AI Act, Article 75 and Articles 75a to 75d (AI Office supervision, investigation, commitments, fines and periodic penalty payments)

The AI Office is exclusively competent for the supervision and enforcement of the obligations under the Regulation in relation to AI systems based on general-purpose AI models where the model and the system are developed by the same provider, or by providers forming part of the same undertaking as that provider, with four exceptions.

The four exceptions to the AI Office's competence over AI systems based on general-purpose AI models are AI systems related to products covered by the Union harmonisation legislation listed in Annex I, AI systems referred to in point 2 of Annex III, AI systems provided by law enforcement authorities, border management authorities and financial institutions insofar as they fall under Article 74(6), and AI systems referred to in point 8 of Annex III as regards the administration of justice.

The AI Office is also exclusively competent in relation to AI systems that constitute or are integrated into a very large online platform or very large online search engine designated in accordance with Regulation (EU) 2022/2065. The AI Office's exclusive competence applies to the providers of the AI systems it covers, and to their deployers only when they are also the provider or form part of the same undertaking as the provider.

By way of derogation from Article 73, providers of high-risk AI systems subject to the competence of the AI Office must report any serious incidents to the AI Office, and Article 73(2) to (9) applies mutatis mutandis. The AI Office is responsible for conformity assessments and tests of the AI systems within its competence that are classified as high-risk and subject to a third-party conformity assessment, and the Commission entrusts their performance to notified bodies.

The fees for testing and assessment activities are levied on the provider of a high-risk AI system who has applied for a third-party conformity assessment to the Commission, and the provider pays the costs of the services entrusted to the notified bodies directly to the notified body.

A market surveillance authority with well-founded and sufficient reasons to suspect an infringement by a provider or deployer of an AI system within the AI Office's competence may request, through its single point of contact, that the AI Office assess the matter.

The AI Office informs a market surveillance authority's single point of contact, without undue delay and in any event no later than four months following receipt of its request for an assessment, of its intention to exercise its powers or of its reasons for not exercising them.

When it supervises and enforces the AI systems within its competence, the AI Office has all the powers of a market surveillance authority provided for in the Section of the Regulation that holds Article 75a and in Article 14(4) and Article 16(3) of Regulation (EU) 2019/1020.

The AI Office is authorised to fully reclaim from the relevant operator the totality of the costs of its supervision and enforcement activities with respect to instances of non-compliance, including costs for human and technical resources.

Where the AI Office has reasonable grounds to suspect non-compliance by a provider or a deployer of an AI system referred to in Article 75(1), it may adopt a decision to start an investigation, and upon starting the investigation it notifies the operator of the AI system concerned. The AI Office may exercise the powers listed in Article 14(4), points (a), (b) and (c) of Regulation (EU) 2019/1020 and Article 74(12) and (13) of the Regulation by simple request or by decision.

When requesting information, the AI Office states the legal basis and the purpose of the request, specifies what information is required and sets the period within which the information is to be provided.

A simple request for information from the AI Office must additionally indicate that, although there is no obligation to provide the information requested, in the case of a voluntary reply the information must be correct and not misleading, and must indicate the potential fines provided for in Article 99(5).

A request for information made by decision must additionally indicate the fines provided for in Article 99(5) for supplying incorrect, incomplete or misleading information and the right to have the decision reviewed by the Court of Justice of the European Union. The AI Office may conduct all necessary remote or on-site inspections pursuant to the powers laid down in Article 14(4), points (d) and (e) of Regulation (EU) 2019/1020 and Article 74(5) of the Regulation.

During an inspection, the officials of the AI Office are empowered to enter any of the business premises, land or property located in the Union of the operator concerned, to examine and copy books, data and other material relevant to their tasks, to ask for oral or written explanations and to seal business premises and books or records for the duration of, and to the extent necessary for, the inspection.

The AI Office may also order operators to provide access to, and explanations relating to, their AI systems, and may impose an obligation on an operator to retain all data and documents deemed to be necessary to assess the implementation of and compliance with the obligations under the Regulation.

