sota.io
2026-04-25·16 min read·sota.io team

EU AI Act Art.89: Right to Be Heard Before Enforcement Measures — Developer Response Guide (2026)

EU AI Act Article 89 is the procedural due process guarantee that sits between an enforcement authority's investigation and its final measure. Before any National Competent Authority (NCA) or the AI Office adopts a corrective measure, market withdrawal order, prohibition, or penalty decision against a provider or deployer, Art.89 requires that person or entity to have the opportunity to be heard. Written observations. An oral hearing upon request. Access to the enforcement file. These are not optional — they are mandatory prerequisites that can be challenged on appeal if bypassed.

Art.89 is the enforcement counterpart to the individual-rights chain of Art.85–Art.88. Where Art.85 gives affected persons recourse against AI-assisted decisions, Art.86 gives them explanations, Art.87 gives them complaint access, and Art.88 protects those who report violations internally, Art.89 protects the organisations themselves from enforcement actions taken without a fair hearing. It operationalises the audi alteram partem principle — hear the other side — at the intersection of AI governance and EU administrative law.

For developers and compliance teams, Art.89 matters most when an investigation has already begun: when a Market Surveillance Authority has made a preliminary finding, when the AI Office has issued a statement of objections to a GPAI model provider, or when corrective measures are being considered. At that point, the Art.89 window is the last opportunity to present evidence, challenge proportionality, and reduce the scope or severity of what follows.

Art.89 became applicable on 2 August 2026, concurrent with the full application of the Regulation's enforcement provisions.

Art.89 in the Enforcement Architecture

Art.89 occupies the procedural-rights tier of the enforcement chain. It connects the investigation phase (Art.74 for NCA, Art.90–Art.92 for AI Office) to the final measure phase (Art.79 risk procedure, Art.80 Union safeguard, Art.82 non-compliance notification, Art.99 penalties, Art.93 interim measures).

StageArticleAuthorityTrigger
Post-market monitoringArt.72ProviderContinuous performance tracking
Serious incident reportingArt.65Provider → NCA15-day notification obligation
Market surveillance powersArt.74NCAOn-site access, document requests
Risk procedure at national levelArt.79NCACorrective measure for presenting risk
Union safeguard procedureArt.80CommissionEU-wide harmonisation of NCA measure
Non-compliance notificationArt.82NCA → CommissionNon-corrective formal non-compliance
Right to be heardArt.89NCA / AI OfficeBefore any enforcement measure
PenaltiesArt.99NCA / AI OfficeFinal enforcement decision
AI Office information requestsArt.90AI OfficeGPAI investigation preliminary step
AI Office inspectionsArt.91AI OfficeOn-site and remote GPAI investigation
AI Office interim measuresArt.93AI OfficeUrgency exception — bypasses Art.89 standard window

Art.89 does not apply to inspection authorisations under Art.91 or information requests under Art.90 — those are investigation steps, not enforcement measures. Art.89 is triggered when the authority moves from investigation to a decision that would adversely affect the subject's market position.

Art.89(1): The Hearing Obligation

Art.89(1) establishes the core rule: the AI Office and NCAs must give persons against whom a measure is addressed the opportunity to be heard before adopting any measure.

"Any measure" in practice means:

Persons entitled to the hearing include:

Art.89(2): Written Observations — Minimum 10 Working Days

Art.89(2) operationalises the hearing right. The authority must send the subject a statement of objections or preliminary findings document setting out the basis for the proposed measure. The subject then has a minimum of 10 working days from receipt to submit written observations.

Critical timing notes:

What to include in written observations:

ElementPurposeArt.89 Impact
Factual correctionsChallenge incorrect findings of factNarrows the evidential basis for the measure
Legal argument on proportionalityShow the proposed measure exceeds what is necessaryCan reduce measure scope under Art.79(2) proportionality requirement
Remediation plan with timelineDemonstrate capacity to correct without withdrawalSupports voluntary compliance path over market withdrawal
Technical expert evidenceAddress AI system performance claimsCounters NCA or AI Office technical assessment
Mitigating factorsPrior compliance record, self-reporting, cooperationDirectly relevant to Art.99 penalty calculation
Third-party declarationsDeployer usage data, affected-person impact evidenceSupports or challenges the claimed risk assessment

Art.89(3): Oral Hearing Upon Request

Art.89(3) gives the subject the right to request an oral hearing in addition to written observations. The authority must grant this request unless the proposed measure is an interim measure under Art.93.

