EU AI Act Enforcement Procedures Draft

Overview and Definitions

The draft Commission implementing regulation establishes practical arrangements for certain Commission proceedings under Articles 75c and 75d of Regulation (EU) 2024/1689. Article 1 identifies two main subjects: access to the Commission’s file and negotiated disclosure of information; and limitation periods governing the imposition of penalties and enforcement of decisions. The instrument bears reference Ares(2026)9589403, dated 12 October 2026. It expressly states that it has not been adopted or endorsed by the Commission and that its contents reflect preliminary views of Commission services. Its proposed duties are therefore not binding obligations created by this draft.

The instrument is procedural rather than a new substantive AI safety regime. It explains defence access to evidence, protection of confidential material, enforcement clocks, deadline management and transmission of information. The European Commission initiative page is the official publication location identified for the draft. The final instrument would be binding in its entirety and directly applicable in every Member State, entering into force on the twentieth day after final Official Journal publication. No final adoption or commencement date is established.

Article 2 identifies the “addressee” as the operator receiving preliminary findings under Article 75c(2). File access is available upon that operator’s request and cannot precede notification of preliminary findings. AI-system, provider, deployer, undertaking and general-purpose AI model terminology is used without standalone definitions; coverage follows Article 75(1) as described in the first recital, not every AI Act operator. “Terms of disclosure” are Commission-decided conditions for specified external legal and economic counsel and technical experts. A “non-confidential version” contains clear, intelligible redactions and, where required, concise descriptions. Business secrets and other confidential information are protected without an exhaustive substantive definition. Qualified Electronic Signature is an external legal concept supplied by Regulation (EU) No 910/2014.

Governance and Institutional Framework

The European Commission is the issuing authority and principal procedural decision-maker. It grants file access, sets disclosure conditions, assesses confidentiality claims, determines deadlines and administers document receipt. The first recital describes exclusive Commission supervision and enforcement over AI systems based on general-purpose AI models where the system and model are developed by the same provider or providers within the same undertaking. It also covers systems constituting or integrated into very large online platforms or very large online search engines designated under the Digital Services Act. The described competence reaches providers and deployers that are themselves providers or belong to the provider’s undertaking.

The AI Office appears in provisions concerning penalties, enforcement and judicial authorisation of on-site inspections. The AI Board, Advisory Forum, scientific panel, Member State competent authorities and other authorities appear principally in file-access exclusions. Their confidential information, correspondence and internal documents do not fall within the ordinary access right described in Article 2(5), although the Commission may disclose and use information necessary to prove an infringement. A standard recital refers to the Artificial Intelligence Committee’s opinion; the draft’s expressly unadopted status means that wording is not proof of a completed committee procedure.

File Access and Controlled Disclosure

Defence access follows two principal routes. Under Article 2(2), the addressee receives all documents mentioned in preliminary findings, subject to confidentiality redactions. Under Article 2(3), access to all file documents without redactions is provided through specified external advisers under Commission-established disclosure terms, subject to exclusions and exceptional restrictions. Advisers must be identified in advance and bound by those conditions. They cannot be employees of the addressee, or in a comparable relationship, when the Commission adopts its disclosure decision. Access may occur electronically or at Commission premises for a period determined by the Commission.

Confidentiality is balanced against effective exercise of the right to be heard. Exceptionally, the Commission may withhold or partly redact documents where likely harm to their submitter outweighs the importance of full disclosure for defence rights. Advisers cannot disclose documents or their contents to non-signatories and may use them only for permitted proceedings. Within one week of obtaining controlled access, they may submit a reasoned request for a non-confidential document version or additional specified advisers. Additional access is exceptional and must be indispensable. Article 2(11) also permits redacted access instead of controlled adviser access to avoid disproportionate delay or administrative burden.

Confidentiality and Digital Submissions

Article 3 establishes the process for confidentiality claims. The Commission informs document originators that access may be granted under Article 2; voluntary suppliers agree that their material may be accessed through that procedure. Originators may be required to identify protected documents or passages and the persons against whom confidentiality is claimed. The Commission may set deadlines for individual justifications, clearly redacted non-confidential versions and concise descriptions of each redaction. Failure to comply allows the Commission to consider that information contains no business secrets or other confidential information. Protection therefore requires timely, document-specific substantiation.

Article 8 makes digital transmission the default for documents and information sent to and from the Commission. Digitally transmitted documents must bear at least one Qualified Electronic Signature; the Commission may issue and update technical transmission and signature specifications. Receipt occurs when the Commission sends an acknowledgement, not merely when a sender uploads or dispatches a document. Unusable files, malicious content or signatures whose validity cannot be verified cause documents to be treated as not received. The Commission must notify the sender without undue delay and allow views and rectification within a reasonable deadline. Exceptional alternatives are registered mail and then hand delivery where both earlier methods are impossible or exceedingly difficult.

