Cambridge Commentary on EU General-Purpose AI Law

Commentary

1. General remarks

1.1. Introduction

1Section 5 of Chapter IX of the AI Act, which is concerned with supervision, investigation, enforcement and monitoring powers of the Commission, begins with Article 88.¹ These supervision, investigation, enforcement and monitoring powers relate to the substantive obligations for providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. of general-purpose AI (“GPAI”) models found in Chapter V AI Act (Articles 51–56).² Article 88(1) declares that it is the Commission that has exclusive powers to supervise and enforce the obligations imposed upon providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. of GPAI models by the AI Act, with implementation tasks entrusted to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. . Although it does not specify this in Article 88(1), some authors have observed that these powers are exhaustive.³

1.2. Legislative history

2The Commission’s April 2021 proposal for an AI Act did not make provision for the regulation of GPAI models at all and did not provide for centralised enforcement by the Commission.⁴ In that proposal, AI systems Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. were to be supervised by national competent authorities Article 3(48) AI Act: ‘national competent authority’ means a notifying authority or a market surveillance authority; as regards AI systems put into service or used by Union institutions, agencies, offices and bodies, references to national competent authorities or market surveillance authorities in this Regulation shall be construed as references to the European Data Protection Supervisor. , which had reporting obligations to the Commission.⁵

3In the European Parliament’s proposal in June 2023, a body called the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. was introduced,⁶ as was the concept of a foundation model. This concept of a foundation model can be seen as a precursor to the concept of GPAI models used in the enacted version of the AI Act,⁷ and many of the AI system Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. obligations applied mutatis mutandis to the providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. of foundation models.⁸ As envisaged by the European Parliament’s proposal, the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. was not a component part of the Commission and was a separate entity with legal personality. However, the Parliament’s proposal did not confer enforcement powers vis-à-vis foundation model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. on the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. , although it did give the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. what might be considered monitoring and implementation tasks.⁹ The enacted version of Article 89(1) AI Act, not Article 88(1), is drafted in similar terms to that provision within the Parliament’s proposal; it provides that the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. can take ‘necessary actions to monitor the effective implementation, and compliance with, this Regulation by providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. of general-purpose AI models Article 3(63) AI Act: ‘general-purpose AI model’ means an AI model, including where such an AI model is trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications, except AI models that are used for research, development or prototyping activities before they are placed on the market. ’.¹⁰

4The point at which the drafts began to contain the same terms as the enacted AI Act in relation to supervision and enforcement of GPAI models appears to have occurred just before or during the trilogues in late 2023 that ultimately resulted in the political agreement enshrined in the AI Act. A Council Presidency trilogue preparation document dated 28 November 2023 contains a revised text of the AI Act that provides for GPAI models and includes a chapter dealing with supervision, investigation, enforcement and monitoring of such models. Moreover, it contains a draft provision very similar to what became Article 88.¹¹ A similar provision to Article 89(1) is also found in the trilogue preparation document under Chapter 3A, Article B(1).¹² It is also notable that the provisions that became Articles 88–93 and 101 did not include any provision for the procedural rights now found in Article 94.¹³ What became Article 94 was introduced only in the final compromise text from the trilogue of 6–8 December 2023.¹⁴

5The legislative history of Article 88 does not provide clarity as to the status of the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. and its relationship to the Commission. The revised text proposed by the Council Presidency in the November 2023 document refers to the Commission and the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. interchangeably, marked by ‘[ AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. /Commission]’. For example, in what would become Article 88(1), the November 2023 document reads under Chapter 3A, Article A(1):

‘The Commission shall have exclusive powers to supervise and enforce Chapter/Title [general purpose AI models] and shall entrust the implementation of these tasks to the European [Commission/ AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. ] without prejudice to the powers of organisation of the Commission’.¹⁵

6It is difficult to draw a firm conclusion on the institutional status of the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. and the role it ought to have in supervision and enforcement from this drafting. On the one hand, it may indicate that the choice between referring to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. or the Commission was not regarded as consequential, such that either reference was acceptable. On the other hand, it is also possible to argue that the choice to refer to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. rather than the Commission turned on what was to be agreed concerning the institutional status of the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. , in particular whether it was to be part of, or independent of, the Commission. This is addressed in greater detail below in the context of the discussion of the distinction between the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. and the Commission.

7In the Committee of Permanent Representatives’ document dated January 2024 approving the political agreement that resulted from the trilogue negotiations in December 2023, the following is stated regarding governance under the AI Act:

‘While for AI systems Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. the market surveillance system on the national level will apply, these new rules for GPAI models provide for a new more centralised system of oversight and enforcement. For this purpose, the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. will be established as a new governance structure with a number of specific tasks in respect of GPAI models, and with a strong link with the scientific community to support its work.’¹⁶

8Whilst the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. is referred to as a ‘new governance structure with a number of specific tasks […]’, even from this language it is difficult to draw any firm conclusion on the institutional status of the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. and the role it ought to have in supervision and enforcement. The text does suggest that the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. will be a ‘new governance structure’ but it does not address the question of whether it is a structure with operational autonomy or whether it is one that is to operate within the Commission.

9The final content of Article 88 appeared as Article 68f in a provisional agreement resulting from the interinstitutional negotiations, that is, the trilogues, dated February 2024.¹⁷

1.3. Rationale for a centralised approach

10Despite the lack of clarity mentioned in the foregoing subsection, it is clear that Article 88(1) establishes a centralised approach to the supervision and enforcement of GPAI models. This approach finds its rationale in Recital 162 AI Act which highlights the need to make use of ‘the centralised Union expertise and synergies at Union level’ for the supervision and enforcement of GPAI model provider Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. obligations under the AI Act.¹⁸ This contrasts with the scheme adopted by EU law in relation to, for example, the regulation of data protection under the General Data Protection Regulation (“GDPR”) where enforcement is led by supervisory authorities within the Member States.¹⁹ The decentralised nature of GDPR enforcement has, in the view of some authors, resulted in forum shopping, inconsistent enforcement and inefficiencies in enforcement.²⁰ For example, a 2024 Commission report details diverging approaches to enforcement by national data protection authorities on key data protection concepts.²¹ The same report states that data protection authorities in Member States consider that insufficient resources and gaps in technical and legal expertise are the main factors affecting their enforcement capacity.²² A separate report noted that the inadequate resourcing of national data protection authorities was also hampering their effectiveness.²³ Compared to GDPR enforcement, a relatively small number of actors building GPAI models means that centralised monitoring, supervision and enforcement by the Commission, rather than market surveillance authorities Article 3(26) AI Act: ‘market surveillance authority’ means the national authority carrying out the activities and taking the measures pursuant to Regulation (EU) 2019/1020. (“MSAs”), is feasible.²⁴

11Given the difficulties with the approach under the GDPR, it is unsurprising that the Digital Markets Act²⁵ (“DMA”) and the Digital Services Act²⁶ (“DSA”) are both indicative of a move towards centralised enforcement. The DMA and DSA both concern regulated entities and harms that, by their nature, may have cross-border effects. Similar to the AI Act, the DMA and the DSA allow for centralised enforcement once a specified threshold level is passed.²⁷ In each of the DMA and DSA, the Commission has been given direct powers to inter alia investigate²⁸ and enforce through, for example, fines²⁹.

