How Brussels will run an AI case, and what it means for your supplier

This analysis first appeared as the weekly Praxikon newsletter.

Brussels sets the rules for AI cases

On 12 October, the European Commission published a draft implementing regulation on how it will conduct its own cases under the AI Act. The draft implements Articles 75c and 75d and covers three things: when a company may access the Commission's file, how business secrets are protected in the process, and how long the Commission has to impose a fine. Feedback is open until 9 November on the Commission's consultation page. It is still a draft: the Commission plans adoption in the fourth quarter of 2026.

Which AI systems are covered?

Not all AI. Under Article 75(1) of the AI Act, the Commission's AI Office is exclusively competent for two groups: AI systems based on a general-purpose AI model where the model and the system come from the same provider or the same undertaking, and AI systems that constitute or are integrated into a very large online platform or very large online search engine under the DSA. Exceptions apply, including for AI in products covered by Annex I and for critical infrastructure. Think of a chat assistant that a large model provider offers on top of its own model.

That competence applies to the provider. A deployer is only covered if it is itself the provider or belongs to the same undertaking. The procedure for providers of general-purpose AI models themselves is separate; it has been governed by Implementing Regulation (EU) 2026/1755 since 10 August.

What is in the draft?

• Access to the file. Only after the preliminary findings. Full access without redactions is limited to a small number of named external lawyers, economists and technical experts engaged by the company.
• Limitation periods. The Commission has five years to impose a fine. For a continuing infringement, that period only starts when the infringement ends. Every investigative step, such as a request for information, a request for access to conduct a system evaluation, an inspection or an invitation to a structured dialogue, restarts the clock, up to a maximum of ten years plus any period of suspension.
• Not finished yet. The maximum-period rule refers to a paragraph 6 that does not exist in the draft. That is exactly the kind of point a consultation is for.

What does this mean for you?

If you are the provider of a system within this scope, the draft affects you directly. Your records then need to withstand an investigation that could last up to ten years, and it pays to decide now which external advisers would access the file on your behalf.

For most organisations, it is a supplier question. Your own obligations as a deployer, such as the transparency duties in Article 50(3) and (4) and the AI literacy measures in Article 4, remain with the national authority. The system you rely on, however, can be investigated in Brussels. If the AI Office intends to prohibit, restrict, withdraw or recall such a system on a national market, it first informs the national authority (Article 75(1d)). Our reading: an investigation of your supplier is therefore also a continuity question for you.

Praxikon now available in ChatGPT

Since 22 October, Praxikon has been available in ChatGPT, alongside the Claude directory. You ask your GDPR or AI Act question in the assistant you already use and get an answer with the legal article and the official source. Free and without an account; Praxikon never sees your conversation. How to add Praxikon to ChatGPT or Claude.

Action for this week

Take your three most-used AI applications from external suppliers. For each one, go through three questions with the owner and procurement:

1. Supervision. Do the model and the application come from the same provider or undertaking, or is the application part of a very large online platform? Then supervision of the provider most likely sits with the AI Office. Record any doubt as an open question.
2. Contract. Does it say the supplier will inform you if a regulator investigates, restricts or withdraws the system? And can you then take your data and settings with you?
3. Fallback. What do you do if the application is temporarily unavailable in your country? One paragraph per application is enough: the alternative, the owner and what then has to be done manually.

Are you a provider within this scope, or do you advise one? Then respond to the draft by 9 November. This is our practical recommendation, not a legal checklist.

Until next Tuesday.
Zahed Ashkara
Praxikon