The European Commission has opened feedback on a draft implementing regulation setting out how the AI Office will run enforcement proceedings against the AI systems it supervises directly. The draft, Ares(2026)9589403 of 12 October 2026, is on the Have your say portal until 9 November 2026. By 6 November, 17 responses had been registered. Adoption is planned for the fourth quarter of 2026. The text reflects only the preliminary views of Commission services.
It covers access to the Commission's file, the protection of business secrets, and limitation periods for fines and periodic penalty payments. Its legal basis is Articles 75c(8) and 75d(3) of the AI Act, inserted by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026.
Which AI systems does the AI Office supervise itself?
Amended Article 75(1) gives the AI Office exclusive competence over two groups of systems: those based on a general-purpose AI model where model and system come from the same provider or undertaking, and those that constitute or are integrated into very large online platforms or search engines designated under the DSA.
Under Article 75a the AI Office has the powers of a market surveillance authority, including information requests and remote or on-site inspections. Under Article 75c it can find non-compliance and impose fines under Article 99: up to EUR 15 million or 3% of worldwide annual turnover for most infringements, and up to EUR 7.5 million or 1% for incorrect, incomplete or misleading information. Periodic penalty payments may reach 5% of average daily income or worldwide annual turnover per day. Proceedings against general-purpose model providers as such follow a separate text, Implementing Regulation (EU) 2026/1755 of 20 July 2026.
File access only after preliminary findings
Under draft Article 2, the operator sees the file only after the AI Office notifies its preliminary findings. It first receives the documents cited in the findings, with business secrets redacted. Unredacted access is possible under terms set by Commission decision, and only for named external counsel and technical experts who are not the operator's employees. If one of them joins the operator, or a company on the same markets, during the investigation or within three years after it, the Commission must be told. Under draft Article 3, where the Commission means to disclose information claimed as confidential, the party gets one week to object, and a reasoned decision cannot allow disclosure sooner than one week after notification.
How the five-year limitation period runs
Article 75c(8) gives five years to impose penalties and five years to enforce them. Under draft Article 4, for continuing or repeated non-compliance, time starts when the conduct ends. Information requests, requests for system evaluations, inspections, invitations to a structured dialogue, and the opening or re-opening of proceedings all interrupt the period, and each interruption restarts it. The outer limit is ten years without a penalty, extended by suspensions, which apply while a decision is before the Court of Justice and while an on-site inspection awaits judicial authorisation.
Filings must be digital and carry at least one qualified electronic signature under the eIDAS Regulation (draft Article 8). Unlike Regulation 2026/1755, which it otherwise mirrors, the draft sets no minimum reply period for written observations; draft Article 7 requires the Commission to have regard to the right to be heard when setting time limits.
What it means for Turkish and Korean companies
The AI Act reaches providers placing AI systems on the EU market irrespective of where they are established (Article 2(1)(a)). A Turkish or Korean group that trains its own general-purpose model and offers an assistant built on it to EU users would, for that system, deal with the AI Office in Brussels rather than with national authorities. Its filings would need an eIDAS-compliant qualified signature, and each investigative step could extend its exposure towards the ten-year ceiling. Korea's AI Basic Act caps administrative fines at KRW 30 million, according to Cooley's January 2026 overview.
Our October report covers the first information requests to model providers; see also the moved high-risk deadlines and our AI Act overview.
Sources: European Commission, draft Implementing Regulation Ares(2026)9589403 and Have your say initiative 19292 (12 October 2026); European Commission, “AI omnibus enters into force” (27 July 2026); AI Act Service Desk, consolidated Regulation (EU) 2024/1689 (as at 27 July 2026); Implementing Regulation (EU) 2026/1755 (20 July 2026); Cooley, South Korea’s AI Basic Act overview (27 January 2026). General information, not legal advice.