12Against this backdrop, it is unsurprising that, in the AI Act, the EU legislature opted for centralised enforcement for GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. , given that the technical gaps and under-resourcing that have plagued GDPR enforcement were also likely to arise in the enforcement of the AI Act’s obligations for GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. . Indeed, the enforcement challenges were likely to be exacerbated due to the need for highly specialised technical expertise and resources to assess whether GPAI models conform to the provisions of the AI Act.³⁰ Further, this centralised approach extends to situations where an AI system Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. is based on a GPAI model and the provider Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. of both the system and the model is the same; in such cases, under Article 75(1) AI Act, the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. is granted certain powers that MSAs enjoy.³¹ However, despite these provisions, the role of centralised enforcement should not be overstated. In essence, the AI Act’s use of centralised enforcement turns on the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. ’s expertise in monitoring, supervising, investigating and enforcing against GPAI models and, therefore, accounts for only a small portion of overall enforcement activity under the AI Act. Otherwise, generally in relation to AI systems Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. (albeit subject to Article 75(1)), the AI Act requires Member States to enforce the obligations of the AI Act and to establish or designate as national competent authorities Article 3(48) AI Act: ‘national competent authority’ means a notifying authority or a market surveillance authority; as regards AI systems put into service or used by Union institutions, agencies, offices and bodies, references to national competent authorities or market surveillance authorities in this Regulation shall be construed as references to the European Data Protection Supervisor. at least one notifying authority Article 3(19) AI Act: ‘notifying authority’ means the national authority responsible for setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring. and at least one MSA to do so.³²

13The interaction of centralised enforcement and enforcement at Member State level is recognised in Article 88(2) AI Act, which allows, subject to the conditions of necessity and proportionality, MSAs to request that the Commission exercise its powers of supervision, monitoring and enforcement to assist them in their tasks.³³ Article 88(2) can be seen as part of an approach to ensure that there are no enforcement gaps arising from the bifurcated enforcement system that the AI Act enshrines.

1.4. Overview of this chapter

14The remainder of this chapter follows a paragraph-by-paragraph analysis of Article 88 and refers to the wider context of the AI Act where appropriate.

2. Analysis

2.1. Article 88(1)

2.1.1. The Commission’s exclusive function

15Article 88(1) reserves exclusively to the Commission the supervision and enforcement of the obligations of providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. of GPAI models found in Chapter V AI Act. Supervising, monitoring and enforcement are provided for in Articles 89–93 AI Act.

16Article 88(1) specifies that the ‘implementation of these tasks’ is entrusted to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. , without prejudice to the powers of organisation of the Commission and the division of competences between the Member States and the Union as set out in the Treaties. For completeness, penalties for breach of obligations are provided for elsewhere, in Article 101 AI Act, in the form of fines that may be levied against GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. by the Commission.³⁴

17It is of note that ‘monitoring’ appears in the section heading, whereas Article 88(1) itself does not refer to monitoring in respect of GPAI models. There are a number of plausible explanations for this.

18One possible explanation is that Article 88(1) is to be interpreted as a competence allocation provision. It declares that the Commission has the exclusive function in relation to supervision and enforcement, as these are powers that are exercised vis-à-vis a specific GPAI provider Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. , whereas it is possible to conceive of ‘monitoring’ as the description of an activity that is carried out continuously. This conception of monitoring would mean that the purpose of Article 89 AI Act is to declare that the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. has a role as a monitor, without creating a power that the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. may exercise against a particular GPAI model provider Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. . On this interpretation, the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. is able to monitor the information that providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. of GPAI models with systemic risk Article 3(65) AI Act: ‘systemic risk’ means a risk that is specific to the high-impact capabilities of general-purpose AI models, having a significant impact on the Union market due to their reach, or due to actual or reasonably foreseeable negative effects on public health, safety, public security, fundamental rights, or the society as a whole, that can be propagated at scale across the value chain. are required to disclose³⁵ but, depending on the circumstances, need not take any further action by exercising a power against a particular GPAI model provider Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. in light of that information. The difficulty with this interpretation is that it runs counter to the express wording of Article 89. Article 89 states that the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. should be able to take the ‘necessary actions’, which does suggest that ‘monitoring’ is not simply a description of the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. ’s activities but is itself an empowering provision as well. It is of note that a comparable provision in the DSA has been used to enable the Commission to take necessary actions.³⁶ However, the DSA also provides for particular monitoring tasks on which the AI Act is silent. These include: ‘provide access to, and explanations relating to, its databases and algorithms’ and ‘imposing an obligation on the provider Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. of the very large online platform or of the very large online search engine to retain all documents deemed to be necessary’ to assess the implementation and compliance with the DSA. The Safety and Security Chapter of the GPAI Code of Practice, adopted under Article 56 AI Act, does require signatories to report certain matters to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. that could be seen to facilitate the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. ’s monitoring powers.³⁷ For instance, pursuant to that Chapter of the Code, GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. ‘commit to reporting to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. information about their model and their systemic risk Article 3(65) AI Act: ‘systemic risk’ means a risk that is specific to the high-impact capabilities of general-purpose AI models, having a significant impact on the Union market due to their reach, or due to actual or reasonably foreseeable negative effects on public health, safety, public security, fundamental rights, or the society as a whole, that can be propagated at scale across the value chain. assessment and mitigation processes and measures by creating a Safety and Security Model Report (“Model Report”) before placing a model on the market’ and ‘[f]urther, Signatories commit to keeping the Model Report up-to-date’ and ‘notifying the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. of their Model Report’.³⁸ GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. are also required to adopt a safety and security framework to ‘outline the systemic risk Article 3(65) AI Act: ‘systemic risk’ means a risk that is specific to the high-impact capabilities of general-purpose AI models, having a significant impact on the Union market due to their reach, or due to actual or reasonably foreseeable negative effects on public health, safety, public security, fundamental rights, or the society as a whole, that can be propagated at scale across the value chain. management processes and measures that Signatories implement to ensure the systemic risks Article 3(65) AI Act: ‘systemic risk’ means a risk that is specific to the high-impact capabilities of general-purpose AI models, having a significant impact on the Union market due to their reach, or due to actual or reasonably foreseeable negative effects on public health, safety, public security, fundamental rights, or the society as a whole, that can be propagated at scale across the value chain. stemming from their models are acceptable’.³⁹ The GPAI model provider Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. is required to provide the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. with access to the framework.⁴⁰ Additionally, GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. are required to draw up and keep up to date certain other information which the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. may request.⁴¹

19The Code of Practice, as it is not binding in itself, does not have the same legal status as an obligation found in the AI Act. However, insofar as GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. choose to adhere to the Code of Practice in order to demonstrate compliance with the AI Act, the effect of the Code of Practice is significant.⁴²

20An alternative interpretation of Articles 88 and 89 is that the legislature considered that ‘monitoring’ is captured by the term ‘supervision’. The first reason to support this interpretation is that the description of monitoring in Article 89(1) is ‘to “monitor” the effective implementation and compliance’ with the obligations in the AI Act. This description of Article 89(1) could easily be understood as a supervisory power captured by Article 88.⁴³ Moreover, it is noteworthy that there was no reference to supervision in the Parliament’s proposal for the role of the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. , whereas that proposal did refer to a ‘monitoring’ function by which the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. was to provide ‘particular oversight and monitoring and institutionalize regulator dialogue with the providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. of foundation models about the compliance of foundation models […]’.⁴⁴ This sounds broadly similar to what might be understood as ‘supervision’.