When to request an oral hearing:

Oral hearing logistics:

Art.89(4): File Access Rights

Art.89(4) gives the subject access to the enforcement file — the documents on which the authority intends to base its decision.

What the file includes:

Confidentiality carve-outs: The authority may redact or withhold documents that contain:

Strategy: Request file access immediately upon receiving the statement of objections. Review what is disclosed to identify whether the authority has relied on information you have not seen. If key documents appear to be missing or heavily redacted, challenge the redaction decision as part of your written observations — the authority must explain the basis for non-disclosure.

Art.89(5): Urgency Exception — Interim Measures Under Art.93

Art.89(5) establishes the critical exception: the full Art.89 hearing procedure does not apply to interim measures adopted under Art.93. The AI Office may adopt interim measures immediately where there is evidence of a serious risk posed by a GPAI model with systemic risk, without waiting for written observations.

But Art.89(5) is not a blanket bypass. Two constraints apply:

  1. After the interim measure is adopted, the AI Office must give the subject the opportunity to be heard as soon as possible
  2. The interim measure lasts a limited period (renewable but subject to proportionality review) and must be followed by a full enforcement measure that does comply with Art.89

Challenging interim measures:

Dual-Track Enforcement: NCA vs AI Office

Art.89 applies across both enforcement tracks, but the procedural context differs significantly:

DimensionTrack 1: NCA (High-Risk AI)Track 2: AI Office (GPAI Models)
Triggering measureArt.79 risk procedure, Art.82 non-complianceArt.62 corrective measures, Art.93 interim, Art.94 commitments
AuthorityNational Competent Authority (designated under Art.57)AI Office (Commission body under Art.64)
Applicable jurisdictionMember State territoryEU-wide (all GPAI models in scope)
Art.89 hearing bodyNCA (national administrative process)AI Office (EU-level process)
Appeal pathNational administrative courts → preliminary reference CJEUGeneral Court (Art.263 TFEU) → CJEU on appeal
Penalty gatewayArt.99(1) for providers, Art.99(2) for deployers via NCAArt.101(1)-(3) for GPAI model providers via AI Office
Interim measuresArt.79(2) corrective measure as de facto interimArt.93 formal interim measure regime
Settlement/commitmentsNot formally provided in Art.79Art.94 formal commitments procedure

GPAI model providers face the more complex enforcement environment. The AI Office can combine Art.90 information requests, Art.91 inspections, Art.92 interviews, Art.93 interim measures, and Art.94 commitments — all with Art.89 hearings at each decisive step. The procedural complexity justifies dedicated EU-level legal counsel.

CLOUD Act Exposure in Enforcement Proceedings

Art.89 enforcement files contain some of the most sensitive documentation in the AI Act compliance cycle: technical assessments of your AI system, your written observations challenging the authority's findings, legal strategy documents, proportionality arguments, and remediation plans.

If these documents are stored on US cloud infrastructure, they are potentially compellable under the US CLOUD Act (18 U.S.C. § 2713) by US law enforcement — regardless of EU-law confidentiality protections.

Five categories of enforcement-sensitive data:

Data CategoryCLOUD Act Compellability RiskEU Mitigation
Art.89 written observations (legal strategy)HIGH — legal memo equivalentStore on EU-sovereign infrastructure only
Technical expert declarationsMEDIUM — technical data with commercial sensitivityEU cloud or on-premises
Annex IV technical documentation (basis of authority's findings)HIGH — core IP + compliance evidenceEU-sovereign mandatory for all tech docs
Post-market monitoring logs (Art.72) cited in preliminary findingsMEDIUM — operational dataEU cloud at minimum
Legal counsel correspondenceHIGH — legal professional privilege potentially waiveable under US lawEU law firm, EU-sovereign comms platform

Practical implication: If your Art.89 written observations are stored in a US-incorporated SaaS document management platform, your EU enforcement defence strategy is accessible to US government requests. EU-sovereign infrastructure severs this exposure. When planning your enforcement response, assess the storage jurisdiction of all documents you will include in or reference from your Art.89 submission.

