safety under the NLA, each Member State designates one or more authorities to monitor non-food products. For digital services, the Digital Services Act (DSA) creates a central role for the European Commission for Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs), while national authorities handle other providers. For AI systems, the AI Act establishes a decentralized model with a strong coordinating role for the European AI Office. For medical devices, national competent authorities act under the watch of the European Medicines Agency (EMA) and the Medical Device Regulation (MDR) framework. It is crucial to recognize that a single company may be subject to oversight from multiple authorities depending on its product portfolio.

Division of Competences at the EU and National Level

At the national level, the responsible authority can vary significantly. In some countries, a single agency like the Federal Network Agency (BNetzA) in Germany has broad competencies across telecommunications and product safety. In others, responsibilities are fragmented: a Ministry of Economy may handle general product safety, a Data Protection Authority (DPA) handles GDPR, a financial regulator handles fintech AI, and a dedicated cybersecurity agency handles NIS2 compliance. This fragmentation creates a challenge for companies: you must identify the correct point of contact for each aspect of your system.

At the EU level, the role is primarily one of coordination, standard-setting, and, in specific high-risk cases, direct enforcement. The European AI Office, established within the European Commission, is a new and powerful actor. Under the AI Act, it will have direct supervisory authority over general-purpose AI (GPAI) models and will coordinate the work of national MSAs. It will also develop codes of practice and issue guidance. Similarly, the European Union Agency for Cybersecurity (ENISA) supports national authorities under NIS2, and the European Data Protection Board (EDPB) coordinates the DPAs on GDPR enforcement.

The principle of subsidiarity governs this architecture. National authorities are the first line of defense. They are closer to the market, to the companies, and to potential victims of non-compliance. EU bodies step in when cross-border issues arise or when a harmonized approach is necessary to prevent a patchwork of interpretations that could fragment the Single Market.

The Role of Notified Bodies and Conformity Assessment

For many high-risk products, market surveillance does not begin with a random market check but with a prior conformity assessment. Notified Bodies are independent third-party organizations designated by Member States to assess the conformity of certain products (e.g., medical devices, machinery, certain AI systems) before they are placed on the market. They are a critical part of the ecosystem. Market surveillance authorities do not typically certify products themselves; they oversee the entire system, including the performance of Notified Bodies.

If an MSA discovers that a Notified Body has improperly certified a product, it can trigger a cascading set of consequences, including the withdrawal of the product from the market, the invalidation of the CE mark, and sanctions against the Notified Body itself. For companies, this means that choosing a reputable Notified Body is a risk management decision. An MSA investigation will often scrutinize the conformity assessment file in detail. If the technical documentation is weak or the risk assessment is superficial, the MSA will not only question the product’s compliance but may also investigate the diligence of the Notified Body that approved it.

The Lifecycle of Oversight: From Pre-Market to Post-Market

Market surveillance is not a single event; it is a continuous process that spans the entire lifecycle of a product or service. The regulatory obligations begin before a product is even placed on the market and extend long after it has been sold. This lifecycle approach reflects the reality that technology evolves, threats emerge, and user behavior changes. A system that was compliant at the time of its design may become non-compliant due to updates, new data, or unforeseen use cases.

Pre-Market Scrutiny and Documentation Requirements

Before a high-risk AI system or a connected device can be legally sold or deployed in the EU, it must undergo a conformity assessment and its technical documentation must be compiled. This documentation is the primary object of pre-market scrutiny. It is not merely a formality; it is the evidence file that proves compliance. MSAs have the right to request this documentation at any time, even if the product is not yet on the market, to verify that the company is prepared for compliance.

The required documentation typically includes a detailed description of the system, its intended purpose, the data sets used for training and testing, risk assessments, design specifications, and instructions for use. For AI systems, this includes details on the model’s capabilities, limitations, and the measures taken to mitigate biases and risks to fundamental rights. An MSA reviewing this file is looking for traceability and rigor. They will ask: Is the risk assessment comprehensive? Does it cover all the scenarios outlined in the AI Act’s list of high-risk use cases? Is there evidence that the data was handled in accordance with GDPR? A superficial or generic documentation file is a red flag that invites further scrutiny.

