Skip to main content

04 · Governance & the AI Office

Sources
note

Governance chapter (Chapter VII) became applicable 2 August 2025. Regulation (EU) 2026/1744 defers Chapter III high-risk Sections 1–3 to 2 December 2027 for Annex III and 2 August 2028 for Annex I.

The governance structure at a glance​

The AI Act creates a layered governance system with EU-level and national-level actors.

European AI Office (EU-level)​

  • Sits within the European Commission (DG CONNECT)
  • Supervises and enforces obligations on GPAI model providers across all 27 member states
  • Also enforces the rules for AI systems developed by the provider, or a provider in the same group, of the underlying GPAI model, and for AI systems integrated into designated VLOPs or VLOSEs
  • Evaluates GPAI models and investigates providers within its remit
  • Can issue decisions and impose fines on providers within its remit
  • Coordinates with national authorities
  • Publishes guidelines, codes of practice, and support tools
  • Maintains the AI Act Service Desk
  • Contact: CNECT-AIOFFICE@ec.europa.eu
  • Page: https://digital-strategy.ec.europa.eu/en/policies/ai-office

Regulation (EU) 2026/1744 reinforces the AI Office's powers for AI systems falling under Article 75 supervision, including stronger investigation, monitoring and EU-level sandbox roles. This is narrower than centralising oversight of every GPAI-based system.

GPAI model evaluations and enforcement proceedings​

Commission Implementing Regulation (EU) 2026/1755 was published on 21 July 2026 and entered into force on 10 August 2026. It sets the procedure for:

  • Commission access to GPAI models for evaluation, which may include APIs, internal access, source code, model weights, hosting infrastructure and access to inspect or modify system state;
  • selecting independent experts and protecting business secrets;
  • opening and closing Article 101 fining proceedings;
  • providers' right to be heard, including at least 21 days for written observations on preliminary findings;
  • access to the case file, confidentiality and five-year limitation periods for imposing and enforcing penalties.

AI Board​

  • Composed of one high-level representative from each member state
  • Advises and assists Commission on consistent application of the Act
  • Coordinates between national authorities
  • Covers the whole Act, not just GPAI

Scientific Panel of Independent Experts​

  • Body of independent AI scientists
  • Alerts AI Office to potential systemic risks from GPAI models
  • Supports model evaluations and technical assessments
  • A "qualified alert" from the panel can trigger an AI Office investigation

Advisory Forum​

  • Consultative body
  • Industry, civil society, academia
  • Advises AI Board and Commission

National-level enforcement​

  • Each member state must designate:
    • Notifying authority: assesses and designates notified bodies
    • Market surveillance authority: monitors compliance of AI systems on the market
  • EDPB's recommended model: existing data protection authorities (DPAs) as market surveillance authorities for AI systems impacting personal data rights
  • National authorities enforce the rules for other AI systems outside the AI Office's and EDPS's remits
  • Member states must have national penalty laws in place (as of 2 Aug 2025)
  • The Commission maintains an evolving list of national market-surveillance single points of contact; some national designations remain pending

Penalties​

ViolationMaximum fine
Prohibited practices (Article 99(3))€35M or 7% global annual turnover, whichever is higher
Listed operator, notified-body and Article 50 breaches (Article 99(4))€15M or 3% global annual turnover, whichever is higher
Incorrect, incomplete or misleading replies to notified bodies or national competent authorities (Article 99(5))€7.5M or 1% global annual turnover, whichever is higher
GPAI provider breaches, including information or model-access failures (Article 101)€15M or 3% global annual turnover, whichever is higher

These ceilings follow Articles 99 and 101 and the Commission enforcement framework. Article 99(6) applies the lower of the amount or percentage to SMEs, including start-ups; Article 99(6a) extends that treatment to SMCs for paragraphs 4 and 5. Those Article 99 exceptions do not apply automatically to Article 101 GPAI fines.

Regulatory sandboxes​

  • At least one national AI regulatory sandbox must be operational by 2 August 2027.
  • The AI Office may establish a Union-level sandbox for AI systems covered by Article 75(1), with priority access for SMEs, start-ups and SMCs.
  • Allow providers to test AI in real-world conditions under regulatory supervision
  • Simplified rules for sandbox participants

Enforcement and reporting channels​

  • The AI Act Complaints Tool accepts Article 85 complaints from natural and legal persons about AI systems under the AI Office's exclusive competence. It requires identification and contact details. Complaints about GPAI model obligations under Articles 53–55 use the separate downstream-provider channel described below; they fall outside this tool's scope.
  • The AI Act Whistleblower Tool provides a secure reporting channel for eligible people professionally connected to providers or deployers.
  • The downstream-provider complaints channel lets providers of AI systems built on GPAI models report alleged provider infringements of Articles 53 to 55 under Article 89(2).

Key articles​

TopicArticle(s)
AI Office establishment and tasksArt. 64
AI BoardArt. 65
Scientific PanelArt. 68
Advisory ForumArt. 67
National competent authoritiesArt. 70
Notifying authoritiesArts. 28–30
Market surveillanceArts. 74–78
GPAI supervision and enforcementArts. 88–94; Implementing Regulation (EU) 2026/1755
PenaltiesArts. 99–101
Governance chapter applicationArt. 113(b)
SandboxesArt. 57