Python: Art89HearingManager

from dataclasses import dataclass, field
from datetime import date, timedelta
from typing import Optional
from enum import Enum

class EnforcementTrack(Enum):
    NCA_HIGH_RISK = "nca_high_risk"
    AI_OFFICE_GPAI = "ai_office_gpai"

class HearingStatus(Enum):
    STATEMENT_RECEIVED = "statement_received"
    FILE_ACCESS_REQUESTED = "file_access_requested"
    FILE_REVIEWED = "file_reviewed"
    ORAL_HEARING_REQUESTED = "oral_hearing_requested"
    OBSERVATIONS_SUBMITTED = "observations_submitted"
    ORAL_HEARING_HELD = "oral_hearing_held"
    MEASURE_ADOPTED = "measure_adopted"
    APPEALED = "appealed"

@dataclass
class StatementOfObjections:
    received_date: date
    authority_name: str
    track: EnforcementTrack
    proposed_measure: str
    preliminary_findings_summary: str
    is_interim_measure: bool = False

    def observation_deadline(self) -> date:
        """Minimum 10 working days from receipt (Art.89(2))."""
        if self.is_interim_measure:
            return self.received_date  # urgency: no standard window
        working_days = 0
        current = self.received_date
        while working_days < 10:
            current += timedelta(days=1)
            if current.weekday() < 5:  # Mon-Fri
                working_days += 1
        return current

    def days_remaining(self) -> int:
        deadline = self.observation_deadline()
        delta = (deadline - date.today()).days
        return max(0, delta)

@dataclass
class HearingResponsePlan:
    statement: StatementOfObjections
    factual_corrections: list[str] = field(default_factory=list)
    proportionality_arguments: list[str] = field(default_factory=list)
    remediation_plan: Optional[str] = None
    mitigating_factors: list[str] = field(default_factory=list)
    file_access_requested: bool = False
    oral_hearing_requested: bool = False
    legal_counsel_engaged: bool = False
    cloud_act_review_done: bool = False

    def readiness_score(self) -> dict:
        checks = {
            "file_access_requested": self.file_access_requested,
            "oral_hearing_requested": self.oral_hearing_requested,
            "legal_counsel_engaged": self.legal_counsel_engaged,
            "factual_corrections_drafted": bool(self.factual_corrections),
            "proportionality_argued": bool(self.proportionality_arguments),
            "remediation_plan_exists": bool(self.remediation_plan),
            "mitigating_factors_documented": bool(self.mitigating_factors),
            "cloud_act_review_done": self.cloud_act_review_done,
        }
        score = sum(1 for v in checks.values() if v)
        return {"score": score, "max": len(checks), "items": checks}

class Art89HearingManager:
    def __init__(self, statement: StatementOfObjections):
        self.statement = statement
        self.plan = HearingResponsePlan(statement=statement)
        self.status = HearingStatus.STATEMENT_RECEIVED

    def assess_urgency(self) -> dict:
        days_left = self.statement.days_remaining()
        urgent = days_left <= 3
        return {
            "deadline": self.statement.observation_deadline().isoformat(),
            "days_remaining": days_left,
            "urgent": urgent,
            "is_interim_measure": self.statement.is_interim_measure,
            "action": (
                "Immediate: engage counsel + request file access today"
                if urgent else
                "Normal: request file access within 48h, draft observations"
            ),
        }

    def request_file_access(self) -> str:
        self.plan.file_access_requested = True
        self.status = HearingStatus.FILE_ACCESS_REQUESTED
        return (
            f"File access requested from {self.statement.authority_name}. "
            f"Track: {self.statement.track.value}. "
            f"Observation deadline: {self.statement.observation_deadline().isoformat()}."
        )

    def request_oral_hearing(self) -> str:
        if self.statement.is_interim_measure:
            return "Art.89(5): oral hearing not available before interim measure adoption."
        self.plan.oral_hearing_requested = True
        self.status = HearingStatus.ORAL_HEARING_REQUESTED
        return "Oral hearing requested. Prepare technical experts and legal counsel for attendance."

