European Commission opens consultation on AI Act enforcement proceedings rules

The European Commission opened a public consultation on a draft Implementing Regulation that sets out detailed procedural rules for enforcement under the EU AI Act, covering evaluations of general-purpose AI models, enforcement proceedings, access to file, confidentiality and limitation periods for penalties. The consultation opened on 12 March 2026 and closed on 9 April 2026.

What it is

The draft responds to the Commission's need to operationalise Articles 92 and 101 of the AI Act, which cover evaluations of general-purpose AI models and the broader enforcement process. It is a secondary, procedural instrument layered on top of the enforcement powers that already became applicable once the AI Office and Member State authorities began supervising the AI Act.

What it requires

The draft sets out how the AI Office exercises powers it already holds, including sending requests for information to verify compliance. It also covers interviews and on-site inspections during investigations into AI systems. These procedural rules apply against a penalty structure that can reach fines of up to €15 million or 3% of total worldwide annual turnover for breaches tied to GPAI obligations. Civil society groups participated in the consultation; the Future of Life Institute said the procedural framework provides much-needed legal certainty and helps operationalise the Act. It also submitted seven targeted recommendations for improvement after reviewing the draft.

What security leaders should do

Security and compliance teams should track how the final text defines access-to-file rights, since those rules will determine what evidence a provider can see and contest during an AI Office investigation. Teams should prepare documentation processes that can respond quickly to requests for information, since incorrect or misleading replies can themselves trigger fines. Organizations developing or integrating general-purpose AI models should map which business unit would face the higher GPAI-related penalty tier so that budget and legal resources are aligned before any investigation begins. Legal and privacy teams should also watch how confidentiality safeguards and limitation periods are finalized, since both affect how long records of an investigation must be retained.