EU draft rules let the AI Office restart its fining clock for up to ten years

The European Commission has circulated a draft that spells out how it would investigate and fine AI systems built on general-purpose models. Dated October 12, 2026, it sets a five-year window to impose a fine, lets six enforcement steps restart that window, and caps the total at ten years. The draft is open for feedback until November 9 and is planned for adoption in the fourth quarter.

What the draft is

The document is a draft Commission Implementing Regulation, reference Ares(2026)9589403, on practical and specific arrangements for proceedings under Articles 75c and 75d of the AI Act (Regulation (EU) 2024/1689). The trade site ppc.land, which published the text's contents, stresses that the draft has not been adopted or endorsed by the Commission and names no company.

Its scope is AI systems built on a general-purpose model by the same provider or undertaking, and AI systems integrated into designated very large online platforms or search engines. In plain terms, it is the procedure for cases where the model maker and the product maker are one firm. That describes the biggest developers.

How the clock works

Article 4 sets the base period to impose fines at five years, running from when continuing non-compliance ends. Six actions interrupt it: information requests, system evaluation requests, inspections, structured dialogue invitations, opening proceedings and reopening proceedings. The wording is blunt: "Each interruption of the period referred to in paragraph 1 shall start time running afresh."

An absolute ceiling of ten years applies, extended by suspension periods. Suspension happens while the EU Court of Justice reviews a Commission decision, and while an on-site inspection awaits judicial authorization. Separately, a fine must be enforced within five years of the decision becoming final, also subject to interruption.

Because any request for information resets the base period, a determined enforcer could keep a case alive well beyond five years. That is standard in EU competition law, but it is new to AI.

Who sees the file

Access to the file is narrow. It is available only to the addressee and not before preliminary findings are notified. A first layer gives the documents cited, with business secrets redacted. A second layer gives the full file, but only to a limited number of named external legal and economic counsel and technical experts, none employed by the addressee. If such an adviser joins the addressee or a competitor within three years of the investigation's end, both sides must notify the Commission.

Business secrets get their own procedure. Suppliers must substantiate each confidentiality claim document by document, and unsubstantiated claims may be treated as non-confidential. The Commission gives one week's notice before disclosing contested material.

Where the fines come from

The draft does not set fine levels. Those sit in the AI Act. According to the summary, Article 75c refers to Article 99: up to EUR 35 million or 7% of worldwide turnover for prohibited practices, and up to EUR 15 million or 3% for most other infringements. For general-purpose model providers specifically, Article 101 caps fines at 3% of worldwide annual turnover or EUR 15 million, whichever is higher, according to the Commission's AI Act Service Desk. The Commission must share preliminary findings first, and the EU Court of Justice has unlimited jurisdiction to cancel, reduce or increase a fine.

How it relates to the earlier rules

The new draft closely mirrors the procedure for model providers. A March 2026 draft, Ares(2026)2709234, was open for feedback from March 12 to April 9, per CMS law and ppc.land, and set a minimum 14-day response period to preliminary findings. According to ppc.land, the new draft follows Implementing Regulation (EU) 2026/1755 adopted July 20, 2026, adds inspections and reopening of proceedings as interrupting actions, and drops some detail, such as the minimum 21-day reply period and page limits on written observations.

ppc.land also lists drafting errors, including cross-references to paragraphs that do not exist. Final text may change, and the numbering will need fixing.

Why it matters for frontier labs

The EU has so far offered the loudest rules and the quietest enforcement. This draft is part of the plumbing that changes that. AI Office enforcement powers over new general-purpose models start in August 2026, per ppc.land, and for models already on the market before August 2025 in August 2027. A procedure with a long clock and a tight file-access regime favors the regulator. Companies should expect cases to be slow, document-heavy and hard to run out.

The definitions are relevant to how we cover the race. What counts as frontier is still contested, as our explainer on who decides what frontier AI means shows. The thresholds that trigger EU duties will matter more as enforcement turns real.

What companies should check

Three provisions deserve a close read before November 9. The interruption list, because it defines how routine requests extend exposure. The file-access rule, because it limits which of a company's own people can see the evidence in a case. And the three-year adviser restriction, which could shape which firms and experts a developer can use. None of these set what counts as a violation. That remains the job of the AI Act itself and the Commission's guidance.

Our take

Read this as procedure, not punishment. No fines are announced and no company is named. But the clock reset is the provision to keep an eye on, because it changes how long a model provider lives under a live case. If you are a developer with EU exposure, file feedback before November 9, and ask for clarity on whether routine information requests really restart the period. If you are a regulator watcher, the interesting question is who the first case will be.