Which entities are authorized to audit these ten-year records?

Under the EU AI Act, the ten-year compliance records must be kept at the disposal of specific regulatory and supervisory bodies. Additionally, market dynamics dictate that certain business entities will also demand access to them.

The entities specifically authorized to access and audit these records include:

• -National competent authorities: providers and their authorised representatives are legally required to keep their technical documentation, quality management system records, conformity declarations, and notified body certificates at the disposal of national competent authorities (which include designated market surveillance authorities and notifying authorities) for 10 years. Importers are similarly required to provide these records upon a reasoned request.
• -The European AI Office: for general-purpose AI models, authorised representatives must keep technical documentation at the disposal of both the AI Office and national competent authorities for a period of 10 years after the model is placed on the market.
• -Authorities protecting fundamental rights: national public authorities or bodies that supervise the protection of fundamental rights (such as data protection authorities and equality bodies) have the legal power to request and access any documentation created or maintained under the Act if it is necessary to fulfill their mandates.

Business and operational audits

Beyond official regulatory bodies, the practical reality of deploying AI means companies must also present these records to private entities. Because compliance attaches to real-world deployments, enterprise customers, internal boards, and third-party auditors routinely expect immediate access to these readiness and compliance records during procurement, risk assessments, or internal audits.