EU Opens Consultation on Draft AI Act Rules for How the AI Office Runs Its Cases

CONFIRMED as a DRAFT/PROPOSAL: the European Commission published the draft and opened feedback on 12 October 2026. The rules have not been adopted. The draft names no company.

The European Commission has opened a four-week public consultation on a draft implementing regulation under the EU AI Act. It sets out how the Commission, through its AI Office, will run certain enforcement cases. Feedback runs from 12 October to 9 November 2026 at 23:59 (Brussels time) [1].

According to the Commission, the draft “sets out practical and specific arrangements for proceedings conducted by the Commission under Regulation (EU) 2024/1689, covering access to the file, procedural safeguards, and limitation periods for penalties, as required by Articles 75c and 75d of that Regulation” [1].

The document carries the Commission’s standard disclaimer: “This draft has not been adopted or endorsed by the European Commission” [2]. The consultation page lists adoption as planned for the fourth quarter of 2026 [1].

Which AI systems it covers

The draft says the AI Act gives the Commission “exclusive competence for the supervision and enforcement” of two kinds of AI systems [2]:

• AI systems “based on general-purpose AI models where the model and the system are developed by the same provider” (or by companies in the same group).
• AI systems “that constitute or are integrated into very large online platforms or very large online search engines” designated under the EU’s Digital Services Act.

A very large online platform (VLOP) or very large online search engine (VLOSE) is a big website, app or search engine that the EU has formally designated under its Digital Services Act. In plain words: the biggest online services, which face the strictest EU online rules.

Who can see the evidence, and when

• Not before preliminary findings. “Access to file shall not be granted before the notification of the preliminary findings,” the draft says [2]. Preliminary findings are the Commission’s formal statement of what it thinks a company has done wrong.
• Redacted documents for the company. The company receives the documents mentioned in the findings, with business secrets and other confidential information removed [2].
• Full, unredacted file only for outside advisers. Unredacted access is limited to “a limited number of specified external legal and economic counsel and external technical experts” hired by the company, named to the Commission in advance and bound by disclosure terms [2].
• A three-year follow-up rule. If one of those advisers later joins the company or a competitor during the investigation or “during the three years following the end of the Commission’s investigation”, they and the company must tell the Commission [2].

How long the Commission has to fine

The AI Act sets a five-year limitation period (a deadline for imposing fines). The draft sets out how it runs [2]:

• For continuing or repeated non-compliance, the five-year period “shall begin on the day on which the non-compliance ceases”.
• Six kinds of Commission action interrupt the period: requests for documentation, explanations or other information; requests for access to conduct system evaluations; inspections; invitations to a structured dialogue; opening proceedings; and re-opening proceedings.
• “Each interruption … shall start time running afresh.”
• There is an outer limit of twice the limitation period, so 10 years without a fine, extended by any time the period is suspended. Suspension applies while a Commission decision is before the EU Court of Justice, and while an AI Office on-site inspection is waiting for a court’s authorisation.

A separate five-year period applies to collecting a fine, starting when the fine decision becomes final [2]. If adopted, the regulation would take effect 20 days after publication in the EU’s Official Journal [2].

Drafting errors

Some cross-references in the draft do not match its numbering. For example, Article 4 points to a “paragraph 6” that does not exist [2]. PPC Land also noted these errors [3]. The consultation could correct them.

How others read it

PPC Land, a marketing trade site, headlined its analysis around Google’s and Meta’s AI systems [3]. That is PPC Land’s reading. The Commission’s draft names no company.

Sources

1. European Commission, Have Your Say, “AI Act Implementing Act – Articles 75c-75d” (initiative 19292), feedback 12 October to 9 November 2026. https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/19292
2. European Commission, draft Commission Implementing Regulation on practical and specific arrangements for the conduct of certain proceedings pursuant to Articles 75c and 75d of Regulation (EU) 2024/1689, Ref. Ares(2026)9589403, 12 October 2026 (PDF). https://ec.europa.eu/info/law/better-regulation/brpapi/download/090166e534f8b82e
3. PPC Land (Luis Rijo), “EU draft lets AI Office restart 5-year fining clock on Google and Meta AI”, 12 October 2026. https://ppc.land/eu-draft-lets-ai-office-restart-5-year-fining-clock-on-google-and-meta-ai/

Related stories

• EU Tech Chief Virkkunen Warns of Under-Tested AI Models and Says Brussels Has Sent Information Requests to OpenAI, Anthropic and Chinese Firms
• The Regulatory Wave: How EU MiCA and the AI Act Are Reshaping Tech
• AI Policy Roundup: FTC Demands Near, a Kentucky Filing, India’s 30-Day Paper and EU Tracker Questions