Article 75: market surveillance, mutual assistance and the powers of the AI Office

Regulation (EU) 2026/1744 replaces the heading of Article 75 with "Market surveillance and control of AI systems and mutual assistance" and replaces paragraph 1: the AI Office shall be exclusively competent for the supervision and enforcement of the obligations under this Regulation in relation to, point (a), AI systems based on general-purpose AI models where the model and the system are developed by the same provider, or by providers forming part of the same undertaking as that provider, with the exception of (i) AI systems related to products covered by the Union harmonisation legislation listed in Annex I, (ii) AI systems referred to in point 2 of Annex III, (iii) AI systems provided by law enforcement authorities, border management authorities and financial institutions insofar as those systems fall under Article 74(6), and (iv) AI systems referred to in point 8 of Annex III as regards the administration of justice; and, point (b), AI systems that constitute or that are integrated into a very large online platform or very large online search engine designated in accordance with Regulation (EU) 2022/2065. The final subparagraph provides that the exclusive competence applies to the providers of those systems, and to the deployers of those systems only when they are also the provider or form part of the same undertaking as the provider.

The same regulation inserts paragraphs 1b to 1d and paragraph 2a. Paragraph 1b requires the authorities involved in the application of the Regulation to cooperate actively with the AI Office and to provide it the necessary assistance, including in connection with inspections or other enforcement measures carried out in the territory of a Member State. Paragraph 1c provides that the Office shall be assisted by the relevant market surveillance authority when investigatory or enforcement action involves access to a public authority data or AI system. Paragraph 1d provides that before taking a decision that would prohibit or restrict the system being made available or put into service on a national market, or a decision to withdraw or recall it from such market, the Office shall without undue delay notify the market surveillance authority competent for that market of its intention. Paragraph 2a allows a market surveillance authority with well-founded and sufficient reasons to suspect an infringement to request, through the single point of contact designated under Article 70(2), that the AI Office assess the matter; that request shall be duly reasoned and shall state at least the provider or deployer concerned, the relevant facts and the provisions allegedly infringed, and the requesting authority. The Office informs the point of contact without undue delay and in any event no later than four months after receipt whether it will exercise its powers, or why it will not.

Article 75a gives the AI Office all the powers of a market surveillance authority provided for in this Section and in Article 14(4) and Article 16(3) of Regulation (EU) 2019/1020, and authorises it to fully reclaim from the relevant operator the totality of the costs of its supervision and enforcement activities with respect to instances of non-compliance. Paragraph 2 allows the Office, on reasonable grounds, to start an investigation, of which it notifies the operator, and provides that it may exercise its powers on its own initiative or following a complaint received pursuant to Article 85, even before starting an investigation. Paragraph 3 allows information requests by simple request or by decision; with a simple request the Office states that there is no obligation to reply but that a voluntary reply must be correct and not misleading, and in both cases it indicates the fines provided for in Article 99(5), and by decision also the right to review by the Court of Justice; a copy of the request goes to the national market surveillance authority. Paragraph 4 allows remote and on-site inspections in which officials may enter business premises, examine and copy books and data, ask for oral or written explanations and seal premises; where national law requires authorisation by a judicial authority, the Office applies for it and the national judicial authority verifies that the coercive measures envisaged are neither arbitrary nor excessive. Paragraph 6 allows the Office to order operators to provide access to and explanations relating to their AI systems and to impose on an operator an obligation to retain all data and documents deemed necessary to assess compliance. Paragraph 7 allows the appointment of independent external experts and auditors, and paragraph 8 provides that information collected shall be used only for the purpose of this Regulation.

Article 75b allows the Office to make commitments offered by the operator during proceedings under Article 75a(2) binding by decision and to declare that there are no further grounds for action; it may reopen the proceedings where there has been a material change in the facts, where the operator acts contrary to its commitments, or where the decision was based on incomplete, incorrect or misleading information, and it rejects inadequate commitments in a reasoned decision. Article 75c provides in paragraph 1 that the Office adopts a decision establishing non-compliance, in paragraph 2 that it first communicates its preliminary findings, and in paragraph 3 that the decision may order the operator to take the necessary measures within a reasonable period and that the operator shall provide the Office with a description of the measures it has taken. Paragraph 4 provides that such a decision may be accompanied by penalties in accordance with Article 99(3) to (7), which apply mutatis mutandis to the AI Office, and that in particular the following are subject to fines as referred to in Article 99(4): (a) infringement of any applicable provision of this Regulation, including those not listed in Article 99(4), (b) failure to comply with decisions or measures adopted pursuant to the powers listed in Article 14(4) or Article 16(3) of Regulation (EU) 2019/1020 as well as those specified in Article 75a, and (c) failure to comply with a commitment made binding pursuant to Article 75b; the supply of incorrect, incomplete or misleading information to the Office is subject to the fines of Article 99(5). Paragraph 5 allows periodic penalty payments to compel submission to an investigation, compliance with an information request ordered by decision, submission to an ordered inspection, the provision of correct or complete answers or explanations in the context of an ordered inspection, compliance with corrective actions, compliance with a binding commitment, or compliance with a decision under paragraph 1; those payments shall, where applicable, not exceed 5 % of the average daily income or worldwide annual turnover in the preceding financial year per day. Paragraph 8 sets a limitation period: the Dutch edition in the Official Journal says three years, the English edition says five years. Article 75d applies Article 18 of Regulation (EU) 2019/1020 mutatis mutandis in paragraph 1, safeguards the rights of defence and access to the file under negotiated disclosure in paragraph 2, and provides in paragraph 4 that the Office publishes its decisions under Articles 75b and 75c stating the names of the parties and the main content, including any penalties imposed.

The practical question behind this provision is simple and rarely asked: who comes knocking. What is new is not that the AI Office appears, because the old paragraph 1 already gave it powers to monitor and supervise systems where the model and the system come from the same provider. What is new is that this competence becomes exclusive rather than shared, that it extends to providers within the same undertaking, that a second category is added in the form of designated very large online platforms and search engines, that four groups are carved out of it, and that Articles 75a to 75d give the Office a toolkit of its own. That toolkit is the point. An information request comes as a simple request or by decision; with a simple request you need not answer, but whoever answers voluntarily must answer correctly and not misleadingly, and with a decision the clock runs. An inspection extends to entering business premises, copying data and sealing cabinets and systems, with a real safeguard in front of it: where national law requires judicial authorisation, the Office applies for it and that judge verifies that the coercive measures are neither arbitrary nor excessive. Commitments are a genuine way out, but they become binding, the decision is published with the names of the parties, and the proceedings reopen if the facts change materially, if you act contrary to them, or if your information turns out to be incomplete or incorrect. Two things that are rarely seen. The trigger need not come from an authority: Article 75a(2) lets the Office exercise its powers following a complaint under Article 85, even before an investigation is running. And cost recovery is not unconditional: the Office may fully reclaim its supervision costs insofar as they relate to instances of non-compliance, so supervision costs you money when you are in the wrong and not merely because supervision happened. The line between the two regimes sits in paragraph 1 and it is not trivial; answer it once per system and record it, rather than working it out at the moment a demand arrives.