21It is also notable for these purposes that the AI Act does not contain a standalone article entitled ‘supervision’. Therefore, it seems plausible that ‘monitoring’ was included in earlier drafts and was intended to be captured by the term ‘supervision’ used in Article 88(1) as enacted.

22Whilst the use of ‘supervision’ and ‘enforcement’ may be considered inconsistent in some provisions of the AI Act,⁴⁵ there is no apparent reason to suggest that discrepancies in the use of ‘monitoring’ between the title of Section V of Chapter IX AI Act, Article 88(1) and Article 89 mean that ‘monitoring’ ought to be considered as falling outside of supervision.

23Looking outside Article 88 AI Act, the Commission’s powers to supervise and enforce Chapter V AI Act in respect of GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. include:

1. requesting documentation and information from GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. ;⁴⁶
2. carrying out evaluations on GPAI models;⁴⁷ and
3. requesting compliance measures from GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. .⁴⁸

24A noteworthy feature of the Commission’s supervision and enforcement powers in relation to GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. is that they are cast more broadly and, in several respects, with far less detail than the MSAs’ powers. For example, Article 74(5) AI Act,⁴⁹ which relates to the MSAs’ enforcement of obligations pertaining to AI systems Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. , provides that those MSAs have the power to conduct ‘unannounced on-site inspections and physical checks of products’⁵⁰ and ‘the power to acquire product samples, including under a cover identity, to inspect those samples and to reverse-engineer them in order to identify non-compliance and to obtain evidence’.⁵¹ No such specific powers are granted to the Commission in its supervisory and enforcement capacity vis-à-vis GPAI models. Instead, the powers granted to the Commission in, for example, monitoring under Article 89 AI Act are expressed as follows: ‘the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. may take the necessary actions to monitor the effective implementation of, and compliance with, this Regulation by providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. of GPAI models, including their adherence to approved codes of practice’.⁵² It should also be noted that Article 91(1) includes a catch-all phrase enabling the Commission to request ‘any additional information that is necessary for the purposes of assessing compliance of the provider Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. with this Regulation.’ Similarly, Article 92 permits the Commission to conduct evaluations in certain circumstances and, under Article 92(3), for such an evaluation, the Commission may request ‘access to the general-purpose AI model Article 3(63) AI Act: ‘general-purpose AI model’ means an AI model, including where such an AI model is trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications, except AI models that are used for research, development or prototyping activities before they are placed on the market. concerned through APIs or further appropriate technical means and tools, including source code.’ Moreover, the EU is not conferred with police or law enforcement Article 3(46) AI Act: ‘law enforcement’ means activities carried out by law enforcement authorities or on their behalf for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security. powers under the Treaties and, pursuant to Article 5(1) and (2) TEU, the principle of conferral means that the EU does not have powers that it is not afforded under the Treaties.⁵³ As such, the Commission is not permitted to exercise physical coercion in the territories of Member States in cases of non-cooperation⁵⁴ and, therefore, it is remarkable that national authorities are not expressly called upon to assist the Commission when it pursues enforcement against GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. under Section 5 of Chapter IX AI Act.⁵⁵ That said, the Commission can rely on Member States to assist enforcement of a fine against a GPAI model provider Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. under Article 299 TFEU.⁵⁶

25It is worth comparing and contrasting the AI Act and the DMA in this regard. The DMA permits the Commission to conduct all necessary inspections of an undertaking or association of undertakings.⁵⁷ However, in cases of non-cooperation, the Commission is not given powers of physical coercion. Accordingly, the DMA enforcement architecture expressly recognises that it requires the assistance of national courts and the police to enable the Commission to exercise coercive powers. Thus, Article 23(2) DMA defines in detail the inspection powers, including entering business premises and means of transport, examining and copying business records, sealing premises and records, and questioning staff.⁵⁸ Article 23(3) permits the Commission to request the assistance of, inter alia, the national competent authority Article 3(48) AI Act: ‘national competent authority’ means a notifying authority or a market surveillance authority; as regards AI systems put into service or used by Union institutions, agencies, offices and bodies, references to national competent authorities or market surveillance authorities in this Regulation shall be construed as references to the European Data Protection Supervisor. of the Member State in whose territory the inspection is to be conducted.⁵⁹

26These DMA provisions create an express regime in which national authorities and courts are under a positive obligation to facilitate the Commission’s powers of inspection, including by deploying police powers and by granting judicial authorisation. By contrast, Section 5 of Chapter IX AI Act contains no equivalent provisions requiring national authorities to assist the Commission in the execution of its enforcement powers vis-à-vis providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. of GPAI models. National authorities may ask the Commission to intervene (Article 88(2)), but the Commission cannot, in turn, rely on a DMA-style express duty of active assistance when exercising its own powers under Articles 89–93.

27However, it is of note that Article 64(2) provides that Member States ‘shall facilitate the tasks entrusted to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. ’.⁶⁰ Although this obligation is not expressed specifically in relation to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. ’s tasks under Articles 89–93, its terms are broad enough to capture those tasks.

28Further, Member States are under a duty of sincere cooperation pursuant to Article 4(3) TEU, and the Court of Justice in Sea Watch stated that this means:

‘[…] account must be taken of the principle of sincere cooperation referred to in Article 4(3) TEU, which lays down an obligation for Member States, […] to assist each other, in full mutual respect, in carrying out tasks which flow from the Treaties, to take any appropriate measure to ensure fulfilment of the obligations resulting from, inter alia, acts of the institutions of the Union, and to refrain from any measure which could jeopardise the attainment of the Union’s objectives.’⁶¹

29It has been described as a two-fold duty requiring ‘(1) ancillary obligations with which the Member States and the institutions must comply in implementing a specific provision of Union law or even independently of such implementation’⁶² and ‘(2) a prohibition on Member States or institutions to act where acting would constitute a misuse of powers’.⁶³

30Accordingly, while there may not be an express duty of active assistance in relation to the exercise of powers under Articles 89–93, Article 64(2) and the Treaty obligations of Member States require Member States to, at least, facilitate the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. and arguably imply a duty of active assistance.