    def add_proportionality_argument(self, argument: str) -> None:
        self.plan.proportionality_arguments.append(argument)

    def add_mitigating_factor(self, factor: str) -> None:
        self.plan.mitigating_factors.append(factor)

    def set_remediation_plan(self, plan_description: str) -> None:
        self.plan.remediation_plan = plan_description

    def check_cloud_act_exposure(self, storage_jurisdictions: list[str]) -> dict:
        us_exposed = any("us" in j.lower() or "aws" in j.lower()
                         or "azure" in j.lower() or "gcp" in j.lower()
                         for j in storage_jurisdictions)
        self.plan.cloud_act_review_done = True
        return {
            "us_cloud_exposure": us_exposed,
            "risk": "HIGH — Art.89 observations compellable under US CLOUD Act" if us_exposed else "LOW",
            "recommendation": (
                "Migrate enforcement file to EU-sovereign infrastructure before Art.89 submission"
                if us_exposed else
                "Storage jurisdiction acceptable for Art.89 documents"
            ),
        }

    def generate_response_summary(self) -> dict:
        readiness = self.plan.readiness_score()
        return {
            "case": {
                "authority": self.statement.authority_name,
                "track": self.statement.track.value,
                "proposed_measure": self.statement.proposed_measure,
                "observation_deadline": self.statement.observation_deadline().isoformat(),
                "days_remaining": self.statement.days_remaining(),
            },
            "response_readiness": readiness,
            "status": self.status.value,
        }

Usage:

statement = StatementOfObjections(
    received_date=date(2026, 9, 15),
    authority_name="Bundesnetzagentur (Germany NCA)",
    track=EnforcementTrack.NCA_HIGH_RISK,
    proposed_measure="Market withdrawal of AI-assisted credit scoring system",
    preliminary_findings_summary="System produces discriminatory outputs in protected class cases",
)

manager = Art89HearingManager(statement)
print(manager.assess_urgency())
print(manager.request_file_access())
print(manager.request_oral_hearing())

manager.add_proportionality_argument(
    "Market withdrawal is disproportionate: system affects < 2% of decisions; "
    "targeted corrective measure sufficient under Art.79(2)"
)
manager.add_mitigating_factor(
    "Provider self-reported anomaly via Art.72 post-market monitoring "
    "three months before formal NCA investigation began"
)
manager.set_remediation_plan(
    "Bias-correction patch deployment within 30 days; "
    "re-testing against NCA's test dataset; "
    "independent third-party audit report by Day 45"
)

cloud_result = manager.check_cloud_act_exposure(["AWS us-east-1", "internal on-prem EU"])
print(cloud_result)

summary = manager.generate_response_summary()
print(summary)

Art.89 Series: Chapter VIII Individual Rights Chain

ArticleTitleDeveloper Relevance
Art.72Post-Market MonitoringGenerates the performance data NCAs use in Art.79 investigations
Art.74Market Surveillance PowersNCA investigation powers that precede Art.89
Art.79Risk Procedure at National LevelThe NCA corrective measure process Art.89 gates
Art.80Union Safeguard ProcedureCommission-level Art.89 hearing if NCA measure is reviewed EU-wide
Art.82Formal Non-Compliance NotificationNCA notification to Commission — Art.89 required before this
Art.85Right of RecourseIndividual's challenge right — separate from Art.89 provider rights
Art.86Right to ExplanationExplanation obligation whose denial triggers Art.87 complaint
Art.87Complaints to MSAThird-party complaint may be what triggers the Art.89 proceeding
Art.88Whistleblower ProtectionInternal disclosure may trigger the investigation preceding Art.89
Art.89Right to Be HeardProvider/deployer hearing before any enforcement measure
Art.90AI Office Information RequestsGPAI investigation step preceding Art.89 (Track 2)
Art.91AI Office Inspection PowersInspection evidence becomes basis for Art.89 preliminary findings
Art.93AI Office Interim MeasuresUrgency exception — bypasses standard Art.89 window
Art.94Commitments DecisionsAI Office settlement path — Art.89 hearing integral to commitments process
Art.99PenaltiesFinal enforcement stage that Art.89 gates and shapes

30-Item Enforcement Readiness Checklist

Preparation (Before Any Investigation)

When Statement of Objections is Received

Observations Drafting

File Review

Oral Hearing Preparation

Post-Hearing

Interim Measures (Art.93 Urgency Path)

See Also