EU AI Office Enforcement Procedure: GPAI Provider and Customer Impact

Key Takeaways

The phrase “draft implementing regulation” now refers to two different instruments, and the two should be distinguished because they differ in status and in the powers they confer. The first, a March 2026 draft on procedures for general-purpose AI (GPAI) model providers, was adopted as Commission Implementing Regulation (EU) 2026/1755 on 20 July 2026 [1]. The second, published for consultation on 12 October 2026, sets procedural rules for proceedings under the new Articles 75c and 75d of the AI Act, which cover AI systems the AI Office now supervises exclusively [2][3]. As of this note, only the second remains a draft.

Providers of GPAI models face a procedural regime that allows the Commission to request access to model weights, source code, and hosting infrastructure during evaluations, and that sets a 50-page limit on written observations to preliminary findings [1]. Fines of up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher, remain available under Article 101 [4]. The adopted regulation provides a five-year limitation period for fines that can be interrupted by steps such as documentation requests and access requests [1]. For operators within the new Article 75 competence, the October draft, as reported, would extend this to an outer limit of ten years [3]. Exposure for past conduct can therefore outlast the original compliance window.

Enterprise customers are not addressees of either instrument. They are nonetheless exposed indirectly: a provider under evaluation may disclose, restrict, modify, or in an extreme case withdraw a model on which customer workloads depend. We assess that customers should treat the regime as a vendor-continuity and evidence-availability issue and prepare accordingly. Some details of the October draft, specifically the adviser and business-secret provisions, rest on a single trade-press reading of the text and should be checked against the Commission’s draft once it is accessible.

Background

The AI Act’s obligations for GPAI model providers under Articles 53 and 55 have applied since 2 August 2025, but the Commission’s power to enforce them did not begin until 2 August 2026 [5][8]. From that date the Commission can request documentation under Article 91, require measures under Article 93, conduct model evaluations under Article 92, and fine providers under Article 101 [4][5]. These powers needed procedural detail: what “access” to a model means technically, how independent experts are chosen, what rights of defence providers hold, and how long the Commission may wait before a violation becomes unenforceable.

The Commission published a draft implementing regulation on these questions on 12 March 2026 and took feedback until 9 April 2026 [6][7]. It was adopted as Implementing Regulation 2026/1755 on 20 July 2026 under Articles 92(6) and 101(6) of the AI Act [1]. The regulation enters into force on the twentieth day after its publication in the Official Journal, which is consistent with the 10 August 2026 date reported for entry into force, although we did not confirm the publication date itself [1]. Comparing the draft with the adopted text is informative. Trade-press summaries of the March draft reported a minimum response period of 14 days for written observations [7], whereas the adopted Article 7 gives providers at least 21 days [1]. If the press summary is accurate, the consultation produced at least one concession to providers, although a full article-by-article comparison is outside the scope of this note.

The second instrument follows from the Digital Omnibus on AI, Regulation (EU) 2026/1744, which was reported as adopted on 8 July 2026 and in force from 27 July 2026, with application from 2 August 2026 [9][10]. The Omnibus rewrote Article 75 so that the AI Office holds exclusive competence over two categories of AI system: those built on a general-purpose model where the same provider, or the same undertaking, developed both model and system, and those that constitute or are embedded in very large online platforms or search engines designated under the Digital Services Act [10][11]. New Articles 75a to 75d add powers that the AI Office does not hold over pure model providers, including on-site inspections, binding commitments, corrective orders, and periodic penalty payments [10][11]. The 12 October 2026 draft implementing regulation, referenced Ares(2026)9589403, supplies the procedural rules for those proceedings, with feedback open until 9 November 2026 and adoption planned for the fourth quarter of 2026 [2][3]. Our account of the Omnibus and of Articles 75a to 75d relies on legal commentary and trade press rather than the text of Regulation 2026/1744, and readers who depend on article-level detail should consult the Official Journal version.

Security Analysis

The security implications of the new enforcement regime turn on three questions: which powers the Commission holds against a given addressee, what access to models and infrastructure those powers allow, and how long a provider remains exposed. The sections below take each in turn, then consider how enterprise customers are affected even though neither instrument is addressed to them.

Two regimes, two sets of powers

The practical difference between the two instruments lies in what the Commission may do to the addressee. Against a model provider that does not also operate a covered downstream system, the Commission enforces through information requests, model evaluations, required measures, and fines under Articles 91 to 93 and 101, and legal commentary indicates it has no power of entry to premises [10]. Against an operator within Article 75(1), the Commission can additionally enter business premises, copy books, data and records, take oral explanations on the spot, and seal premises or records [10]. Fines under Article 75c(4)(a) reach the same ceiling of EUR 15 million or 3% of worldwide annual turnover, and Article 75c(5) adds periodic penalties of up to 5% of average daily worldwide turnover for each day of non-compliance [10]. A provider that both trains a frontier model and operates a consumer product on it may therefore sit under the more intrusive regime for the product and the narrower one for the model.