Active Post-Market Surveillance

Once a product is on the market, the focus shifts to post-market surveillance (PMS). This is a proactive obligation for the manufacturer or provider to continuously monitor the performance and safety of their product. It is not a passive waiting game. Companies must have systems in place to collect data on failures, misuse, and emerging risks. For AI systems, this is particularly important. An AI model can drift, its performance can degrade, or it can produce biased outcomes when exposed to new data. A robust PMS plan will specify what data to collect, how to analyze it, and when to trigger corrective actions.

MSAs will review these PMS systems. They may ask to see PMS reports, data on incident rates, or evidence of how user feedback has been incorporated into system updates. A key question for an MSA is whether the company is actively looking for problems or simply reacting to complaints. Proactive monitoring is the expected standard. For example, a company deploying a biometric identification system should be actively testing for demographic differentials in error rates and taking corrective action if disparities are found, not waiting for a civil society report to expose the issue.

Incident Reporting and Vigilance Systems

When a serious incident occurs, a different set of obligations is triggered. Legislation like the AI Act, the GDPR, and the MDR mandates serious incident reporting within strict timelines. For AI systems, a “serious incident” is defined as an incident that leads to the death of a person, a serious and irreversible impairment of health, or the disruption of critical infrastructure. The reporting obligation is time-sensitive: for the AI Act, the initial report must be made within 15 days of the provider becoming aware of the incident.

MSAs operate “vigilance systems” to receive these reports. An incident report is not an admission of guilt, but a legal requirement. How a company handles this moment is critical. A prompt, transparent, and well-documented report demonstrates a responsible approach to safety. Conversely, attempting to downplay an incident or delaying a report can lead to severe penalties and a loss of trust from the authority. The MSA will analyze the report, may request further information, and will decide whether the incident warrants a formal investigation or a market-wide alert.

The Investigative Process: How MSAs Gather Information

When an MSA decides to investigate a company, it is because it has identified a potential risk or a sign of non-compliance. The trigger could be a complaint, an incident report, a routine market check, or information received from another authority. The investigation is a formal process governed by law, with defined powers for the authority and defined rights and obligations for the company. The tone of an investigation is typically professional and fact-based, but it is a serious matter that requires careful management.

Triggers and Risk-Based Selection

MSAs do not have the resources to investigate every company. They use a risk-based approach to prioritize their efforts. High-risk triggers include:

• Incident Reports: A report of a serious incident is a primary trigger for investigation.
• Complaints: Complaints from consumers, businesses, or public interest groups can initiate a review.
• Whistleblower Information: Information from employees or partners is a valuable source of intelligence for MSAs.
• Cross-Border Signals: Information from an MSA in another Member State can trigger a domestic investigation.
• Routine Market Checks: MSAs conduct random or targeted checks on products sold online or in physical stores.
• Referrals from Other Authorities: A data protection authority might refer a case to a product safety authority, or vice versa.

For companies, this means that any signal of a problem—internal or external—should be taken seriously. A pattern of minor complaints, even if they do not meet the threshold for a formal incident report, can attract the attention of an MSA.

Formal Information Requests and On-Site Inspections

The MSA’s toolkit includes several investigative powers. The most common is the formal information request. This is a legally binding request for information, often with a deadline. It can ask for technical documentation, internal reports, data samples, code, or business processes. Responding to such a request is a legal obligation. Providing incomplete or misleading information can be treated as a separate violation and can significantly escalate the investigation.

In more serious cases, MSAs can conduct on-site inspections or “dawn raids.” They can enter a company’s premises, inspect computers and documents, and take copies of relevant files. They are typically required to obtain a court order or a similar legal authorization for this, but they do not need to give the company advance notice. For digital systems, this power extends to accessing servers and data repositories. Companies must have a clear protocol for how to handle an on-site inspection, respecting the authority’s legal mandate while protecting their own legal rights (e.g., ensuring that legally privileged documents are identified and handled appropriately).

Testing and Technical Audits

For technology products, MSAs are increasingly conducting their own technical testing. This can involve purchasing a product from the market and reverse-engineering its behavior, testing its cybersecurity resilience, or auditing its algorithms. Under the AI Act, authorities will have the power to request access to models and data for testing purposes, particularly for GPAI models. This is a significant development. It means that “black box” systems are no longer immune from regulatory scrutiny. MSAs may use their own technical experts or commission independent labs to perform these tests. The results can form the basis of a finding of non-compliance if the system’s real-world behavior deviates from its documented specifications or intended purpose.

