A request for information is not an ordinary inbox task
The European Commission's AI Act enforcement framework gives the AI Office powers to request information from organisations within its remit. A request may be informal or made through a Commission decision. The framework also provides for penalties where answers are incorrect or misleading, and, for decision-based requests, where a response is missing or incomplete.
The AI Office directly supervises general-purpose AI model obligations and certain AI systems embedded in very large online platforms or search engines. National competent authorities supervise many other AI systems. Even when your organisation is not the direct addressee, an upstream provider, customer or public authority may pass evidence questions down the supply chain.
This makes response readiness an operational capability. Legal interpretation matters, but the legal team cannot reconstruct system ownership, versions, evaluations and changes from memory after the clock starts.
Hours 0–4: authenticate, preserve and assign
Confirm the sender, legal basis, deadline, requested format and permitted response channel before distributing the request. Record the exact time received and retain the original message and attachments. Escalate it to legal counsel and the accountable AI governance owner.
Issue a focused preservation notice covering the named model, system, feature or business process. Preserve relevant versions, prompts and configuration, supplier identifiers, evaluations, incident records, user notices, approvals, change logs and communications. Do not silently repair or overwrite evidence that may explain the historical state.
Name one response lead, one legal reviewer and one evidence coordinator. Create a question register so each request has an owner, status, evidence references and a clearly recorded uncertainty.
Hours 4–12: define scope before collecting files
Connect every question to the AI inventory. Confirm the intended purpose, actual use, provider and deployer roles, deployment geography, model and application versions, affected customers or users, and relevant suppliers.
Then build an evidence map. For each requested fact, identify the authoritative record, record owner, version, approval state and date. Distinguish documents that existed at the relevant time from material created for the response. A newly written explanation may be useful, but it is not a substitute for contemporaneous evidence.
Where a request reaches beyond your records, log the gap and the action taken to obtain the information. Unsupported confidence is more dangerous than an explicit, managed uncertainty.
Hours 12–30: assemble a traceable response pack
A practical pack starts with the request, scope note and question register. It should then include the system record, role assessment, evidence index, applicable risk and control records, relevant evaluations, monitoring or incident material, change history and supplier evidence.
Draft answers at the level of the question asked. Link each material statement to an indexed source and avoid broad claims such as “fully compliant” where the evidence only supports a narrower conclusion. Separate facts, interpretation and remediation commitments.
Apply access controls and data minimisation. The Commission's investigative powers do not remove the need to manage personal data, confidential information, security-sensitive material and legal privilege appropriately. Legal counsel should direct disclosure decisions.
Hours 30–48: challenge, approve and submit
Run a two-person factual review against the evidence index. Check names, dates, system versions, role descriptions and numerical claims. Look specifically for contradictions between policies, system records, supplier statements and actual operating evidence.
Confirm that every question is answered, marked not applicable with a reason, or identified as outstanding with an agreed delivery date. Record who approved the final response, what was submitted, when it was submitted and the acknowledgement received.
After submission, retain the response pack as a controlled record. Convert any missing evidence, unclear ownership or weak retention revealed by the exercise into owned corrective actions.
Test the capability before a request arrives
Select one important AI system and run a 48-hour tabletop exercise. Ask the team to produce its current owner, intended purpose, role assessment, model and supplier versions, approval record, principal risks, control evidence, evaluation results, incidents and material changes.
If the evidence cannot be assembled quickly, the problem is usually not the final response template. It is an incomplete inventory, unclear ownership or evidence stored across inboxes and personal drives. Start with the AI governance readiness check, then use our complaint response playbook for the related incident workflow.
AI Act Ready helps organisations build an evidence-led governance system before scrutiny arrives. The goal is not to predict every question. It is to make accurate answers reproducible.