Enforcement of the EU AI Act: The EU AI Office

On 21 May 2024, the Council of the European Union adopted the Regulation laying down harmonised rules on artificial intelligence or the AI Act. As the world's first comprehensive law to regulate artificial intelligence, the AI Act establishes uniform requirements for the development and use of artificial intelligence in the EU. 

Once signed, the Regulation will be published in the Official Journal of the EU and will enter into force 20 days after publication.

As a European regulation, the AI Act applies in all 27 EU member states, and is a key component of the European digital strategy (A Europe fit for the digital age). The AI Act will have a far-reaching impact on companies in Europe and around the world. 

In a series of articles over the coming weeks, we will outline the enforcement structure of the EU AI Act and explain what measures companies can expect in the coming years.

This article, the first in the series, looks at the enforcement structure at a European level through the EU AI Office.

The EU AI Office was established on 24 January 2024, before the AI Act was adopted by the European Parliament, by the founding decision of the Commission. 

The EU AI Office, which will be the centre of AI expertise in the EU, will perform key tasks as part of the EU's AI strategy, such as overseeing the regulation of general purpose AI models (GPAI models) and AI systems based on a GPAI model and developed by the same provider. In addition, the EU AI Office will play an important role in the adoption of codes of conduct, technical regulations and standards. 

EU AI Office as part of the EU Commission 

From an administrative point of view, the EU AI Office is part of the administrative structure of the European Commission's Directorate-General for Communication Networks, Content and Technologies (DG Connect), the European Commission’s department for technology. The former Directorate A in DG Connect is currently being reorganised to implement the EU AI Office. As of 16 June 2024, the EU AI Office will be integrated into this directorate, which will then consist of the following units: 

• CONNECT.A.1 Excellence in Artificial Intelligence and Robotics 
• CONNECT.A.2 Artificial Intelligence Regulation and Compliance 
• CONNECT.A.3 Artificial Intelligence Security 
• CONNECT.A.4 Artificial Intelligence Innovation and Policy Coordination 
• CONNECT.A.5 Artificial Intelligence for Societal good.

The AI Office will be led by the Head of the AI Office, Lucilla Sioli, who is currently Director of AI and Digital Industry within DG Connect and will work under the guidance of a Lead Scientific Adviser to ensure scientific excellence in evaluation of models and innovative approaches. Additionally, an Adviser for International Affairs will be appointed to oversee the Office's commitment to collaborate closely with international partners on trustworthy AI.

Of particular importance and practical relevance is the ‘Regulation and Compliance’ unit (CONNECT.A.2), which will coordinate the regulatory approach to facilitate the uniform application and enforcement of the AI Act throughout the EU. The unit will work closely with member states and contribute to investigations on possible infringements. 

The EU AI Office will initially have 140 employees, of whom 60 are already working within the European Commission. In addition to lawyers and digital policy experts, AI engineers are currently being sought internally and externally for this purpose.

EU AI Office is responsible for the enforcement of GPAI provisions 

The final AI Act contains provisions that were not included in the European Commission's original proposal from April 2021. These include rules for GPAI models, AI systems based on a GPAI model, and a governance structure to monitor these rules. In this governance structure, the EU AI Office is supported at European level by the European Artificial Intelligence Board (Article 65 of the AI Act), the Advisory Forum (Article 67 of the AI Act) and the scientific panel of independent experts (Article 68 of the AI Act). The second article of this Law-Now series will examine this governance structure.

The central element within this governance structure is the EU AI Office, which acts as the market surveillance authority for GPAI models and AI systems based on a GPAI model developed by the same provider. 

The surveillance of other AI systems regulated by the AI Act is the responsibility of the national market surveillance authorities. 

When enforcing the rules on GPAI models, the EU AI Office – in contrast to national authorities responsible for market surveillance and control of AI systems in EU member states – is not limited to the measures provided for in Regulation (EU) 2019/1020 (i.e. the EU Market Surveillance Regulation). Instead, Article 89(1) of the AI Act clarifies that the EU AI Office may take "the necessary actions" to enforce the AI Act's GPAI model provisions. 

Therefore, it is also possible for the EU AI Office to carry out activities beyond market surveillance. The AI Office, however, lacks a toolbox of specific investigative powers, such as those available to the European Commission to enforce the DMA und DSA. Therefore, the AI Office will likely work closely with other European Commission services (e.g. with DG Competition for antitrust investigation). Such cooperation is expressly provided for in Article 5 of the Decision establishing the AI Office. 

