AI Act enforcement now has three distinct reporting routes

This analysis first appeared as the weekly Praxikon newsletter.

<h2>Enforcement is not a single gateway</h2> <p>Since 2 August, the enforcement powers under the AI Act have been operational. Over the past week, the European Commission has made the corresponding structure concrete through three distinct reporting routes. The distinction matters, because a report submitted through the wrong route may fall outside that body's remit or need to be referred elsewhere.</p> <ul> <li><strong>The AI Act Complaint Tool.</strong> Individuals and organisations can use it to complain about a possible infringement by a provider or deployer of an AI system supervised by the AI Office. This route is not anonymous and requires identification, the country where the incident occurred and a concrete description, supported by evidence where possible.</li> <li><strong>The AI Act Whistleblower Tool.</strong> This is the secure, anonymous route for people professionally connected to a provider of a GPAI model or an AI system within the AI Office's remit. They can submit documents in any official EU language and answer follow-up questions while remaining anonymous.</li> <li><strong>The GPAI route for downstream providers.</strong> A provider that integrates another provider's GPAI model into its own AI system can use this route to report possible infringements of Articles 53 to 55, such as missing technical information, copyright policy or information about systemic risks.</li> </ul> <h2>What does this mean for your organisation?</h2> <p>Most organisations are not directly supervised by the AI Office for their own chatbot, deepfake policy or AI-generated content. Article 50 compliance is mainly enforced by national market surveillance authorities. The European complaint route is competent only for AI systems within the AI Office's specific supervisory remit. With the complainant's consent, the Commission may refer a complaint to the competent national authority.</p> <p>For organisations, the main change is therefore evidentiary. A complaint can now originate directly with a customer, employee, business client or supplier. Your file must show not only that a disclosure or control exists, but also who owns it, when the control was performed and which supplier information supports it.</p> <h2>Action for this week</h2> <p>Create a compact complaint file for one publicly visible AI system. Record five things: your role as provider or deployer, the applicable transparency obligation, the visible disclosure, the internal owner and the technical information supplied by your vendor. Then test whether legal, compliance and the operational owner give the same answer when asked where a complaint belongs and who can produce the evidence within 24 hours.</p> <p>If your file will ultimately rest on who can demonstrate what, see how the <a href="https://learnwize.ai/article-4-evidence-dossier?utm_source=praxikon&utm_medium=referral&utm_campaign=praxikon_weekly&utm_content=editie-2026-08-11">Article 4 evidence dossier by LearnWize</a> records per role who has been trained, who owns the control and who can produce the evidence within 24 hours.</p> <p>You receive this weekly AI Act update because you signed up with Praxikon or used one of our tools or templates. You can unsubscribe with one click at the bottom.</p> <p>Until next Tuesday.<br/>Zahed Ashkara<br/>Praxikon</p>