2.1.2. Taking into account the procedural guarantees under Article 94

31In exercising its exclusive supervision and enforcement powers, it is clear from the wording of Article 88(1) that the Commission must take into account the procedural guarantees under Article 94 AI Act. Article 94 provides certain procedural safeguards in enforcement that are without prejudice to more specific safeguards elsewhere in the AI Act.⁶⁴

32Article 94 is not the only source of procedural protections for GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. . Article 101(6), for instance, requires the Commission to adopt implementing acts containing ‘detailed arrangements and procedural safeguards for proceedings in view of the possible adoption of decisions’ pursuant to Article 101(1) AI Act. It may be that the investigation stage of proceedings is covered by Article 94 AI Act, whereas the fines proceedings are subject to the safeguards arising from the expressly contemplated implementing regulation. In any event, safeguards established specifically under Article 101 do not seem to be intended to displace Article 94 but rather to supplement the protections the latter offers. This interpretation is supported by the fact that the rights which Article 94 incorporates are basic ones which might be implied in relevant circumstances by various Charter of Fundamental Rights provisions including, inter alia, the right to good administration.⁶⁵ This is explored further below.

33Whilst a full and detailed analysis of Article 94 and its consequences falls outside of the scope of this chapter, it would be remiss not to highlight certain aspects of Article 94 because it contains a number of substantial procedural protections that are crucial to understanding how the supervision and enforcement powers can be exercised. Before doing so, it is worth noting a curious feature of Article 94: rather than specifying those procedural rights in the Article itself, it refers to Article 18 of the Market Surveillance Regulation and states that these rights apply mutatis mutandis.

34It is unclear why the AI Act did not simply list the procedural rights that apply, as in, for example, the DMA⁶⁶ and the DSA.⁶⁷ It is possible that the incorporation of procedural rights by reference to another legislative instrument was simply an expedient measure because Article 94 was only introduced in the final trilogue negotiations that resulted in a political agreement. The legal consequences of this incorporation by reference do not seem significant: the applicable rights are clear in the Market Surveillance Regulation, and it cannot be said that this approach gives rise to interpretive friction.

35Notwithstanding this drafting choice, the applicable rights include: (i) the right to know the grounds on which a decision, measure or order is taken; (ii) the right to have that decision, measure or order communicated without delay; and (iii) save in exceptional circumstances, the right to be heard before such a decision, measure or order is adopted. Even if these rights were not explicitly provided for, they are rights which have similar provisions under the right to good administration pursuant to Article 41 Charter of Fundamental Rights of the European Union (“CFREU”) and Article 298 TFEU.⁶⁸

36The right to know the grounds on which a decision, measure or order is taken is a reflection of the obligations found under Article 296 TFEU⁶⁹ and Article 41(2)(c) CFREU⁷⁰ to state reasons for decisions. Determining the adequacy of reasons will, of course, be context dependent. However, what is required in principle is set out by the Court of Justice of the European Union (CJEU) in various judgments. In HeidelbergCement AG v European Commission, in the context of competition law, the obligation to state specific reasons is said to be a:

‘[…] fundamental requirement, designed not merely to show that the request for information is justified but also to enable the undertakings concerned to assess the scope of their duty to cooperate whilst at the same time safeguarding their rights of defence […]’⁷¹

37There is a link between the right to be heard prior to the adoption of a decision and the right to reasons, which is explained below.

38The right to have that decision, measure or order communicated without delay reflects, in part, Article 41(1) CFREU, which provides that a person is entitled to have his or her affairs handled, inter alia, within a reasonable time by the institutions, bodies, offices and agencies of the Union.

39The right to be heard prior to a decision, measure or order being adopted, save in exceptional circumstances, is also reflected in the right to good administration under Article 41(2)(a) CFREU.⁷² The Charter right does not provide for the caveat ‘save in exceptional circumstances’ which appears in Article 18 Market Surveillance Regulation and is incorporated into the AI Act via Article 94. This right has been considered by the CJEU. In Khaled Boudjlida v Préfet des Pyrénées-Atlantiques, the CJEU explained that the right to be heard ‘guarantees every person the opportunity to make known his views effectively during an administrative procedure and before the adoption of any decision liable to affect his interests adversely’.⁷³ The Court stated that:

‘In accordance with the Court’s case-law, the purpose of the rule that the addressee of an adverse decision must be placed in a position to submit his observations before that decision is adopted is to enable the competent authority effectively to take into account all relevant information. In order to ensure that the person concerned is in fact protected, the purpose of that rule is, inter alia, to enable that person to correct an error or submit such information relating to his or her personal circumstances as will argue in favour of the adoption or non-adoption of the decision, or in favour of its having a specific content (see the judgments in Sopropé, C‑349/07, EU:C:2008:746, paragraph 49, and Mukarubega, EU:C:2014:2336, paragraph 47).’⁷⁴

40The Court went on to explain that the authorities are obligated to pay due attention to the observations submitted by the person concerned, examining carefully and impartially all the relevant aspects of the individual case. Importantly, and linked to the right to reasons, the authorities must give a ‘detailed statement of reasons for their decision.’⁷⁵

41Similarly, the right to be heard under Article 41(2)(a) CFREU applies where it concerns ‘any individual measure which would affect him or her adversely is taken’, whereas under Article 94 there is no express requirement for the individual measure to have an adverse effect, only where a measure, decision or order concerns the economic operator Article 3(8) AI Act: ‘operator’ means a provider, product manufacturer, deployer, authorised representative, importer or distributor. . Practically, it may be difficult to see a distinction between the two.

42Whilst the rights detailed under Article 94 AI Act are not the only ones that will apply,⁷⁶ these rights do set a baseline for the administrative or procedural protections that GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. will have when subject to monitoring, supervision and enforcement by the Commission or the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. , as appropriate.

43It is arguable that the rights under Article 41 CFREU and Article 94 AI Act are not necessarily coextensive; however, the interaction between CFREU rights and the rights in Article 94 AI Act falls outside the scope of this chapter.

2.1.3. The role of the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission.

44The text of the AI Act does make a distinction between the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. and the Commission in Article 88(1). However, it is important to recall two matters: (a) the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. does not have a legal personality distinct from the Commission and (b) Article 3(47) AI Act defines the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. as the function of the Commission responsible for contributing to the implementation, monitoring⁷⁷ and supervision of AI systems Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. and GPAI models, and to AI governance, as provided for in the Commission Decision of 24 January 2024 establishing the European Artificial Intelligence Office (“Establishment Decision”).⁷⁸ Article 3(47) also sets out that the AI Act’s references to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. shall be construed as references to the Commission. The AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. is a directorate within the administrative framework of the Commission.⁷⁹ It is unusual for a Commission directorate to be given a role as the EU AI Act envisages. The usual course is that a power is assigned to the Commission and the Commission then assigns that task to an individual Commissioner, Director-General or Head of Service in accordance with the Commission’s Rules of Procedure.⁸⁰

45In light of this anomaly, the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. ’s status within the Commission and the entrusting of the implementation of supervision and enforcement of GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. ’ obligations to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. per Article 88(1), it is useful to look beyond Article 88(1).

