A Hospital Procurement Team Just Asked What Happens If Your AI Imaging Tool Is Inspected by a Market Surveillance Authority: Answering the Article 74 Questions
A hospital procurement team just asked what happens if your AI imaging tool is inspected by a market surveillance authority: answering the Article 74 questions
Your enterprise health system account manager sent the question at the start of the week. A university hospital system in Germany is completing vendor due diligence on your AI medical imaging analysis tool. Their legal and clinical governance teams have aligned on the purchase, but one question from their risk committee is blocking final sign-off:
"What is your process if a market surveillance authority — the BfArM or a regional authority — requests access to your technical documentation, logs, or the system itself under Article 74 of the EU AI Act? How do you ensure our operations are not disrupted during an inspection?"
This question reflects increasing sophistication among healthcare procurement teams about what EU AI Act enforcement actually looks like in practice. Here is what Article 74 requires and how to answer it.
What Article 74 Gives Market Surveillance Authorities the Power to Do
Article 74 grants national market surveillance authorities — in Germany this is primarily the BfArM for medical devices and AI systems in that category — access rights and powers to verify compliance with the EU AI Act for high-risk AI systems.
These powers include: the right to access all technical documentation and information necessary to assess compliance; the right to request access to the training data, validation data, and test data used to develop the system if necessary to assess compliance with data governance requirements; and the right to conduct on-site inspections and test the AI system, including accessing it remotely.
Authorities can also request that providers take corrective measures, withdraw a product from the market, or restrict its use, if they find it presents unacceptable risks or does not comply with the high-risk requirements.
For your customer, this creates a legitimate risk management question: if an authority inspects your tool, what is the impact on their operations?
What Preparedness Looks Like as a Provider
The hospital's question is asking whether you are prepared for this scenario — not whether you are non-compliant. A well-prepared answer demonstrates that you have an inspection readiness process and that it is designed not to disrupt your customers.
Technical documentation readiness. Article 74 access requests begin with documentation. Your answer should confirm that your Annex IV technical documentation is complete, current, and can be provided to a competent authority within a defined timeframe — typically stated as "within [X] business days of a formal request." A provider who cannot retrieve their technical documentation quickly creates operational uncertainty for every customer during an inspection.
Log and data access process. Authorities may request access to the automatic logs generated under Article 12 or the data sets used to develop and validate the system. Your answer should describe whether logs are retained in a format accessible to authorities, and whether data sets are retained in a retrievable form or summarised in documentation. If your system is built on a third-party model, describe how you have access to the documentation needed to respond to authority requests about the underlying model.
Customer-facing continuity. The hospital is asking whether an inspection would disrupt their operations. The answer is that an authority inspection does not require the system to go offline. Inspections are primarily documentary reviews. If an authority requires a live system test, your process should be to conduct this in a controlled environment, not by interrupting clinical workflows. State this explicitly.
Notification protocol. Your customers should know that if you receive a formal inquiry from a market surveillance authority related to an installation at their facility, you will notify them promptly and keep them informed throughout the process. This is not only good practice — it is expected by enterprise health system procurement teams who have their own regulator relationships to manage.
The Practical Answer
A direct answer to the question looks like this:
"We maintain inspection-ready technical documentation under Annex IV and Article 11. If we receive a formal request from a market surveillance authority — including the BfArM or regional authorities — we respond to documentation requests within [X] business days. Authority inspections are documentary reviews and do not require service interruption. Live system tests, if requested, are conducted in a controlled environment to protect clinical workflows. We notify affected customers at the point we receive a formal inquiry and provide updates throughout the process. Our legal and compliance team manages all authority communications and is available to coordinate with your governance team if needed."
This answer closes the question, demonstrates preparedness, and positions you as a vendor that treats regulatory transparency as a customer service commitment rather than a threat.
Why This Question Will Become Standard
Healthcare is the sector where market surveillance authorities are most likely to exercise their Article 74 powers first, because the patient safety stakes are highest and the regulator relationships are most established. Hospital procurement teams who ask this question now are protecting their institutions before an enforcement landscape develops. The vendors who can answer it precisely — not with boilerplate, but with documented process — are the ones who build durable relationships with health system customers.
Try Complizo free at complizo.com