When a regulator asks about automated decisions: what to do first
A written enquiry about automated decisions is not an accusation. It is a request for evidence: what the system does, who reviewed its output, and how a person could contest the result. The first task is to freeze the file, name one internal owner, and answer only what the letter actually asks — nothing broader.
The legal basis
Automated decision systems that affect a person's rights or access to a service fall inside the scope of Regulation (EU) 2024/1689 (AI Act) once its obligations take full effect. The Regulation enters into force in stages, with the bulk of high-risk obligations applying from 2 August 2026 (status as of 4 June 2025). Where the system in question is not yet inside that stage, the enquiry still tests something narrower: whether the automated process was disclosed, documented and open to human review under the applicable data protection framework.
The letter itself will usually tell you which basis the regulator is working from. Read that line before drafting anything — it decides which file you are actually building.
What changes for you
A regulator's letter starts an internal clock even before any formal deadline is set. Evidence gathered under pressure is weaker than evidence prepared in advance, and a hurried answer can lock the company into a position it later needs to correct. The safer move is to treat the letter as the start of a file, not as a question to answer from memory.
The company's risk moves from theoretical to active the moment the letter is logged. From that point, what you do with the logs and the model version matters as much as what you eventually write back.
What to do first
- Log the enquiry the moment it arrives and record the exact date received — the response clock is measured from that date, not from when the letter is read.
- Assign one internal owner, typically the data protection lead or general counsel, who becomes the sole point of contact with the regulator.
- Freeze the relevant logs, the model version, and the decision records before anyone edits or adjusts the system in response to the enquiry.
- Map every automated decision made under the current model version, not only the single case the regulator names.
- Draft a factual chronology first, and a legal position second — the two documents serve different readers and should not be merged.
- Confirm with counsel whether the letter is an informal query or opens a formal file, since the two carry different obligations.
Who decides, and on what timeline
The authority that sent the letter decides how the file proceeds, and it decides on the record the company hands over, not on the system's stated intent. The table below sets out the stages without guessing at a timetable the letter has not yet given.
| Stage | Who acts | What starts the clock |
|---|---|---|
| First letter | Supervisory authority names a case handler | The date the letter is received, as stated in the letter itself |
| Documentation request | Company's named internal owner responds | The scope set out in the request, not a general statute |
| Formal investigation | Authority issues findings; company may respond and appeal | The decision itself, under the procedure the authority publishes |
If your situation is different
If the system was built on technology your company licensed rather than owns, the enquiry can turn into a dispute about who is actually accountable for the model's behaviour. Read When a licence is granted by a non-owner and ownership itself is unresolved before you answer for the model's conduct.
If the decision logic is itself protected technology currently being offered to you for sale, the two questions should not be handled by the same letter. See What to do first in this situation and what comes after, before agreeing to any transfer.
If a third-party integration feeds the data behind the automated decision, and that partner suffers a breach, the enquiry can widen beyond the original question. See When an integration partner leaks credentials explained for the separate sequence that follows.
If the automated decision feeds a token-based access or reward mechanism, and a partner distributes that token, the regulator's questions and the token questions run on different clocks. See When a partner distributes the token step by step for that separate procedure.
What this page does not answer
This page does not tell you whether a specific system qualifies as high-risk under the AI Act, and it does not draft the actual response letter. It does not cover a cross-border enquiry that spreads to more than one supervisory authority at once — that sequence follows its own procedure and its own clock.
Related reading
An enquiry about automated decisions sometimes grows into a cross-border matter, particularly if the same system serves users in more than one member state. For that sequence, see When an incident touches several countries in practice.
Verified
This page reflects the regulatory calendar as of 4 June 2025. Primary source: Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act). National procedural detail — which authority, which internal deadline — varies by regulator and is not set out on this page.
FAQ
What is the first step when a regulator asks about automated decisions?
Log the date the letter arrived, freeze the current model version and its logs, and name one internal owner before drafting any reply.
Which deadline is already running?
The clock set out in the regulator's own letter. Its length is stated in the document itself, not in a generic statute, and it runs from the date of receipt, not from the date you read it.
Who decides, and on what evidence?
The supervisory authority that sent the letter decides, and it decides on the record you hand over — the logs, the version history, and the chronology — not on your account of the system's intent.