EU AI enforcement draft: feedback closes 9 November

Businesses potentially facing European Commission AI enforcement have four days left to comment on proposed rules for handling investigations. The Have Your Say feedback period closes on 9 November 2026, making this week the last opportunity to flag practical problems before the draft moves forward.

What's changing

The draft Commission Implementing Regulation would establish practical procedures for Commission proceedings under Articles 75c and 75d of Regulation (EU) 2024/1689, the EU AI Act. Its focus is how enforcement works: access to evidence, protection of confidential information, submission requirements and time limits. It does not propose new AI safety standards.

The draft reference, Ares(2026)9589403, was dated 12 October 2026. The document remains unadopted and unendorsed, so these proposed duties are not binding now. There is no established start date. If adopted, the implementing regulation would take effect on the twentieth day after publication in the Official Journal—not twenty days after the consultation closes.

One important proposal concerns access to the Commission's investigation file. An operator could request access after receiving preliminary findings, but not before those findings were notified. Documents mentioned in the findings would be available with confidential information removed.

Broader access to unredacted material would generally be channelled through approved external lawyers, economic advisers or technical experts. Those advisers could use the material only in permitted proceedings and could not pass it to anyone outside the agreed disclosure arrangements, including company staff. Businesses should therefore consider how their teams could instruct advisers and respond to findings when some evidence cannot be shared internally.

Confidentiality would also require active management. A business claiming protection would need to identify the specific passages concerned, explain why they should remain confidential and supply clearly redacted versions within Commission deadlines. If it missed those requirements, the Commission could treat the information as non-confidential. A blanket confidentiality label would not substitute for the proposed passage-by-passage process.

Digital submissions would be the default, with at least one Qualified Electronic Signature required. Crucially, uploading or sending a file would not itself establish receipt: that would depend on the Commission's acknowledgement. Unusable files or signatures that could not be verified would count as not received, although there would be an opportunity to correct them.

Finally, the draft proposes five-year time limits for imposing penalties and enforcing final penalty decisions. Specified investigative or enforcement steps could restart those periods, while court proceedings and other listed circumstances could pause them. The draft creates no penalties of its own and no new penalty ceilings.

Who is affected

This is an EU-level proposal concerning European Commission enforcement. It is not a measure from an individual member state, and it does not cover every business that uses AI.

The described scope includes AI systems built on general-purpose AI models where the system and model are supplied by the same provider, or by providers within the same business group. It also includes AI systems forming part of designated very large online platforms or very large online search engines.

That makes the draft particularly relevant to integrated AI providers, corporate groups supplying both models and systems, and providers or deployers connected with the designated platform and search-engine category. Legal, technical and compliance teams could all become involved in producing evidence or responding to findings.

Company size alone is not a reliable scope test. The relevant questions are the system's relationship to its underlying model, the relationship between the providers, and whether the system forms part of a designated service. Smaller suppliers should not assume they are covered simply because they sell an AI product; larger businesses should not assume all their AI activities fall within this procedure.

Three things to do this week

1. Map your exposure and submit focused feedback. Identify systems and model providers within your group, then check any connection with designated very large platforms or search engines. Before 9 November, use Have Your Say to explain concrete concerns, such as whether restricted adviser access would make a technical response difficult. Separate objections to the proposed procedure from broader views about AI regulation.

2. Test a confidentiality and evidence workflow. Choose a representative document and practise identifying protected passages, recording reasons and creating a readable redacted copy. Decide who would approve confidentiality claims and which external advisers could handle restricted evidence. This is preparation for a possible future procedure, not a claim that the draft already requires these steps.

3. Check digital submission readiness. Confirm access to a Qualified Electronic Signature and test file readability and signature verification. Design a checklist that records the Commission's acknowledgement rather than treating an upload timestamp as proof of receipt. Allow time to correct rejected files, and plan to track events that could restart or pause penalty limitation periods.

Related context

The parent EU AI Act, Regulation (EU) 2024/1689, was adopted on 13 June 2024 and published on 12 July 2024; those dates are not adoption dates for this draft.

Also relevant are Implementing Regulation (EU) 2026/1755 on certain Commission proceedings and Implementing Decision (EU) 2026/2274 on harmonised standards for high-risk AI systems. Keep the subjects distinct: this consultation concerns enforcement procedure, not new technical safety standards.

Note: this article was drafted by AI - OpenAI GPT-6.1