Regulation (EU) No 290/2012
For the purpose of determining compliance with the relevant requirements of Regulation (EC) No 216/2008 and its Implementing Rules, the organisation shall grant access to any facility, aircraft, document, records, data, procedures or any other material relevant to its activity subject to certification, whether it is contracted or not, to any person authorised by:
(a) the competent authority defined in ORA.GEN.105; or
(b) the authority acting under the provisions of ARA.GEN.300(d), ARA.GEN.300(e) or ARO.RAMP.