46Although the clear aim of Article 88(1) AI Act is to permit tasks to be performed by the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. , Article 88(1) does not list the specific tasks themselves. As has been acknowledged by other authors, it is necessary to view it alongside the Establishment Decision for a more detailed list of the specific tasks to be performed by the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. .⁸¹

47Further detail in relation to the role of the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. in supervision and enforcement can be found in the Establishment Decision.⁸² It refers to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. :⁸³

1. investigating possible infringements of rules by GPAI models and systems including by, inter alia, assisting in the preparation of decisions of the Commission and conducting evaluations pursuant to the AI Act;⁸⁴ and
2. assisting the Commission in the preparation of relevant Commission Decisions.⁸⁵

48The text of Articles 89–93 AI Act also affords the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. certain tasks or functions. These include:

1. monitoring compliance of GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. with the AI Act;⁸⁶
2. conducting model evaluations;⁸⁷ and
3. structured dialogues with GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. .⁸⁸

49A useful illustrative example of the interplay between the Commission’s and the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. ’s powers and tasks in the supervision and enforcement of Chapter V AI Act obligations is provided by Article 91(3) AI Act. It provides that the Commission may issue a request for documentation or information to a GPAI provider Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. upon a duly substantiated request from the scientific panel in certain circumstances. Although Article 91(3) does not provide a role for the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. , and Article 15 of the Commission Implementing Regulation (EU) 2025/454 of 7 March 2025 laying down the rules for the application of Regulation (EU) 2024/1689 of the European Parliament and of the Council as regards the establishment of a scientific panel of independent experts in the field of artificial intelligence (“Scientific Panel Implementing Act”) confirms that a request is made by the scientific panel to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. for the Commission to request documents or information.⁸⁹ Article 16 of the Scientific Panel Implementing Act references the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. in the ‘[p]rocessing of the request for assistance’. Article 16(1) of the Scientific Panel Implementing Act provides that the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. shall assess whether issuing a request is, inter alia, ‘necessary and proportionate’, and Article 16(2) of the Scientific Panel Implementing Act provides that the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. may prepare a decision for the Commission to issue a request for documentation or information if it concludes that the scientific panel’s request is necessary and proportionate. As such, the importance of the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. ’s role lies in carrying out, that is, implementing, the tasks necessary for the Commission to discharge its function. However, the ultimate legal decision-making power remains with the Commission.⁹⁰

2.1.4. Article 88(1) AI Act: The express delegation of tasks to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. ?

50The second sentence of Article 88(1) provides that the ‘Commission shall entrust the implementation of these tasks to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. , without prejudice to the powers of organisation of the Commission and the division of competences between Member States and the Union based on the Treaties.’

51Entrusting tasks to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. by the Commission is consistent with the orthodox competences of the Commission under EU administrative law.⁹¹ The wording of Article 88(1) indicates that the ‘implementation’ of enforcement and supervision tasks will be carried out by the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. . That said, the second sentence of Article 88(1) makes the implementing role of the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. expressly subject to the caveat that it is ‘without prejudice’ to the powers of organisation of the Commission.⁹²

52It has been suggested that ‘shall entrust’ in Article 88(1) is comparable to a delegation found under the Rules of Procedure of the Commission⁹³ and that the legislature has delegated directly through the express language of Article 88.⁹⁴ It has also been suggested that Article 88(1) is a mandatory provision that requires the Commission to entrust certain tasks to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. .⁹⁵

53Moreover, a ‘direct’ delegation effected by Article 88(1) might, unless expressly or impliedly limited, deviate from the substantive and procedural features of an orthodox delegation of powers by the Commission pursuant to its Rules of Procedure. The Rules of Procedure do not provide for the delegation of powers to units within the Commission, but rather to the delegation (or sub-delegation) to Directors-General or Heads of Service. Accordingly, the Rules of Procedure allow the grant of a general empowerment by the Commission to one or more of its Members to adopt ‘management or administrative acts of a routine and recurring nature on [the Commission’s] behalf and under its responsibility’.⁹⁶ These Commission Members may then sub-delegate all or part of their delegated powers to Directors-General or Heads of Service, unless the original delegation decision prohibits them from doing so.⁹⁷ It is also possible for a delegation of powers to be made by the Commission to a Director-General or a Head of Service.⁹⁸ There is, however, an important caveat in both circumstances: despite the delegation, the Commission ‘retains the right to exercise itself the powers it has granted. It may also give instructions to the Member(s) of the Commission exercising the general empowerment’.⁹⁹ Therefore, if Article 88(1) does, contrary to the analysis above, bring about a ‘direct’ delegation from the Commission to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. , it could be argued that such a delegation would be much broader than that envisaged under the Commission’s Rules of Procedure, would seem to call into question the lawful extent of the delegation and would create tension with core principles of primary EU law. In response, it could be argued that the ‘without prejudice’ caveat found in Article 88(1) would limit any direct delegation; however, the scope of the delegation would remain unclear even if a maximum allowable upper limit was set. In other words, it may be clear under EU administrative law that a direct delegation under Article 88(1) cannot go further than a particular point, but precisely what the delegation entails would remain unclear.

54Another argument against direct delegation is that there are articles within the section on supervision and enforcement where the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. is afforded powers directly and, for that reason, it is clear that where the legislature did intend for powers to be afforded to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. directly it conferred them. For example, Article 92(1) AI Act does afford a power to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. directly – the ‘[p]ower to conduct evaluations’ – by stating that ‘[t]he AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. , after consulting the Board, may conduct evaluations’ of GPAI models in order to assess compliance and investigate systemic risk Article 3(65) AI Act: ‘systemic risk’ means a risk that is specific to the high-impact capabilities of general-purpose AI models, having a significant impact on the Union market due to their reach, or due to actual or reasonably foreseeable negative effects on public health, safety, public security, fundamental rights, or the society as a whole, that can be propagated at scale across the value chain. at EU level.

55The view that there is a delegation to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. finds some support in Recital 164, albeit that recital does not make the distinction between the Commission and the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. . Rather, it states that the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. ought to be able to ‘take necessary actions to monitor the effective implementation and compliance with the obligations for [GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. ]’ and ‘investigate possible infringements in accordance with the powers provided for in this Regulation, including by requesting documentation and information, by conducting evaluations, as well as by requesting measures from providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. of [GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. ]’. This may blur the distinction between the functions of the Commission and that of the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. . Whilst the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. is given the responsibility to carry out the necessary monitoring actions under Article 89(1), the powers to request documentation and information and the ability to request measures are powers of the Commission in the text of the AI Act itself. Perhaps surprisingly, Recital 164 does not refer to the Commission at all: it discusses monitoring of the effective implementation and compliance with the obligations for GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. with reference to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. only.