The Commision will carry out the imposition of fines (e.g. infringing GPAI provisions of the AI Act will result in penalties of up to 3% of the previous year's worldwide turnover or EUR 15 million) in accordance with Article 101(1) of the AI Act, but the exact procedure has not yet been formulated. The EU AI Office, however, will play a central role as the enforcement authority. In administrative terms, this corresponds to a structure that already exists today such as the Directorate-General for Competition or the Directorate-General for Trade.

The priorities of the EU AI Office will be determined by the ambitious timetable of the AI Act in the first months after its entry into force. Therefore, the initial focus will be on supporting the European Commission in the development of the accompanying measures to the AI Act (e.g. guidelines, codes of conduct and implementing acts), which number more than 80. 

EU AI Office’s coordinating responsibilities with member states 

In addition to the enforcement role of the GPAI Commission, the EU AI Office must ensure the uniform application and enforcement of AI Act in EU member states. 

The responsibilities of the EU AI Office in this area will be determined by the ambitious timetable of the AI Act in the first months after its entry into force. The initial focus will be to support the European Commission in the development of the more than 80 accompanying measures to the AI Act (e.g. guidelines, codes of conduct and implementing acts). 

In addition, the AI Office will coordinate the uniform enforcement of the rules on prohibited practices and high-risk AI systems across Europe. A central element of this will be the establishment of an EU database for high-risk AI systems in accordance with Art. 71 of the AI Act. 

Furthermore, the AI Office will act as the secretariat for the AI Advisory Board and its subgroups and will provide administrative support for the Advisory Forum and the Scientific Panel of Independent Experts, including organising meetings and preparing relevant documents.

Of particular importance will be the AI Office’s participation in the development of the European Commission's guidelines on the practical implementation of a definition of an AI system (Art. 96(1)(f) of the AI Act) and the guidelines on the practical implementation of the prohibition under Article 5 (Art. 96(1)(b) of the AI Act), which are to be issued within six months.

Participation in the standardisation and adoption of technical regulations 

According to the Commission’s founding decision, the EU AI Office will play a supporting role in the development of technical norms and standards for AI systems. Essentially, it is to assist the European Commission in preparing standardisation mandates, reviewing existing standards and developing common specifications required for the implementation of the AI Act. 

In addition, the EU AI Office is empowered, at the request of the European Commission or on its own initiative, to issue recommendations and written opinions on all relevant aspects related to the implementation of the AI Act and its consistent and effective application. This includes technical specifications and the review of existing standards regarding the requirements of the AI Act, and the use of harmonised standards or common specifications within the mandate of the standardisation organisations CEN and CENELEC.

Further tasks of the AI Office 

Alongside its role as a market surveillance authority with wide-ranging enforcement powers, the AI Office will also promote innovation. The EU AI Office is to act as a "centre of AI expertise across the EU" working with national, European and international organisations. 

In addition, the AI Office oversees the AI Pact, an initiative that enables companies to work with the European Commission and other stakeholders before the AI Act comes into force. 

Other tasks of the AI Office include the development of "codes of conduct" and supporting the European Commission in the preparation of implementing acts and delegated acts for the implementation of the AI Act.

The EU AI Office has far-reaching competences in the enforcement of the AI Act 

With the enforcement of the GPAI provisions by the EU AI Office, the European Commission is responsible for enforcing the “core regulatory provisions” of the AI Act. By delegating the enforcement of other AI provisions to national authorities, the EU is developing a dual structure for the enforcement of the AI Act. Whether this will lead to friction losses in enforcement remains to be seen. In any case, the EU AI Office is indirectly involved in the enforcement of most provisions of the AI Act, whether through its involvement in the guidelines on prohibited practices or through the operation of the database for high-risk AI systems. 

The European Commission also reserves the right to continue to steer European AI expertise through the numerous other tasks of the EU AI Office, whether in connection with the promotion of AI innovation or the design of codes of conduct in the AI Act.

With the establishment of the EU AI Office, the European Commission has created an authority with far-reaching responsibilities and powers. In the coming years, it will play a central role in shaping European AI policy and implementing and enforcing the EU AI Act. 

Part 2 of this series will explore the governance structure set down in the AI Act for monitoring the rules that oversee GPAI models and AI systems based on GPAI models, 

For more information on the EU AI Act and the regulatory powers of the AI Office, contact your CMS client partner or these CMS experts: 

Italo de Feo, Tom de Cordier, Björn Herbers, Markus Kaulartz, Maria González Gordon, Ian Stevens, David Rappenglück