Enforcement Actions and Corrective Measures

Once an investigation concludes that a product or service is non-compliant, the MSA has a range of corrective and punitive measures at its disposal. The choice of measure is typically proportionate to the risk and the severity of the non-compliance. The goal is not always to punish, but to restore compliance and protect the public.

Corrective Measures and Market Withdrawal

The first step is often to require the company to fix the problem. This can take the form of a corrective action plan, where the company must outline the steps it will take to achieve compliance, with a clear timeline. If the risk is immediate and severe, the MSA can order the withdrawal of the product from the market or a recall from consumers. For software and AI systems, this can mean ordering the company to disable a feature, update the model, or suspend the service in the EU.

Market surveillance authorities can impose a ban on a product if the non-compliance poses a serious and immediate risk to public safety or fundamental rights. This is a drastic measure, but it is available for high-risk situations. For example, if an AI system used for hiring is found to be systematically discriminating against a protected group, an MSA could ban its use until the issue is remedied. These measures are binding across the entire Single Market. An order issued by an authority in one Member State can, through the EU’s rapid alert system (RAPEX for products, other systems for digital services), lead to coordinated action across all Member States.

Administrative Fines and Penalties

Fines are a well-known deterrent. The GDPR set a new standard with fines of up to 4% of global annual turnover. The AI Act follows a similar model, with fines for non-compliance reaching up to 7% of global annual turnover for the most serious violations. These are not theoretical numbers; they have been applied in practice. The DSA also includes significant fines.

When calculating fines, authorities consider the nature of the infringement, its duration, the company’s level of cooperation, and whether the infringement was intentional or negligent. A company that actively hides information or obstructs an investigation will face a much higher fine than one that proactively identifies and reports a problem. It is important to understand that fines are not just a cost of doing business; they are a signal of the regulator’s disapproval and can trigger significant reputational damage and shareholder scrutiny.

Public Naming and Reputational Consequences

Beyond fines, MSAs are increasingly using public communication as an enforcement tool. They can issue public warnings about specific products or services. They can publish the names of non-compliant companies on their websites. In some cases, they are legally required to do so. This “naming and shaming” can be more damaging than a fine, as it erodes consumer trust and business reputation. For B2B companies, a public warning from an MSA can lead to the termination of contracts and partnerships. For this reason, managing an investigation transparently and working towards a resolution can be as important as the legal outcome itself.

Coordination and Cross-Border Enforcement

In the Single Market, a product or service is rarely confined to one country. A company based in Finland may sell its AI-powered tool to customers in Spain, France, and Italy. If there is a problem, which authority is in charge? The EU has developed sophisticated mechanisms to handle this, ensuring that enforcement is effective and consistent across borders.

The Rapid Alert System and Mutual Assistance

The RAPEX (Rapid Alert System for dangerous non-food products) is a well-established network that allows national authorities to quickly share information about products that pose a risk to health and safety. When an authority in one country identifies a dangerous product, it can issue an alert through RAPEX, prompting other countries to take action. Similar information-sharing networks exist for other sectors, such as the CSIRTs network under NIS2 for cybersecurity incidents.

This system means that a problem discovered in one corner of the EU can trigger a continent-wide response within hours. For companies, this highlights the importance of a coordinated EU-wide recall or corrective action. A piecemeal approach, where a company tries to handle the issue differently in each country, is likely to fail and will be viewed negatively by regulators.

The “One-Stop-Shop” and Lead Authority Model

To simplify compliance for cross-border digital services, the GDPR introduced the One-Stop-Shop (OSS) mechanism. A company with establishments in multiple Member States has a “lead supervisory authority,” typically the DPA in the country where its main establishment is located. The lead authority coordinates the investigation with other concerned DPAs. This aims to provide a single, coherent decision rather than a patchwork of conflicting rulings.

The AI Act adopts a similar but distinct model. For GPAI models, the European AI Office is the lead supervisor. For other high-risk AI systems, the lead authority is the one in the Member State where the provider is established. However, if a system is deployed in another country and causes a problem there, that country’s MSA can take urgent measures on its own territory. The OSS model is not a shield against local enforcement; it is a mechanism for coordinating a common position. It requires the company to engage substantively with one primary authority while keeping others informed.

Dispute Resolution and Consistency Mechanisms

When national authorities disagree on how to interpret a rule or how to enforce it, the EU has consistency mechanisms to resolve the dispute. The AI Act,