56On one reading, Recital 164 suggests that the legislature intended for the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. to carry out a wide range of monitoring, supervisory and enforcement actions and that although the language utilised is ‘should be able to’, it suggests the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. has that power. This lends credence to the interpretation that the legislature has directly entrusted certain tasks to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. . Such a reading of Recital 164, or the AI Act more broadly, elides the distinction made between the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. and the Commission in the text of the AI Act itself.¹⁰⁰ A significant difficulty with such an elision is that the Commission’s powers of organisation are premised on collegiate decision-making. It is a well-established principle of Union law that the Commission as a college of Commissioners is governed by the principle of collegiate responsibility. Collegiate responsibility finds its basis in the Treaties: Article 17(6)(b) TEU grants the President of the Commission the power to ‘decide on the internal organisation of the Commission, ensuring that it acts consistently, efficiently and as a collegiate body’.¹⁰¹ Furthermore, Article 250 TFEU requires that the Commission is to act by majority.¹⁰² The CJEU has explained the principle in case law, with the effect that the principle of collegiality is based on the equal participation of the Commissioners in the adoption of decisions.¹⁰³ For this reason, the delegation of powers by the Commission is subject to limitations. The most important limitation is that, while Union law permits the Commission to delegate certain administrative or management acts in order to provide a certain degree of flexibility in how the Commission operates, it does not permit the Commission to delegate decisions of principle.¹⁰⁴

57Another interpretation is that Recital 164 aligns well with the language in the AI Act insofar as by stating that the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. ‘should be able to’ do a particular thing suggests that there are further steps to be taken before the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. has this power. On this interpretation, Recital 164 does suggest that the legislature did intend for the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. to carry out a wide range of monitoring, supervisory and enforcement actions. This supports the interpretation that the Commission ought to entrust certain tasks to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. . Recital 164 supplements this interpretation of the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. ’s powers, but the ‘shall’ in Article 88 does the critical work, in an operative provision, of making clear the legislature’s intention to entrust powers to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. .

58It is important to caveat the interpretative value of recitals in either case. The primary function of recitals under EU law is to explain the objective pursued by a legislative act. Relatedly, a second well-known function of recitals is to assist with legal interpretation. The Court recently restated this in Kočner v EUROPOL, in which the Grand Chamber stated:

‘In that regard, the Court recalls that, whilst having no binding legal force, a recital of an EU act has important interpretative value, in that it is capable of explaining the content of a provision of the act in question and of clarifying the intention of the author of that act […].’¹⁰⁵

59The Court continued:

‘It is true that the recital of an EU act cannot be relied on as a ground for derogating from the actual provisions of the act in question or for interpreting those provisions in a manner that is clearly contrary to their wording […].’¹⁰⁶

60The interpretative function is not foreseen in the Treaties but has been developed in the Court’s case law. ¹⁰⁷The orthodox view is that the CJEU has held that recitals may be used to clarify the intentions of legislators where there is uncertainty regarding operative provisions.¹⁰⁸ Further, some authors point to the Joint Practical Guide for drafting EU legislation which discusses recitals. The Guide states that recitals should not be of norm-setting character, use mandatory language, or be capable of being confused with enacting terms.¹⁰⁹ This demonstrates that recitals are distinct from provisions in the legislation itself.

61Maarten den Heijer and his co-authors contend that the Court has on occasion treated recitals as though they are on a par with operative provisions of the legislative act itself.¹¹⁰ That paper notes that the AI Act contains recitals with details and rules that would purportedly exceed the purely interpretive function of recitals.¹¹¹ It is argued that this approach implicitly and uniquely shifts the function of recitals for the AI Act. This view is not substantiated further, and it would be a departure from the case law outlined above.

62Accordingly, a direct delegation of powers to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. that exceeds the administrative or management acts that the principle of collegiality permits, such as the power to take an enforcement decision against a GPAI model provider Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. , would offend primary EU law and pose difficulties in terms of the principle of legal certainty which EU law also honours. A teleological interpretation of this provision needs to take into account these considerations. On that basis, if it is accepted that not all tasks can be delegated to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. because of these core principles of EU law, which also seem to be reflected in the wording of Article 88(1) (‘without prejudice to the powers of the Commission’), it seems reasonable to conclude that any direct delegation from the Commission to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. pursuant to Article 88(1) must operate to respect such limitations.

63Fundamentally, it seems more likely, pursuant to a systemic and teleological interpretation, that Article 88(1) does not bring about a ‘direct’ delegation to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. . To the extent a task or power is not provided for in the AI Act or the Establishment Decision, it will be necessary for the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. to be given additional powers.¹¹² It is of note that the Commission must evaluate the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. ’s functioning by 2 August 2028 in order to evaluate whether the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. has been given ‘sufficient powers and competences to fulfil its tasks’ and ‘whether it would be relevant and needed for the proper implementation and enforcement of this Regulation to upgrade the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. and its enforcement competences and to increase its resources.’¹¹³ The Commission’s own Guidelines state that further detail will be provided on how supervision and enforcement powers will be implemented by way of an implementing act adopted under Article 92(6) and Article 101(6) AI Act.¹¹⁴

2.2. Article 88(2)

2.2.1. Purpose of Article 88(2)

64Article 88(2) provides that MSAs may, where necessary and proportionate for the fulfilment of their tasks under the Act, request that the Commission exercise its powers under Section 5 of Chapter IX AI Act. As noted above, the purpose of Article 88(2) is to avoid enforcement gaps in situations where Member States’ MSAs, in order to ensure the compliance of AI systems Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. with the AI Act, need the Commission to exercise its powers of supervision, monitoring and enforcement of the obligations owed by GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. . In effect, Article 88(2) is a component of a composite enforcement process (broadly understood), whereby an EU authority and a national authority coordinate their enforcement activities by exercising their respective competences, thereby making the process, among other things, more coherent.¹¹⁵ This is because Article 88(2) recognises the interaction between AI systems Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. and GPAI models such that, to understand whether an AI system Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. is compliant, it may be necessary to understand the GPAI model and how its provider Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. has complied with Chapter V obligations. Even in the context of centralised enforcement mechanisms in EU law, Article 88(2) seems to be unusual within the EU acquis. One point of comparison is Article 22 of the Council Regulation (EC) No 139/2004 of 20 January 2004 on the control of concentrations between undertakings (“EU Merger Control Regulation”). This permits Member States to request that the Commission examine acquisitions that lack an EU dimension but may affect trade and competition, although this mechanism makes the Commission the enforcement body, rather than providing assistance as in Article 88(2).¹¹⁶

65It has been suggested in some of the literature that Article 88(2) permits the delegation of the Commission’s powers to MSAs.¹¹⁷ However, this interpretation is not supported by the text of the AI Act, which states that MSAs are entitled to request that the Commission exercises its powers.¹¹⁸

66A more plausible reading appears to be that the Commission’s exclusive competence as regards the powers under Articles 89 AI Act  et seq. militate against the notion that Article 88(2) creates an enforceable right of national MSAs to take specific actions, but that the general principle of sincere cooperation means that the Commission must, in any case, consider a reasoned request from an MSA and decide within a reasonable period whether and to what extent it intends to comply with it.¹¹⁹ Nevertheless, although Article 88(2) is a discretionary power the criteria as to whether the Commission ought to facilitate the MSA’s tasks are provided for in Article 88(2): necessity and proportionality.