Monitoring and Operational Controls

The draft creates no annual reporting programme, periodic review cycle, testing benchmarks or separate conformity-assessment system. Its monitoring relevance is procedural: Article 4 identifies investigative activities that interrupt the limitation period for imposing fines or periodic penalty payments. Examples include requests for documentation, explanations or other information; requests for access to conduct system evaluations; inspections; invitations to structured dialogue; opening proceedings under Article 75a(2); and reopening proceedings under Article 75b. These examples do not constitute a complete technical evaluation regime or independently grant every underlying investigatory power.

Article 8(4) addresses real-time or near-real-time information sharing through application programming interfaces or equivalent means. The Commission determines methods and duration and may first invite the operator to propose alternatives. It does not specify universal access to source code, model weights or hosting infrastructure. Covered operators would need reliable records of requests, inspections, disclosures, acknowledgements and court-related suspensions. External-adviser relationship changes also require monitoring: during the investigation and for three years afterward, specified new relationships with the addressee or other undertakings active on the same markets trigger notification and confidentiality assurances.

Penalties, Liability and Appeals

The draft regulates timing, not penalty ceilings. Article 4 states that the five-year limitation period for imposing penalties begins when continuing or repeated non-compliance ceases. Investigative or procedural Commission action interrupts that period, and each interruption starts time running afresh. An outer period equal to twice the limitation period is specified where no fine or periodic penalty payment has been imposed, with extension for suspension. Separate provisions suspend limitation while the relevant Commission decision is before the Court of Justice of the European Union and while an AI Office-requested on-site inspection awaits judicial authorisation.

Article 5 establishes a five-year period for enforcing penalty decisions, beginning when the decision becomes final. Notification of a decision varying the amount or refusing variation interrupts the period, as does Commission or Commission-requested Member State action designed to enforce payment. Each interruption restarts the clock. Enforcement limitation is suspended while time to pay is allowed or payment enforcement is suspended by an EU or national court decision. The draft creates no compensation scheme or independent appeal deadline. For disputed confidentiality disclosure, Article 3 allows one week to object; a subsequent reasoned disclosure decision must set a disclosure date at least one week after notification.

The draft contains apparent numbering and cross-reference defects. Article 4(3) refers to a nonexistent paragraph 6, although Article 4 contains only five paragraphs. Article 6 contains paragraphs numbered 6 and 7 while referring to paragraphs 1 and 2. These defects should be flagged rather than silently treated as settled provisions. Deadline management includes the working-day start rule, applicable calculation rules and justified extension requests made before deadlines expire.

Relationship to Other Instruments and International Scope

The parent instrument is Regulation (EU) 2024/1689, the Artificial Intelligence Act, adopted on 13 June 2024 and published on 12 July 2024. The draft invokes Articles 75c(8) and 75d(3) as empowering provisions and refers throughout to Articles 75a–75d. These references describe its intended legal setting; the research record does not independently establish adoption or commencement of amendments introducing those provisions. The implementing regulation would organise procedures within the parent framework, not itself create the complete underlying supervisory jurisdiction, substantive infringement rules or penalty amounts.

Regulation (EU) 2022/2065, the Digital Services Act, supplies the platform and search-engine designation referenced in the scope recital. Regulation (EEC, Euratom) No 1182/71 supplies general rules for calculating periods, subject to the working-day start rule. Regulation (EU) No 910/2014 supplies electronic-signature requirements. The draft has nine articles and no annex prescribing page limits, fonts or margins. It establishes no universal minimum response period for preliminary findings; requirements from other Commission procedural instruments must not be imported.

This is an EU procedural regulation, not a treaty or mutual-recognition arrangement. Its information protections extend to correspondence, confidential information and internal documents involving EU bodies, international and intergovernmental organisations and third-country authorities. These exclusions recognise investigations may involve external material but create no reciprocal investigation powers, international certification pathways or automatic foreign-regulator access. The Commission retains the ability to disclose and use information necessary to prove an infringement.

Cross-border relevance follows from covered systems and undertakings, not a separate international alignment programme. Advisers remain bound by disclosure and permitted-use restrictions; accessed documents may be used only in the relevant proceedings or related judicial or administrative proceedings concerning AI Act application. The draft identifies no alignment commitments with OECD recommendations, foreign AI legislation or an international AI convention. Multinational organisations should treat it as a controlled EU defence-access process: sharing across offices or corporate groups is not automatically permitted because recipients work on the same business matters.

Implementation Timeline and Verification

Compliance Checklist

Sources and References