The table below summarizes the principal differences. Entries for the model-provider regime draw on the adopted regulation, while entries for the system regime reflect the Omnibus provisions as described in commentary and the October draft as reported.

What the model-access provisions require

Article 2 of Regulation 2026/1755 allows the Commission to specify the technical means, tools, components, and conditions under which a provider grants access to a model, and lists APIs, internal access, source code, model weights, and infrastructure access among the forms of access [1]. The adopted text also allows the Commission to seek access to inspect and modify the system state, and to require providers to disable logging measures during evaluations (Article 2(3)) [1]. Both points were first reported from the March draft [7] and are confirmed in the adopted text.

From a security standpoint, weights and infrastructure are among the most sensitive assets a provider holds, and these provisions create an access pathway to them for external evaluators. That pathway includes independent experts who may be appointed under Article 3 [1]. It raises questions about how credentials are scoped, how evaluation environments are isolated from production, and how evaluator activity is monitored. The regulation requires experts to declare interests and to preserve the confidentiality, integrity, and availability of sensitive information consistent with Article 78 of the AI Act [1]. Whether providers can satisfy their own security obligations while accommodating a request to disable logging is an open tension that providers may wish to raise in guidance discussions with the AI Office. This is our inference rather than a position stated in the regulation.

Procedural safeguards and their operational cost

Written observations on preliminary findings are capped at 50 pages, with annexes excluded from the cap where they serve a purely evidential and instrumental function [1]. Access to the file is tiered and runs through specified external legal and economic counsel and external technical experts, and the documents may be used only for the relevant proceedings or related judicial or administrative actions [1]. The October draft, as reported, would also require those advisers to notify the Commission if they join the operator or its competitors within three years after the end of the investigation, and would give one week’s notice before the Commission discloses material claimed as business secrets [3]. Because these two provisions rest on one outlet’s reading of the draft, they should be treated as provisional.

In practice, this would likely mean that a provider’s ability to defend itself depends on having external counsel and technical experts ready to be designated quickly, and on keeping an evidence base organized well enough to be summarized in 50 pages. The adopted regulation requires submissions to carry a qualified electronic signature under Regulation (EU) 910/2014 (Article 14(2)) [1], and the October draft reportedly keeps that requirement and treats receipt as occurring on the Commission’s acknowledgment [3]. Providers without qualified-signature infrastructure should resolve that before a deadline, not during one.

Limitation periods and the length of exposure

Regulation 2026/1755 sets a five-year period for imposing fines running from the conduct (Article 10(1)), and Article 10(3) lists events that interrupt it, including requests for documentation, requests for evaluation access, invitations to structured dialogue, and the opening of proceedings [1]. The March draft listed the same categories of event [7]. The October draft goes further, as reported. It provides that the five-year period begins when non-compliance ceases for continuing violations, and that each interruption starts time running afresh, up to an outer limit of twice the period, or ten years [3]. Six actions interrupt the clock under that draft: requests for documentation or explanations, requests for evaluation access, inspections, invitations to structured dialogue, opening of proceedings, and reopening of proceedings [3]. We confirmed the ten-year outer limit and the inspection and reopening triggers only for the October draft, not for the adopted regulation.

Two consequences follow. A routine documentation request can lengthen the Commission’s window to act, so providers should not assume that a quiet period after a request means the matter has lapsed. Evidence retention policies also need to span at least the five-year base period and, for operators within Article 75(1) that have been the subject of any interrupting step, potentially up to ten years if the draft is adopted as reported. Practitioners will need to confirm the operative rules once the final text of the October instrument is published.

Exposure for enterprise customers

Neither instrument imposes obligations on deployers or downstream users, and the October draft contains no provisions addressed to enterprise customers [3]. The Article 75(1) competence is defined by a same-provider relationship between model and system, so an enterprise that builds its own application on a third-party model through an API would, on our reading, fall outside the AI Office’s exclusive competence for that application. This is an inference from the statutory description, and organizations with borderline structures, such as affiliated-group arrangements, should take legal advice.

Customers are nonetheless exposed through supply-chain effects. Article 5(3) of Regulation 2026/1755 provides for interim measures on grounds of urgency, and a summary of the March draft describes these as including suspension of a model’s availability where there is a risk of serious damage [1][7]. We did not confirm that the adopted text uses the word “suspension.” Corrective measures under Article 93 and market restrictions could also change what a model provider is able to offer in the EU. In addition, customers who rely on provider documentation for their own compliance work, such as downstream transparency or risk assessments, depend on that documentation being accurate and available, and an open proceeding could indicate that it may be revised.

Recommendations

The recommendations below are organized by time horizon and, within each, by who bears the action. They are operational suggestions rather than legal advice, and several touch on contract terms and corporate structure that warrant review by counsel.