67Article 88(2) will be engaged where the MSA cannot properly assess or address the non-compliance of a high-risk AI system Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. without the Commission exercising its powers vis-à-vis the underlying GPAI model. In that sense, if the AI system Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. is compliant and the MSA’s tasks are not impeded, a request under Article 88(2) might be difficult to justify as ‘necessary and proportionate’. A broader reading could support the submission of requests to the Commission in situations where a non-compliant GPAI model poses systemic risks Article 3(65) AI Act: ‘systemic risk’ means a risk that is specific to the high-impact capabilities of general-purpose AI models, having a significant impact on the Union market due to their reach, or due to actual or reasonably foreseeable negative effects on public health, safety, public security, fundamental rights, or the society as a whole, that can be propagated at scale across the value chain. to future conformity of a high-risk AI system Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. , even if the specific system under current investigation meets the AI Act’s requirements.

68While the exact parameters of the making of a request by a Member State for the Commission to exercise its powers or functions are unclear, it would appear to follow that where there are preconditions on the exercise of those powers or functions by the Commission, then those preconditions would equally apply to the consideration of the request by a Member State. For instance, a precondition to Article 92 AI Act is that there has been consultation with the AI Board by the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. and that information gathered under Article 91 is insufficient.¹²⁰ There is nothing in the wording of Article 88(2) that would displace those preconditions.

2.2.2. Without prejudice to Article 75(3)

69Article 88(2) states that it is without prejudice to Article 75(3) AI Act. Article 75(3) reads as follows:

‘Where a market surveillance authority Article 3(26) AI Act: ‘market surveillance authority’ means the national authority carrying out the activities and taking the measures pursuant to Regulation (EU) 2019/1020. is unable to conclude its investigation of the high-risk AI system Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. because of its inability to access certain information related to the GPAI model despite having made all appropriate efforts to obtain that information, it may submit a reasoned request to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. , by which access to that information shall be enforced. In that case, the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. shall supply to the applicant authority without delay, and in any event within 30 days, any information that the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. considers to be relevant in order to establish whether a high-risk AI system Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. is non-compliant. Market surveillance authorities Article 3(26) AI Act: ‘market surveillance authority’ means the national authority carrying out the activities and taking the measures pursuant to Regulation (EU) 2019/1020. shall safeguard the confidentiality of the information that they obtain in accordance with Article 78 of this Regulation. The procedure provided for in Chapter VI of Regulation (EU) 2019/1020 shall apply mutatis mutandis’.

70The interaction between Articles 88(2) and 75(3) arises because one of the Commission’s powers that the MSA can request under Article 88(2) is to request documentation under Article 91. Article 91 relates to the provision of documentation and information, and overlaps with the information that can be accessed under Article 75(3). Under the latter provision, the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. shall supply that information to the applicant authority ‘without delay, and in any event within 30 days’. One interpretation is that Article 75(3) relates only to information that the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. already possesses. Indeed, the requirement that the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. must supply the information ‘without delay’, and within the strict maximum timeline of 30 days, supports the view that this is information to which the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. already has access, as it offers little time for the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. to make a successful request of the GPAI model provider Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. under Article 91. On this interpretation, where the information is not in the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. ’s possession, the MSA ought to seek the information under Article 88(2) AI Act, requesting that the Commission exercise its powers under Article 91.

71There is little merit in an argument that the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. (the body named in Article 75(3)) does not have powers to obtain information under Article 91 because the power to obtain information and documentation under that section is a power of the Commission. That is because Article 3(47) makes it clear that references to the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. can be read as references to the Commission, as discussed above. Rather, the primary difficulty with an interpretation of Article 75(3) that requires an exercise of Article 91 in response to a request made by an MSA is, as noted above, the strict and relatively tight 30-day timeline within which responsive information is to be provided to the MSA by the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. , particularly if the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. engages in a structured dialogue in advance of using its powers under Article 91.

2.2.3. Necessary and proportionate

72Article 88(2) conditions the ability of MSAs on such a request being ‘necessary and proportionate to assist with the fulfilment of their tasks’ under the AI Act. It is difficult, in the abstract, to imagine the precise circumstances in which Article 88(2) will be engaged, but consideration of the scope of MSAs’ functions is useful in delineating its likely application. It appears that Article 88(2) will be of most use where Article 75(1) AI Act does not apply and the MSA identifies that a potentially non-compliant AI system Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. is based on a non-compliant GPAI model over which it does not have jurisdiction to conduct an investigation.¹²¹ The requirement of necessity and proportionality seems likely to impose a limit on the circumstances in which the MSA can make a request and on the scope of the request made.

73As for necessity, there is a comparable requirement for necessity in competition law from which some guidance can be gained as to how necessity in Article 88(2) will be understood and applied. For instance, the Commission’s decision to request information under Article 18(3) of Regulation 1/2003 must be limited to information that can reasonably be regarded as necessary for the Commission’s investigation. In that context, necessity is given a wide meaning, and in Qualcomm Inc v European Commission, the CJEU considered that, on judicial review, necessity is to be judged in relation to the purpose stated in the request for information by the Commission. The Court went on to state that:

‘The requirement that a correlation must exist between the request for information and the suspected infringement is satisfied if the Commission could reasonably suppose, at the time of the request, that the information may help it to determine whether the infringement has taken place.’¹²²

74It is clear, therefore, that necessity is determined in relation to the suspected infringement which the Commission intends to investigate.

75One specific point arises on necessity under Article 88(2) where the power under Article 91 is sought to be utilised. Article 88(2) is expressed to be ‘without prejudice’ to Article 75(3) and, insofar as an MSA can avail itself of Article 75(3), a question arises as to whether it must do so instead of invoking Article 88(2) when it is available. Put another way, it may be possible for a GPAI model provider Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. to argue that an MSA ought to have first sought to use Article 75(3) before Article 88(2) is invoked to request that Article 91 be used. The GPAI model provider Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. could argue that invoking Article 88(2) is not ‘necessary and proportionate’ in circumstances where an argument can be made that Article 75(3) would have sufficed. On one view, this might mean that if Article 91 is relied upon by the Commission following a request under Article 88(2) in circumstances where Article 75(3) has not been used, a GPAI model provider Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. may be entitled to seek judicial review of any decision of the Commission to utilise Article 91 on this basis. Such a challenge to a decision under Article 91 would be predicated on the basis that the information or documentation would be available via Article 75(3). Other authors have not addressed this issue. It seems that, in circumstances where a reason can be given as to why it is appropriate to use Article 91 rather than Article 75(3), a judicial review on this basis would not be successful. However, if no such reason is given, the attempt to utilise Article 91 (following an Article 88(2) request) would not be ‘necessary and proportionate’.