If, during proceedings under Article 75a(2), the operator concerned offers commitments to ensure compliance, the AI Office may, by decision, make those commitments binding on the operator and declare that there are no further grounds for action.

The AI Office may reopen proceedings in which it made commitments binding where there has been a material change in the facts on which the decision was based, the operator acts contrary to its commitments, or the decision was based on incomplete, incorrect or misleading information provided by the operator.

Where the AI Office finds that an operator falling within the scope of Article 75(1) does not comply with the relevant provisions of the Regulation or with commitments made binding under Article 75b, it adopts a decision establishing such non-compliance.

Before adopting a decision establishing non-compliance, the AI Office communicates its preliminary findings to the operator concerned and explains the measures that it is considering taking, or that it considers the operator should take, to address them.

In a decision establishing non-compliance the AI Office orders, where relevant, the operator to take the necessary measures to ensure compliance within a reasonable period specified in the decision and to provide information on the measures it intends to take, and the operator then provides the AI Office with a description of the measures it has taken upon their implementation.

A decision establishing non-compliance may be accompanied by the imposition of penalties in accordance with Article 99(3) to (7), which apply mutatis mutandis to the AI Office in the execution of its supervision and enforcement tasks.

Infringement of any applicable provision of the Regulation, failure to comply with decisions or measures adopted under the powers in Article 14(4) or Article 16(3) of Regulation (EU) 2019/1020 and Article 75a, and failure to comply with a commitment made binding under Article 75b are subject to administrative fines as referred to in Article 99(4).

The supply of incorrect, incomplete or misleading information to the AI Office in reply to a request is subject to administrative fines as referred to in Article 99(5). Article 99(4) sets administrative fines of up to EUR 15,000,000 or, if the offender is an undertaking, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher.

Article 99(5) sets administrative fines of up to EUR 7,500,000 or, if the offender is an undertaking, up to 1% of its total worldwide annual turnover for the preceding financial year, whichever is higher, for the supply of incorrect, incomplete or misleading information. In the case of SMEs, including start-ups, Article 99(6) limits each fine to the percentage or amount referred to in paragraphs 3, 4 and 5, whichever is lower.

The AI Office may adopt a decision imposing periodic penalty payments to compel operators to submit to an investigation, to comply with an information request or an inspection ordered by decision, to provide correct or complete answers in an inspection, to comply with corrective actions, to comply with commitments made legally binding, or to comply with a decision establishing non-compliance.

Periodic penalty payments imposed by the AI Office are effective and proportionate and, where applicable, do not exceed 5% of the average daily income or worldwide annual turnover in the preceding financial year per day, calculated from the date appointed by the decision.

The Court of Justice of the European Union has unlimited jurisdiction to review decisions of the AI Office fixing a fine or periodic penalty payment, and may cancel, reduce or increase the fine or periodic penalty payment imposed. The AI Office's powers under Article 75c are subject to a limitation period of five years, which begins to run on the day the infringement is committed or, for continuing or repeated infringements, the day the infringement ceases.

The rights of defence and of access to the file of operators falling within the scope of Article 75(1) must be fully respected in proceedings, and those operators are entitled to have access to the AI Office file under the terms of a negotiated disclosure, subject to the legitimate interest in the protection of business secrets.

The AI Office publishes the decisions it adopts under Articles 75b and 75c, stating the names of the parties and the main content of the decision, including any penalties imposed.

Where market surveillance authorities have sufficient reason to consider general-purpose AI systems that can be used directly by deployers for at least one purpose classified as high-risk to be non-compliant, they cooperate with the AI Office to carry out compliance evaluations and inform the Board and other market surveillance authorities accordingly.

Where a market surveillance authority is unable to conclude its investigation of a high-risk AI system because it cannot access certain information related to the general-purpose AI model despite all appropriate efforts, it may submit a reasoned request to the AI Office, which supplies the information it considers relevant without delay and in any event within 30 days.