The draft
The European Commission has opened feedback on a draft implementing regulation setting out how it will run enforcement proceedings under the AI Act. The initiative page describes it as covering access to the file, procedural safeguards, and limitation periods for penalties, as required by Articles 75c and 75d of Regulation (EU) 2024/1689.
The document is registered as Ares(2026)9589403 and runs to ten pages. Feedback opened on 12 October and closes on 9 November 2026 at midnight Brussels time. The Commission plans to adopt the regulation in the fourth quarter of this year. Six submissions had been published when this story was filed, including one from the Spanish healthcare industry association FENIN, which asked the Commission to clarify how confidential information originating from third parties in a supply chain would be treated.
What Articles 75c and 75d actually do
These articles are new. They were added to the AI Act by the Digital Omnibus on AI, and the consolidated text of 27 July 2026 marks them as such.
Article 75c gives the AI Office a decision-making power of its own. Where it finds that an operator within the scope of Article 75(1) is not complying, it adopts a decision establishing that — but it must first communicate preliminary findings explaining the measures it is considering, and it may hold a structured dialogue in which the operator can offer commitments.
The penalties come from Article 99(3) to (7), applied with the necessary changes. Administrative fines under Article 99(4) cover infringement of any applicable provision of the Regulation, including provisions not listed in Article 99(4), as well as failure to comply with decisions taken under the AI Office’s own powers. Supplying incorrect, incomplete or misleading information in reply to a request is separately fineable.
Periodic penalty payments are the sharper instrument. The AI Office can impose them to compel a company to submit to an investigation or an inspection, to answer an information request, to carry out corrective action or to comply with a decision. They must be effective and proportionate, and they may not exceed 5% of average daily income or worldwide annual turnover in the preceding financial year, per day.
The Court of Justice of the European Union has unlimited jurisdiction to review a fine or a periodic penalty payment, and may cancel, reduce or increase it.
Who this reaches
Article 75(1), as amended, makes the AI Office exclusively competent in two cases. The first is AI systems built on general-purpose models where the model and the system come from the same provider or the same group — with carve-outs for Annex I products, the Annex III point 2 systems, law enforcement, border management and financial institutions under Article 74(6), and administration of justice. The second is any AI system that constitutes, or is integrated into, a very large online platform or search engine designated under the Digital Services Act.
That competence attaches to providers. It reaches deployers only when the deployer is also the provider or part of the same undertaking.
Article 75d is where the implementing act is mandated. It says rights of defence and access to the file must be fully respected, that access runs under a negotiated disclosure protecting business secrets, that the AI Office can set the disclosure terms itself if the parties disagree, and that the file does not extend to the AI Office’s internal documents or its correspondence with national authorities. It also requires the AI Office to publish its decisions, naming the parties and the penalties.
What to watch
The consultation closes on 9 November, and adoption is planned before the end of the year. The question the draft answers in practice is who, on a company’s side, gets to read the evidence against it — the negotiated-disclosure mechanism is the part lawyers will argue over, because an enforcement file that only outside counsel may read is a different proceeding from one the company can examine itself.
