A Draft EU Regulation Would Set File-Access and Limitation Rules for AI Office Proceedings

What did the Commission publish, and does it bind anyone?

It published a draft, and it binds nobody. The Commission released the draft on 12 October 2026 under reference Ares(2026)9589403 and opened feedback until 9 November 2026. The cover page says: "This draft has not been adopted or endorsed by the European Commission." It adds that any views are the preliminary views of the Commission services.

The draft cites Articles 75c(8) and 75d(3) of Regulation (EU) 2024/1689 as its legal basis. Recital 1 says Article 75(1) gives the Commission exclusive competence over AI systems built on a general-purpose AI model where the model and the system are developed by the same provider or providers in the same undertaking, and over AI systems that are or are integrated into designated very large online platforms or search engines. We have not opened the text of Articles 75a to 75d. This page describes what the draft says and recites, not what those articles provide.

Who would see the Commission's file, and what if an adviser later joins the investigated company?

The addressee would see a redacted file after preliminary findings, and named external advisers could see unredacted documents under Commission terms. Draft Article 2(1) reads "Access to file shall not be granted before the notification of the preliminary findings" under Article 75c(2). The addressee could then ask for access, and the Commission would provide all documents mentioned in the preliminary findings, with redactions made under draft Article 3 for business secrets and other confidential information.

Under Article 2(3), the Commission would give access to all documents on its file without redactions, but only under terms of disclosure set in a Commission decision. Access would go to a limited number of specified external legal and economic counsel and external technical experts engaged by the addressee, whose names are communicated to the Commission in advance. They would be bound by the terms and could not disclose the documents to anyone who has not signed them (Article 2(3)(d)). The draft does not provide for the advisers to pass unredacted documents to the addressee. The Commission would specify the technical means and duration, which could be electronic or at its premises.

Further points in the draft:

• Exceptional circumstances: the Commission could refuse access to certain documents or give partly redacted versions if the harm to the submitting party would, on balance, outweigh the importance of full disclosure for the right to be heard (Article 2(4)).
• Exclusions: access would not extend to confidential information, correspondence and internal documents of the Commission, the AI Board, the Advisory Forum, the scientific panel and Member State and other authorities. The Commission could still use information necessary to prove an infringement (Article 2(5)).
• One-week request window: within one week of receiving access, the advisers could make a reasoned request for a non-confidential version of a document not yet given to the addressee, or for extension to additional advisers, which would be granted only exceptionally where indispensable (Article 2(6)).
• Use restriction: documents obtained could be used only for the relevant proceedings or related judicial or administrative proceedings concerning the AI Act (Article 2(10)).
• Substitute route: the Commission could at any time give access to redacted documents instead, to avoid disproportionate delay or burden (Article 2(11)).

Article 3 would let the Commission require whoever supplied a document to identify confidential material, substantiate each claim, and provide a non-confidential version and a concise description of each redaction. If the supplier did not comply, the Commission could consider the information not confidential (Article 3(5)). Before disclosing material claimed to be confidential, it would give a one-week window for objections (Article 3(6)).

On adviser movement, the adviser would have to be reported, and the draft does not bar the move. Under Article 2(3)(c), listed advisers could not be employed by the addressee on the date of the decision setting the terms. If one later entered such a relationship with the addressee, or with another undertaking active on the same markets, during the investigation or in the three years after it ends, the adviser and the addressee would promptly inform the Commission about the terms. The adviser would also assure the Commission that they no longer have access to the documents they were given access to that the Commission did not make available to the addressee, and would continue to comply with the non-disclosure and use restrictions in Article 2(3)(d).

How long could the Commission impose a fine, and how long could it enforce a decision?

The draft sets a five-year period that restarts on each interrupting act, up to a ceiling of twice the period. Article 4 deals with imposing fines and periodic penalty payments. For continuing or repeated non-compliance, the five-year period provided for in Article 75c(8) would begin on the day the non-compliance ceases. Any Commission action for the purpose of its investigation or proceedings against an operator would interrupt the period. The draft lists six: requests for documentation, explanations or information; requests for access to conduct system evaluations; inspections; invitations to a structured dialogue; the opening of proceedings under Article 75a(2); and the re-opening of proceedings under Article 75b. The text says actions "shall include" those, so the six read as examples, not a closed list.

Each interruption would start time running afresh. The ceiling in Article 4(3) reads that the period "shall expire at the latest on the day on which a period equal to twice the limitation period has elapsed" without a fine or penalty payment being imposed. On a five-year period that is ten years, our arithmetic; the draft states it only as a multiple. Article 4(3) adds that the period "shall be extended by the time during which limitation is suspended pursuant to paragraph 6", but Article 4 has no paragraph 6. Article 4(4) and (5) suspend limitation while the decision is before the Court of Justice and while an on-site inspection requested by the AI Office awaits judicial authorisation. Reading those suspensions as extending the ceiling is our interpretation, not clear draft wording.

