The EU AI Office can now investigate AI providers and fine them

Since Sunday 2 August 2026, the European AI Office, part of the European Commission, holds formal powers to investigate and sanction providers of general-purpose AI (GPAI), the models behind ChatGPT, Claude, Gemini and Le Chat. The Commission announced it in a press release of 31 July 2026: “From 2 August 2026, the European Commission's AI Office, together with national authorities, will start enforcing the AI Act.”[1]

In practice, the AI Office can now require a model's technical documentation, run its own evaluations (including through interface or code access), order corrective measures, restrict or withdraw a model from the European market, and propose fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher.[2]

Regulation (EU) 2024/1689, the AI Act, entered into force on 1 August 2024 and applies in stages. The substantive obligations of GPAI model providers (Chapter V, Articles 53 to 55: maintaining up-to-date technical documentation, informing downstream developers, adopting a copyright policy, publishing a summary of training content, and, for models with systemic risk above 10²⁵ training FLOP, evaluating models, mitigating risks, reporting serious incidents and ensuring cybersecurity) have applied since 2 August 2025 under Article 113.[4]

But for a year those obligations had no enforcement mechanism: the co-legislators had expressly deferred Article 101 (GPAI fines) and Chapter IX (investigation powers, Articles 88 to 94) to 2 August 2026. The Commission wrote as much in its guidelines of 19 November 2025: “During the first year from 2 August 2025, the Commission cannot take any enforcement action, as its enforcement powers only become applicable on 2 August 2026.” As Tech Policy Press puts it: “Although these obligations began to apply last year, only now can the Commission investigate, order corrective measures and impose fines.”[7]

So the rules did not change on 2 August 2026; the power to enforce them came into being.

According to the Commission's official page on the enforcement framework, the AI Office holds two families of powers.[2]

Investigation powers. The AI Office can issue requests for information (RFIs) to verify compliance: either “simple” RFIs or RFIs adopted by formal Commission decision. Answering a simple RFI inaccurately or misleadingly is itself finable; failing to answer, or answering incompletely, an RFI by decision is too. For GPAI models, the AI Office, or independent experts it designates, can require access to the model to run its own evaluations (Article 92, including through the interface or source code), and require the provider to take measures up to restricting the model's public availability. For AI systems within its competence, it can also conduct hearings and inspections at providers' premises.[9]

Sanction powers. Where the AI Office establishes an intentional or negligent infringement, the Commission can adopt a fining decision. Breaches of GPAI obligations are capped at €15 million or 3% of worldwide turnover (Article 101). Prohibited AI practices (Article 5: social scoring, manipulation, exploitation of vulnerabilities) fall under the higher ceiling of €35 million or 7%; supplying inaccurate or misleading information to authorities falls under a floor of €7.5 million or 1%.[2]

One decisive structural point: under Article 88, the Commission holds exclusive, centralised competence to supervise and enforce the obligations of GPAI model providers, exercised through the AI Office, unlike the rest of the AI Act, which is entrusted to national market surveillance authorities. National authorities can ask the Commission to act, but cannot act themselves against model providers. The AI Office is also competent for AI systems developed by the same provider as the underlying model (or its group), and for AI systems integrated into very large online platforms designated under the DSA.[8]

The AI Office also relies on three reporting channels launched for the occasion: a complaint tool open to any natural or legal person, a secure tool for internal whistleblowers, and a complaint channel reserved for downstream providers integrating a third party's GPAI model.[1]

These powers apply to any provider making a GPAI model available in the EU, wherever it is established. “A US address does not put a lab beyond the reach of the European regulator,” Elisabetta Righini, a partner at Sidley Austin, told CNBC, noting that non-EU providers must also designate an authorised representative established in the EU (Article 54). She stresses an often-underestimated point: “GPAI liability is not limited to substantive breaches: refusing a request for information, giving misleading answers or blocking a model evaluation is sanctionable in itself.”[5]

Anthropic, OpenAI, Google, Meta, Mistral and xAI are therefore all within scope. The Parliament's rapporteur on the text, Brando Benifei, presents the AI Office as “the first authority in the world with genuine investigation and enforcement powers over advanced AI models”.

The same date activated two other strands, often confused with the GPAI one. First, transparency: Article 50 becomes enforceable, chatbots must say they are AI, deepfakes must be labelled, and AI-generated or modified content must carry machine-readable marking. The single exception: the machine marking of Article 50(2) benefits from a transition to 2 December 2026 for systems already on the market before 2 August 2026.[10] Second, the general penalty regime and the full competence of national market surveillance authorities also activate.

By contrast, the “Digital Omnibus on AI” (Regulation (EU) 2026/1744, in force on 27 July 2026 after a Parliament vote of 16 June) postponed the high-risk system obligations: to 2 December 2027 for the sensitive use cases of Annex III (recruitment, credit, education, essential services) and to 2 August 2028 for AI embedded in the regulated products of Annex I. The GPAI timetable did not move, and that is a deliberate choice: give time to users of high-risk systems, but keep the pressure on the handful of companies whose models underpin everything else.[10]

Note also: models placed on the Union market before 2 August 2025 have until 2 August 2027 to comply (Article 111(3)).[9]

The GPAI Code of Practice, a voluntary route for demonstrating compliance, counts Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI among its signatories, but not Meta, while xAI signed only the safety and security chapter. For signatories, supervision focuses on adherence to the Code; non-signatories must demonstrate equivalent compliance “by other adequate means”, which exposes them to more detailed information requests. A second code, on transparency of AI-generated content, gathered more than 180 signatories according to the Commission.[11]

The EU negotiated for months over access to Anthropic's advanced Mythos model before the company agreed to share it with the cybersecurity agency ENISA, after senior Commission officials travelled to San Francisco; OpenAI had previously offered access to its GPT-5.5-Cyber model. Article 92 now allows that access to be required. The Commission is moreover in discussions with OpenAI and Anthropic following cyberattack incidents involving their models, according to Reuters.[5]

These powers arrive a few weeks after the roughly $1 billion fine imposed on Google under the DMA in July 2026, which led US President Donald Trump to threaten the EU with “substantial” tariffs. AI Act enforcement gives Brussels additional leverage over American companies, and US labs now face two governments demanding forms of pre-deployment control, on either side of the Atlantic.[5]

Companies building products on a third party's model do not carry the Article 53 to 55 obligations (those sit on the model provider), but they gain a right to information (Annex XII) and an official complaint channel. The flip side: if the AI Office orders the restriction, withdrawal or recall of a model (Article 93), every product built on it is affected.[9]

Watch out for reclassification too: fine-tuning beyond a third of the original training compute, or placing a model on the market under your own brand, makes the company a provider subject to AI Office supervision.

At “day zero”, no public fine had been issued under Articles 99 or 101, and only 9 of the 27 Member States had fully designated their competent national authorities.[11] A Commission official told Tech Policy Press that the AI Office intended to maintain a “constructive dialogue” with providers. Early company reactions point the same way: OpenAI says it has “worked closely with the European Commission” and wants to “keep working together”, and Google says it is “determined to comply with all applicable rules”.[5]

2 August 2026 creates no new obligation for model providers: it turns year-old obligations into enforceable ones, backed by a single central regulator with a right to look into the models themselves and fines indexed on worldwide turnover.

As Tech Policy Press puts it, the first months of enforcement will tell “whether the AI Act becomes an effective accountability framework or remains largely a set of obligations on paper”. The question is no longer whether Brussels has the power to investigate and sanction the major AI labs: it has, since Sunday. The question is when, and against whom, it will use it for the first time.