A market surveillance authority is the national public body in an EU member state that oversees compliance with product and regulatory rules, including parts of the EU AI Act. In the AI incident context, it is the authority that receives and reviews certain serious-incident reports from providers of covered AI systems. Its role is not to investigate only classic cyber intrusions, but also harmful outcomes linked to AI behavior, such as unsafe decisions, rights impacts, or major disruption.
This matters because reporting is time-sensitive. Security and compliance teams need a way to decide quickly whether an AI-driven event is reportable, preserve evidence, and document causality. In practice, a complaint, audit finding, or downstream business failure may trigger the review, even when the model itself was not hacked. Defenders should know which authority is competent, who inside the organization can approve a report, and how to package logs, model versions, outputs, and human decision traces so the authority can assess the incident.