Filing a complaint under the AI Act and how enforcement works

Short answer: Anyone who believes an AI system breaches the AI Act can lodge a complaint with the national market surveillance authority, which is obliged to handle it. The supervisor investigates, can request documentation and, if needed, impose measures or fines. Where personal data are also involved, a parallel route runs through the privacy regulator.

Who can complain and about what

The AI Act gives any natural or legal person the right to lodge a complaint with a market surveillance authority about a suspected infringement. You need not be directly affected. Complaints may concern prohibited practices, high-risk systems that fail to meet their obligations, or a lack of transparency. Which national supervisor is competent depends on sector and country.

The steps of the process

In broad terms, enforcement proceeds as follows:

• Report — you file the complaint with the competent supervisor, with the most concrete substantiation possible.
• Assessment — the supervisor decides whether the complaint falls within its mandate and whether there are grounds to investigate.
• Investigation — the supervisor can request technical documentation, log files and information; for high-risk systems also the conformity documentation.
• Measure — on finding an infringement, the supervisor can require corrective measures, have the system withdrawn from the market or impose a fine.
• Decision and appeal — the decision is reasoned; the company concerned can object and appeal.

What the supervisor can enforce

Market surveillance authorities have binding powers: access to documentation, setting a deadline to bring a system into compliance, and ultimately banning or recalling a system. Fines run up to EUR 35 million or 7% of worldwide annual turnover for the most serious infringements. For GPAI models, enforcement runs not through the national route but through the AI Office.

Overlap with the GDPR

Where a complaint also concerns personal data — for example with profiling or biometrics — the same case may fall under both the AI Act and the GDPR. In the Netherlands the Data Protection Authority is then a natural channel. A single set of facts can thus lead to two parallel investigations.

What to do

• Gather evidence: describe the system, the provider and the suspected defect as concretely as possible.
• Choose the right channel: model or application, and which sector — see national supervisors.
• Consider the GDPR route where personal data are involved.
• For organisations: make sure your audit documentation is in order, as it is requested first.
• Know the financial risks: see fines and enforcement.