How the EU AI Act is enforced: Regulation 2026/1755 and GPAI proceedings

Who enforces the AI Act against GPAI providers

This guide explains how the European Commission enforces the AI Act against providers of general-purpose AI (GPAI) models. It also describes what a proceeding looks like for the provider on the receiving end. It draws on Commission Implementing Regulation (EU) 2026/1755, dated 20 July 2026, and on two Commission web pages. Each statement is attributed to the document it comes from, so a reader can check it against the source.

On who acts, the Commission's enforcement page names the AI Office for this group of providers. It says the AI Office enforces the rules for providers of general-purpose AI models.

The same page sets a start date. It states that the enforcement powers of the AI Office and the national competent authorities apply from 2 August 2026.

The implementing regulation is the procedural layer. The sections below follow its order: evaluations and independent experts, the opening and closing of proceedings, and the safeguards for the provider. They then cover penalties and what to expect.

How the AI Office investigates

The enforcement page lists the tools the AI Office has for GPAI models. Three matter most to a provider's security and compliance teams: requests for information, access to the model, and requests to take measures.

Requests for information come in two forms, and the second is more serious. The page says that for requests issued by decision, fines can also be imposed if the provider fails to reply or replies incompletely.

On model access, the page says the AI Office, or independent experts it appoints, can demand access for testing. It states that they can require providers to grant access to their models in order to conduct evaluations.

The page also describes a stronger step. It says the AI Office can ask providers to take measures, which may include restricting the public availability of a model if necessary.

Access to the model and independent experts

Chapter II of the implementing regulation sets the detail for evaluations. The articles below describe what a provider can be required to open up, and how the Commission treats the experts who carry out the work.

Article 2 says the access decision must be specific. It states that the decision shall specify the technical means, tools, components and conditions, including the time limit, for the access.

Article 2 also lists what the access may cover. It says access may include internal access, source code, model weights and the infrastructure used for hosting the model.

Article 2 also deals with logging. It states that the Commission may require the provider to disable logging measures that could track or record the Commission's access, to the extent necessary for the integrity and confidentiality of the evaluation.

Article 3 turns to the experts. It states that before appointing an expert, the Commission must assess whether the expert has internal and external information security protocols in place or available.

Article 3 also gives providers a way to object to the choice of expert, by submitting reasoned observations. Article 4 covers how experts are selected. Both articles sit in the part of the regulation reviewed for this guide.

Opening, interim measures and closing

Chapter III covers how proceedings begin and end. The proceedings in question are those that could end in a fine under Article 101(1) of the AI Act.

An investigation can start before any proceeding does. Article 5 states that the Commission may use its Chapter IX, Section 5 powers before opening proceedings.

Article 5 also allows urgent action before a proceeding opens. It says the Commission may, by decision, order interim measures against a GPAI provider on grounds of urgency.

Article 6 covers closing a proceeding when the Commission finds no grounds for a fine. A closed proceeding is not necessarily final. The article says the Commission may reopen a proceeding, including when the closing decision rested on incomplete, incorrect or misleading information.

Procedural safeguards for the provider

Chapter IV sets out the provider's rights once the Commission has sent preliminary findings. The provider is called the addressee. The rules cover written observations, access to the file and the protection of confidential information.

On timing, Article 7 sets a floor. It states that the addressee must send its observations within a time limit set by the Commission, which shall be no less than 21 days. Article 7 also says observations must be succinct, in writing, and in the format set out in the Annex. The Annex is not part of the text reviewed for this guide.

On the file, Article 8 limits who sees unredacted material. It states that access is granted only to a limited number of specified external legal and economic counsel and external technical experts engaged by the addressee. Article 8 also says documents obtained this way may be used only for the relevant proceedings, or related judicial or administrative proceedings.

On confidentiality, Article 9 puts work on the parties who submit documents. The article says that if a person fails to identify and substantiate business secrets as the Commission requires, the Commission may treat the information as not confidential.

Penalties and time limits

The Commission's enforcement page explains when penalties follow. It states that if the AI Office establishes an intentional or negligent breach, the Commission may adopt a decision imposing penalties.

The page also gives a ceiling for GPAI obligations. It says breaches of those obligations may result in fines of up to €15 million or 3% of total worldwide annual turnover, whichever is higher. The page describes itself as an overview that does not replace the AI Act's provisions, so the Act itself is the reference for exact amounts.

Article 10 of the implementing regulation sets a time limit on fines. It states that the Commission may adopt a fining decision within five years from the day the conduct was carried out. The text reviewed for this guide cuts off in Article 10(3). The rules on interrupting the period, and Articles 11 onward, including Article 14 on how documents are submitted, could not be reviewed here.

What a security leader should expect

The documents describe a sequence. Information requests and evaluations can come first. An urgent interim order can come before a proceeding opens. A proceeding can follow, with preliminary findings, a response period of at least 21 days, and controlled access to the file.

Several points bear on security work. Evaluation access can reach weights, source code and hosting infrastructure. The Commission can require logging of its own access to be disabled. The provider can object to a proposed expert, and the regulation requires the Commission to check the expert's information security protocols.

The Commission's guidelines page names the channel for filings. It says providers of general-purpose AI models must use the EU SEND platform to submit documents related to their obligations to the AI Office.

The same page lists serious incident reports among those filings. It cites Article 55(1)(c) of the AI Act for them.

The guidelines page also says its guidelines are not legally binding but reflect the Commission's interpretation. It says providers should review their obligations, assess model risks, prepare for compliance and engage with the AI Office. Beyond these points, the three documents do not say how long a proceeding takes. They also do not set a fine in any particular case, so this guide does not predict either.