76It is well established that, when assessing the question of necessity, reasons are important. In HeidelbergCement AG v European Commission, the Court explained the importance of reasons in the context of determining what is necessary:

‘As correctly noted by the General Court in paragraph 34 of the decision at issue, “the Commission is entitled to require the disclosure only of information which may enable it to investigate presumed infringements which justify the conduct of the investigation and are set out in the request for information”.

Since the necessity of the information must be judged in relation to the purpose stated in the request for information, that purpose must be indicated with sufficient precision, otherwise it will be impossible to determine whether the information is necessary and the Court will be prevented from exercising judicial review (see, to that effect, judgment in SEP v Commission, C‑36/92 P, EU:C:1994:205, paragraph 21).’¹²³

77Turning to proportionality, this is a general principle of EU law that arises in different contexts, and it requires that the means for attaining a legitimate objective must not go beyond what is appropriate and necessary to achieve that objective and that recourse must be had to the least onerous where there are several appropriate measures and that disadvantages caused must not be disproportionate to the aims pursued.¹²⁴ Essentially, proportionality is concerned with balancing conflicting interests.¹²⁵ Disproportionate interference with a legitimate interest or right renders the action unlawful.

78An affected party can invoke proportionality in judicial review proceedings in, among others, the following circumstances: if an administrative sanction is imposed that is excessive,¹²⁶ if an EU measure or action adversely and excessively affects a CFREU right, or if an interest is impacted by EU legislation in a way which offends the principle of proportionality enshrined in Article 5(4) TEU.¹²⁷

79In the context of Article 88(2) AI Act, proportionality will require that the use of the supervision and enforcement powers of the Commission is appropriate for attaining the legitimate objectives pursued by the AI Act and that the use of that power does not go beyond what is necessary in order to achieve that legitimate objective. The identification of the legitimate objective is crucial to carrying out the proportionality assessment. As appears from the above analysis, necessity and proportionality are reasons-based standards and either the Commission or the MSA will need to provide those reasons. As the exercise of the power is requested by the MSA under Article 88(2), it would appear logical that the MSA demonstrates, at least to the Commission as part of the relevant request, that it has met the conditions required. A demonstration of necessity requires the MSA to, at a minimum, (a) identify the task that cannot be fulfilled effectively without resort to Article 88(2), (b) explain why existing powers are insufficient, and (c) link the MSA’s difficulty to the Commission’s power sought. A proportionality assessment requires the MSA to articulate why the requested action is no more than what is required to achieve the object and that the measure is appropriate for attaining the legitimate objectives pursued by the action the MSA seeks to take.

3. Enforcement powers of other EU regulatory bodies and their interaction

80While Article 88(1) is the provision of the AI Act that declares the Commission as the body with exclusive powers for enforcing obligations of GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. , GPAI model providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. also have obligations under other EU legislation. It is beyond the scope of this chapter to examine the wider EU regulatory landscape in detail, but it is worth highlighting briefly a selection of obvious interactions between the AI Act and other pieces of EU legislation to illustrate the multilayered complexity of the governance ecosystem, given that each regulation or directive establishes separate regulatory entities and institutions.

81It has been argued that the governance arrangements under the AI Act itself are complex.¹²⁸ In addition, it is obvious that the AI Act sits within a broader EU regulatory landscape that encompasses numerous regulations, directives and legal regimes. However, to the extent that there is overlap between these regimes, it is notable that the AI Act does not provide any coordination mechanism between the bodies entrusted with enforcing those instruments and the bodies responsible for enforcing the AI Act.¹²⁹ For example, data protection is an area of particular regulatory importance given how reliant AI is on data for training and post-training purposes. The GDPR, the Data Governance Act (DGA), the DSA, the DMA, and the Data Act (DA) are all relevant in this regard.¹³⁰

82While there are mechanisms within the AI Act to prevent overlap between the Commission and national authorities when exercising their respective powers under the AI Act, such as the demarcation of those enforcement responsibilities that are centralised pursuant to Article 88(1), these provisions do not address conflicts or overlaps between different regulatory areas. Under Recital 118 AI Act, it is stated that where there is regulatory overlap in relation to the regulation of AI systems Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. and AI models embedded into designated very large online platforms or very large online search engines, those systems and models are subject to the risk-management framework under the DSA. The Recital states that the corresponding obligations under the AI Act ‘should be presumed to be fulfilled, unless significant systemic risks Article 3(65) AI Act: ‘systemic risk’ means a risk that is specific to the high-impact capabilities of general-purpose AI models, having a significant impact on the Union market due to their reach, or due to actual or reasonably foreseeable negative effects on public health, safety, public security, fundamental rights, or the society as a whole, that can be propagated at scale across the value chain. not covered by Regulation (EU) 2022/2065 emerge and are identified in such models’.¹³¹ The Commission’s webpage introducing the Digital Omnibus Package points to the 2024 Draghi Report which critiques the EU’s competitiveness deficit in part by reference to administrative burdens and regulatory inconsistencies regarding the body of EU legislation governing emerging digital technologies, cybersecurity, online platforms and electronic communications.¹³² Consideration of the interplay between the various different regulatory regimes may raise further questions about the complexity arising from the regulatory overlap and, as some have argued, the increased regulatory burden.¹³³

83In addition to the complexity added by regulatory overlap, it is also unclear whether different regulatory regimes that overlap ought to have regard to each other. To provide one example of this, in implementing Article 55 AI Act, the Safety and Security Chapter of the GPAI Code of Practice, adopted under Article 56 AI Act, includes measures addressed to providers Article 3(3) AI Act: ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. of GPAI models with systemic risk Article 3(65) AI Act: ‘systemic risk’ means a risk that is specific to the high-impact capabilities of general-purpose AI models, having a significant impact on the Union market due to their reach, or due to actual or reasonably foreseeable negative effects on public health, safety, public security, fundamental rights, or the society as a whole, that can be propagated at scale across the value chain. for identifying risks Article 3(2) AI Act: ‘risk’ means the combination of the probability of an occurrence of harm and the severity of that harm. relating to privacy and protection of personal data Article 3(50) AI Act: ‘personal data’ means personal data as defined in Article 4, point (1), of Regulation (EU) 2016/679. .¹³⁴ It is unclear whether, in assessing adherence to those Code of Practice measures concerning personal data Article 3(50) AI Act: ‘personal data’ means personal data as defined in Article 4, point (1), of Regulation (EU) 2016/679. risks Article 3(2) AI Act: ‘risk’ means the combination of the probability of an occurrence of harm and the severity of that harm. , the Commission ought to have regard to the decisions of the national lead data protection authority in the Member States made under the General Data Protection Regulation.

84In this regard, it is of note that the CJEU has outlined a coordination framework between data protection and competition authorities in a recent judgment.¹³⁵ Although this arose in the context of powers under different EU regulations, in Meta Platforms v Bundeskartellamt, the CJEU determined that the duty of sincere cooperation binds the various national authorities involved and, under that principle, