Who can investigate an AI provider under the EU AI Act?
A new Commission overview maps the AI Office, national authorities and the EDPS, along with complaint routes and maximum penalties. It clarifies the framework but does not announce a new law or enforcement case.
The short version
- What happened
- The Commission's AI Office oversees general-purpose AI providers and certain connected systems; national authorities handle other AI systems, while the EDPS covers EU institutions.
- Who it affects
- Individuals and organisations now have a clearer route for allegations within the AI Office's remit, but the identified complaint form is not anonymous.
- What remains unproven
- The Commission says the overview is informational, does not replace the AI Act and does not bind the Commission.
The map separates three enforcement routes
The European Commission has published a consolidated map of AI Act enforcement. The AI Office covers providers of general-purpose AI models, systems built by the same provider or business group, and AI integrated into designated very large online platforms or search engines. National competent authorities cover other AI systems, while the European Data Protection Supervisor enforces the rules for EU institutions.[1][2]
Who it affects
Individuals and organisations now have a clearer route for allegations within the AI Office's remit, but the identified complaint form is not anonymous.[1][2]
Keep in mind
The Commission says the overview is informational, does not replace the AI Act and does not bind the Commission.
The page publishes no complaint denominator, investigation outcome, response time, sanction or remedy.
The linked complaint and whistleblower pages were last updated 6 October 2026, so their existence should not be presented as a 20 October launch.
Source analysis · 2 linked sources. Original source date: 20 October 2026.
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Read the full report · 3 min The evidence, methods, implications and limitations
The map separates three enforcement routes
The European Commission has published a consolidated map of AI Act enforcement. The AI Office covers providers of general-purpose AI models, systems built by the same provider or business group, and AI integrated into designated very large online platforms or search engines. National competent authorities cover other AI systems, while the European Data Protection Supervisor enforces the rules for EU institutions.
For people and organisations, that division determines where a complaint goes. The identified AI Office complaints route requires contact details and covers alleged infringements inside the Office's remit; submissions can use any official EU language. Eligible people professionally connected to a provider can use a separate anonymous whistleblower channel. Matters outside the Office's remit may be referred to national or fundamental-rights authorities with consent.[1][2]
The Office has tools, but this page reports no case outcome
The overview says the AI Office can request information, require access for model evaluations, ask providers to take measures and, where necessary, restrict public availability. It also summarises maximum penalties already set by the Act: up to €35 million or 7% of worldwide annual turnover for prohibited practices, €15 million or 3% for other breaches including general-purpose-model duties, and lower limits for some information failures.
The page is not a new regulation, enforcement decision or finding that a provider broke the law. Commission services explicitly say it is informational and non-binding. Its value is procedural clarity for complainants and providers; evidence of practical impact will come from published cases, response times, referrals, remedies and court or supervisory scrutiny.[1]
The distinction that matters
Which authority handles which AI system?
The responsible body depends on the provider, system and institution involved.
AI Office
GPAI providers and certain connected systems
EU-level investigation and sanctions
National
Other AI systems
Member-state market surveillance
EDPS
AI used by EU institutions
Institutional supervision
Evidence check
The Commission says the overview is informational, does not replace the AI Act and does not bind the Commission.
The page publishes no complaint denominator, investigation outcome, response time, sanction or remedy.
The linked complaint and whistleblower pages were last updated 6 October 2026, so their existence should not be presented as a 20 October launch.
Reporting basis: Source analysis. Original source date: 20 October 2026.
Continue the story
Read next
Continue exploring eu ai act: compare the finding and its evidence limits.
EU AI Act moves from rulebook to staged implementation
The European Commission's official AI Act portal sets out the risk-based framework, prohibited practices, general-purpose AI obligations and the staged dates on which different duties apply.
Read the next reportExplore the full source and evidence record
What this means for people
- Individuals and organisations now have a clearer route for allegations within the AI Office's remit, but the identified complaint form is not anonymous.
- Providers need to know which authority can request information, model access or corrective measures; an overview does not replace legal advice or the Act itself.
Global context
The framework applies inside the European Union, but overseas model providers can fall within scope when placing models or systems on the EU market. Other jurisdictions retain their own enforcement structures and legal tests.
What the evidence does not yet show
- The Commission says the overview is informational, does not replace the AI Act and does not bind the Commission.
- The page publishes no complaint denominator, investigation outcome, response time, sanction or remedy.
- The linked complaint and whistleblower pages were last updated 6 October 2026, so their existence should not be presented as a 20 October launch.
What to watch next
- The first published AI Office investigations, evaluations, corrective measures or penalties
- Complaint volumes, eligibility decisions, referrals, response times and remedies
- National authority designations and coordination in cross-border cases
Living evidence record
Impact record IAI-0Y087HQ
Evidence stage
Announced
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Not yet
Record status
Monitoring
Last checked
21 October 2026
Source trail
2 direct sources across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Related-source reporting disclosure
This record analyses 2 linked source records around the same underlying development. The extra records add method, date or context, but they do not by themselves constitute independent replication of every performance claim or predicted outcome.
Evidence trail
Sources used for this report
Links checked 21 October 2026
Research question, topics and regions
How the European Commission divides AI Act enforcement responsibilities and complaint routes
Topics: EU AI Act · AI Office · Enforcement · Complaints · General-purpose AI
Regions: European Union · Europe
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.