AI Office

What the AI Office does

The AI Office has two enforcement jobs under the EU AI Act.

General-purpose AI models. The Commission alone enforces the rules for providers of these models, through the AI Office (Article 88). It can ask for a model’s documentation, evaluate the model, and ask the provider to fix problems or withdraw the model (Articles 91 to 93).

Some AI systems. The Digital Omnibus on AI rewrote Article 75(1). The AI Office is now the only supervisor of the providers of two groups of AI systems:

• systems built on a general-purpose AI model by the provider that made the model, or by a company in the same group
• systems that are, or sit inside, a very large online platform or search engine formally designated as such under the Digital Services Act

Four exceptions to the first group stay national, such as AI in medical devices.

Why it matters

Each EU country designates its own market surveillance authorities: the national regulators that check AI already on the market (Articles 3(26) and 70). The AI Office is the EU-level enforcer beside them.

The original Article 75(1) gave the AI Office the powers of a market surveillance authority over a system where the same provider built both the model and the system. The Omnibus, in force since 27 July 2026, widened that to the provider’s whole corporate group, added platform AI, set out exceptions the old text did not have, and spelled out the Office’s inspection, commitment and fining powers.

Other companies that use the system are still supervised nationally, unless they belong to the provider’s group.

In practice

General-purpose AI model fines. The Commission can fine a model provider that, intentionally or negligently, breaks the rules, fails to comply with a request or measure, gives incorrect or misleading information, or fails to give access for an evaluation. The cap is 3% of worldwide annual turnover in the preceding financial year or EUR 15 million, whichever is higher (Article 101). The AI Office also encourages and facilitates codes of practice for these models (Article 56).

What stays national. The AI Office’s sole role over systems built on a provider’s own model excludes four groups (Article 75(1)):

• AI related to products under Annex I, such as medical devices
• AI used as a safety component in critical digital infrastructure, road traffic, or water, gas, heating or electricity supply
• systems of law enforcement and border authorities and of financial institutions, where Article 74(6) applies
• AI used in the administration of justice

Powers over AI systems. For the providers in its scope, the AI Office has all the powers of a market surveillance authority under the AI Act and the EU market surveillance regulation (Article 75a). It can inspect business premises, copy records and seal premises during an inspection. It can accept binding commitments from a company instead of continuing an investigation (Article 75b).

Fines. The AI Office can find a company non-compliant and fine it under the Act’s general penalty rules. To force a company to comply, for example to submit to an inspection or follow a decision, it can also impose periodic penalty payments. These are capped, where applicable, at 5% per day of average daily income or worldwide annual turnover in the preceding financial year. The Court of Justice of the EU can cancel, reduce or increase them (Article 75c).

Safeguards. Companies have the right to defend themselves and to see the AI Office’s case file, except confidential material. The AI Office must publish its commitment and non-compliance decisions (Article 75d).

Working with national authorities. A national authority that has well-founded reasons to suspect a system in the AI Office’s scope breaks the Act can ask the Office to act, through its country’s single point of contact, the authority each EU country names as its AI Act contact (Article 70(2)). The Office must say within four months whether it will (Article 75(2a)). Providers of high-risk systems in its scope report serious incidents to it (Article 75(1a)). Where such a system needs a third-party conformity assessment, the Commission hands the check to a notified body acting on its behalf (Article 75(1e)).

Questions and answers

Is the AI Office a separate EU agency?

No. The AI Office is a function inside the European Commission, set up by Commission Decision C(2024) 390 of 24 January 2024. The EU AI Act says that its references to the AI Office are to be read as references to the Commission (Article 3(47)).

Who enforces the EU AI Act, the AI Office or national authorities?

Both, for different things. The Commission, through the AI Office, enforces the rules for general-purpose AI models. Since the Digital Omnibus on AI, the AI Office is also the sole supervisor of providers of AI systems built on a general-purpose AI model from their own corporate group, with exceptions, and of AI in very large online platforms and search engines designated under the Digital Services Act. Market surveillance authorities designated by each EU country supervise other AI systems, and other companies that use these ones. The European Data Protection Supervisor covers the EU institutions' own AI.