Immediate Actions

Enterprise customers should inventory every GPAI model dependency and record, for each, whether the model and the product wrapping it come from the same provider or group, since this determines which regime applies to the vendor. Security teams should also confirm that their contracts with model providers include notification obligations if the provider becomes subject to an Article 92 evaluation, an Article 93 measure, or a proceeding under Article 75c. For their part, providers should confirm that qualified electronic signature capability and a designated external counsel and technical expert panel are in place. Anyone intending to comment on the October draft has until 9 November 2026 to do so [2].

Short-Term Mitigations

Customers should add model-change and model-withdrawal scenarios to business continuity plans, including pre-tested fallback models and portable prompt and evaluation assets. They should also request, and store in their own records, the provider documentation on which their compliance conclusions depend, with version history. Providers, in turn, should design evaluation environments that can offer scoped, monitored, and revocable access to weights and infrastructure, and should document how any request to suspend logging would be reconciled with their own security controls. Both groups should review evidence-retention schedules against a five-year baseline, and providers that operate covered systems should consider the ten-year outer bound that the October draft would introduce.

Strategic Considerations

Over the next year, the practical shape of the regime will depend on how often the AI Office uses information requests, evaluations, and inspections, and on how the courts treat the limitation and file-access rules. We anticipate that model-provider assurances will become a regular part of vendor due diligence, and we suggest that enterprises avoid single-model architectures for critical functions where regulatory action could interrupt service. Providers that operate both models and covered systems should plan for two procedural tracks that may run against the same underlying conduct. We also suggest monitoring the final text of the October instrument for any change to response periods, file-access conditions, and limitation rules relative to Regulation 2026/1755.

CSA Resource Alignment

CSA’s analysis of the EU AI Act Digital Omnibus, EU AI Act Digital Omnibus: Enterprise Risk Recalibration [12], is the most directly relevant prior work. It examines the provisional agreement that led to Regulation 2026/1744, including the 16-month deferral of high-risk obligations and the fact that GPAI obligations remain enforceable. The GPAI enforcement provisions of Regulation 2026/1755 were not deferred, although the Omnibus separately extended the AI Office’s powers over certain systems. This supports that paper’s conclusion that enterprise AI risk programs should not treat the deferral as relief from GPAI-related exposure.

CSA’s earlier research notes on GPAI enforcement, EU AI Act GPAI: Security Compliance Before August 2026 [13] and GPAI Enforcement Is Live: What Security Teams Must Do Now [14], addressed the substantive obligations and the security readiness steps that apply as enforcement began. This note extends them to procedure: how the Commission will request access, how providers may respond, and how long exposure lasts.

For control mapping, the AI Controls Matrix (AICM) v1.1 [15] offers domains relevant to the vendor-assurance and evidence-retention actions above. CSA’s STAR for AI assurance program is one avenue that could be explored for customers seeking structured provider evidence.

References

[1] European Commission. “Commission Implementing Regulation (EU) 2026/1755 of 20 July 2026 on detailed arrangements for the conduct of certain proceedings by the Commission pursuant to Regulation (EU) 2024/1689.” EUR-Lex, 20 July 2026.

[2] Digital Policy Alert. “European Commission opened consultation on draft implementing regulation on practical and specific arrangements for conduct of certain proceedings pursuant to Article 75c and Article 75d of Artificial Intelligence Act.” Digital Policy Alert, October 2026.

[3] PPC Land. “EU draft lets AI Office restart 5-year fining clock on Google and Meta AI.” PPC Land, October 2026.

[4] AI Act Service Desk, European Commission. “Article 101: Fines for providers of general-purpose AI models.” European Commission, 2026.

[5] Artificial Intelligence Act EU. “Enforcement of Chapter V.” Future of Life Institute, 2026.

[6] CMS. “European Commission Proposes Implementing Regulation for AI Act Enforcement Proceedings.” CMS, March 2026.

[7] PPC Land. “EU draft reveals how Brussels will probe and fine AI model providers.” PPC Land, March 2026.

[8] Let’s Data Science. “EU enforcement powers over general-purpose AI providers take effect.” Let’s Data Science, August 2026.

[9] PPC Land. “AI Office gains 5% daily penalty power over Google and Meta AI systems.” PPC Land, 2026.

[10] Bratby Law. “AI Office enforcement: the AI Act’s new powers over platform AI.” Bratby Law, 2026.

[11] Model Diplomat. “EU Digital Omnibus centralizes AI enforcement.” Model Diplomat, 2026.

[12] Cloud Security Alliance. “EU AI Act Digital Omnibus: Enterprise Risk Recalibration.” CSA AI Safety Initiative, June 2026.

[13] Cloud Security Alliance. “EU AI Act GPAI: Security Compliance Before August 2026.” CSA AI Safety Initiative, May 2026.

[14] Cloud Security Alliance. “GPAI Enforcement Is Live: What Security Teams Must Do Now.” CSA AI Safety Initiative, August 2026.

[15] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” CSA, 2026.