Enforcing a final decision is separate: a five-year period with no twice-the-period ceiling in the draft text. Article 5 would run the period from the day the decision under Article 75c(4) and (5) becomes final. Notification of a decision varying the original amount of the penalty or refusing an application for variation, or any action by the Commission or by a Member State acting at its request to enforce payment, would interrupt it and start it afresh (Article 5(3) and (4)). It would be suspended while time to pay is allowed or while the Court of Justice or a national court suspends enforcement.

What filing and deadline rules would apply?

Filings would be digital and signed, and, where appropriate, a time limit set by the Commission could be extended on a reasoned request lodged before it expires (Article 7(2)). Time limits would be calculated under Regulation (EEC, Euratom) No 1182/71, with periods beginning on the working day after the triggering event (Article 6). In setting a time limit the Commission would have regard to the right to be heard and the expediency of the proceedings (Article 7). Transmission would be digital, signed with at least one Qualified Electronic Signature under Regulation (EU) No 910/2014 (Article 8(1) and (2)). A filing would be deemed received on the day the Commission sends an acknowledgment of receipt, and deemed not received if it is unusable, contains malware or carries a signature the Commission cannot verify; the Commission would then tell the sender and allow a reasonable time to rectify (Article 8(3), (5), (6)). Registered mail and hand delivery would be available only in exceptional circumstances.

What does it mean for counsel and compliance leads at GPAI model providers, and what should they do now?

If adopted as drafted, the engagement of outside advisers would come before the file does. Unredacted material would be seen only by advisers named to the Commission in advance, and the draft does not provide for them to pass it to the client. A provider whose counsel or experts later move to a competitor would face a notice to the Commission during the investigation and for three years after it.

The one-week windows are short. Reasoned requests for non-confidential versions or wider access (Article 2(6)) and objections to disclosure of a confidentiality claim (Article 3(6)) would each run on a week.

On records, the penalty-imposition clock would restart on each interrupting act, with a ceiling of twice the period. The draft does not say how long a provider should keep records. Our inference, not the draft's statement, is that a retention schedule shorter than the exposure window could be hard to defend.

One scope point. The draft is framed around operators of AI systems within Article 75(1) and recites exclusive competence over systems built on a general-purpose model by the same provider or undertaking. In the text we read, it does not describe how it applies to a model provider with no such system. Our earlier coverage of AI Office enforcement of GPAI model rules covers the enforcement background.

For preparation:

• Check your position against Recital 1. Work out whether your model and system fall within the Article 75(1) description before assuming the procedure would apply to you.
• Decide on feedback. Submissions go through the Better Regulation portal until 9 November 2026. The numbering errors, the non-exhaustive interruption wording and the ten-year ceiling are possible subjects.
• Treat no term as settled. Planned adoption is the fourth quarter of 2026 and the text can change.
• Check whether outside counsel and experts could accept disclosure terms of the kind in Article 2(3), including the three-year notice.
• Confirm who holds a Qualified Electronic Signature that complies with Regulation (EU) No 910/2014, since an unverifiable signature would mean a filing is deemed not received.
• Compare record-retention schedules for model and system documentation with a possible five-year horizon with restarts.

What we did not verify

What we opened: the full 10-page draft PDF and the Better Regulation portal record for the initiative.

What we did not open: the text of Articles 75a to 75d of Regulation (EU) 2024/1689. The EUR-Lex pages returned no text when we tried. We have not read stakeholder feedback.

What we refuse to claim: the content of Article 75c(1), the amount or cap of any fine, whether and when Articles 75a to 75d apply, that any proceeding has been opened, or that the final text will match this draft.

Drafting errors we found in the draft, which matter if you cite it: Article 4(3) refers to suspension under a "paragraph 6" that Article 4 does not contain. Article 4(4) refers to a decision "referred to in paragraph 1" although paragraph 1 refers to none. Article 5(1) and (2) both set the start of the enforcement period. The two paragraphs of Article 6 are numbered 6 and 7 and refer to paragraphs 2 and 1. Do not rely on the draft's internal cross-references as final.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• AI Regulation News hub
• Europe AI regulation tracker
• AI laws by profession
• AI Office enforcement of GPAI model rules and fines, August 2026
• Commission Implementing Regulation 2026/1755 on GPAI model access and evaluation
• EU Digital Omnibus: AI Act deadlines deferred
• The EU AI Omnibus entered into force: the calendar it locks in