EU adopts Implementing Regulation 2026/1755 on AI Act enforcement procedures

What it is

Commission Implementing Regulation (EU) 2026/1755 is a binding EU instrument that sets out how the Commission evaluates general-purpose AI models and runs enforcement proceedings against their providers under the AI Act.

The measure carries the title Commission Implementing Regulation (EU) 2026/1755 of 20 July 2026 on detailed arrangements for the conduct of certain proceedings by the Commission pursuant to Regulation (EU) 2024/1689 of the European Parliament and of the Council, and it entered into force on 10 August 2026 and applies directly in all Member States.

What it requires

This binding regulation sets procedures for Commission evaluations of general-purpose AI models and potential fines under the EU AI Act.

It covers the technical means by which providers must grant access to a model, the appointment and selection of independent experts, the opening and closing of proceedings, written observations on preliminary findings, access to the file, the protection of confidential information, and limitation periods.

Under the rules, Commission-requested access to a general-purpose AI model can extend to application programming interfaces, internal access, source code, model weights and hosting infrastructure, as well as inspecting or modifying system state during interaction with the model.

Providers that receive preliminary findings get a Commission-set response period of at least 21 days to submit written observations.

A fining decision generally remains possible within five years of the conduct, and for continuing or repeated conduct the period starts only once that conduct ceases.

What security leaders should do

Teams responsible for general-purpose AI models should prepare internal readiness plans for Commission access requests that could reach source code, model weights and hosting infrastructure, since those forms of access are explicitly within scope. Legal, compliance and security functions should map out who owns the 21-day response window for preliminary findings so that defence submissions, confidentiality claims and file-access requests can be coordinated without missing deadlines. Because fining exposure can run for up to five years and restarts for continuing conduct, organizations should retain documentation of model evaluations, access decisions and remediation steps well beyond a single enforcement cycle. Security leaders at providers who are not yet designated as systemic-risk GPAI providers should still track this regulation, since it defines the procedural playbook the Commission will use if and when an evaluation or proceeding is opened against their models.