When a supervisory authority sends a first request: what to do first
When a supervisory authority sends a first request, treat it as a procedural step, not correspondence to be answered informally. Confirm receipt, identify the legal basis the letter cites, and calendar the deadline it states. Do not send a substantive reply before someone with authority to bind the organisation has reviewed scope and privilege. Assign one internal owner immediately; several people answering the same authority undermines the file from day one.
What governs the request
Which framework applies depends on who sent the letter, not on what the letter is about in general terms. If the sender is a national competent authority acting under When a breach is discovered by a customer: what-type incidents fall under, the reference point is Directive (EU) 2022/2555 (NIS2), which sets out reporting and security obligations for essential and important entities.
If the sender is a market surveillance authority reviewing an artificial intelligence system, the reference point is Regulation (EU) 2024/1689 (AI Act), which governs providers and deployers of AI systems placed on the market or put into service. If neither of these applies, the letter most likely comes from a national data protection authority. Its investigative powers rest in national implementing law, and this page does not name a specific article, because no confirmed record for that national provision is held here. That omission is deliberate: a wrong article number is worse than no article number.
What changes once the letter arrives
A first request starts a clock even before it names a deadline explicitly. Silence beyond the stated period is treated as non-cooperation, and non-cooperation is assessed separately from whatever the underlying matter turns out to be. From the moment the letter is logged, every document the organisation creates about it becomes part of the record the authority may later rely on. Accuracy in that record matters more than speed in producing it.
What to do
- Log the request the day it arrives: date received, sender, channel, and reference number.
- Route the letter to the person authorised to sign correspondence with the authority before any reply is drafted.
- Confirm the deadline stated in the letter; if none is stated, ask the authority in writing to confirm one.
- Reconstruct the underlying facts internally — what happened, when, and who is affected — before speaking to the authority.
- Have counsel review scope and privilege before any document leaves the organisation.
- Send an acknowledgement within the stated period, even if the substantive reply needs more time.
Who decides
The authority that sent the request decides how the file proceeds, based on what it receives from that point onward. Which desk within that authority handles the file depends on the sender.
| Sender type | What it typically requests | Who inside the organisation should answer |
|---|---|---|
| National competent authority under NIS2 | Details of a security incident or the measures taken to address it | The person responsible for cybersecurity governance |
| Market surveillance authority under the AI Act | Documentation supporting an AI system's conformity | The person who holds the AI system's compliance file |
| National data protection authority | An explanation of a processing activity or a complaint received | The data protection lead or equivalent internal function |
Forks
If the request touches a licensed dataset alongside the main question, recording status can determine who must answer for it: When a licence must be recorded to be effective sets out that separate mechanism.
If a patent dispute surfaces at the same time as the authority's letter, that thread runs on its own timeline and should not be folded into the response: When a competitor files a patent application next to covers the first moves there.
If the customer relationship behind the request also raises a contract dispute, keep the two files apart: When a customer demands unlimited liability explained addresses that separately.
If the organisation also issues tokens and the authority's questions overlap with an offering, a parallel clock can start: When the offering document is questioned and the deadline sets out that separate procedure.
Limits
This page does not assess the merits of any specific finding a supervisory authority might reach. It does not state a deadline that is not already confirmed by the letter itself, and it does not recommend a substantive response without that letter having been reviewed. Where national implementing law governs the authority's powers and no confirmed record for that provision exists here, the page says so rather than guessing.
Verified
Verified 4 March 2025. Primary sources referenced above: Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2024/1689 (AI Act). No national implementing provision is cited on this page pending a confirmed record.
Related publications
A related first-response situation, triggered by a different kind of event: When a breach is discovered by a customer: what.
FAQ
What is the first step when a supervisory authority sends a first request?
Confirm receipt in writing, identify who signed the letter and under what authority, and calendar the deadline before drafting any substantive answer.
Which deadline is already running?
The deadline stated in the letter starts on receipt, not on your acknowledgement. If no deadline is stated, ask the authority to confirm one rather than assuming a default period applies.
Who decides, and on what evidence?
The authority that sent the request decides, based on the file both sides build from this point: the request itself, your response, and anything exchanged afterward.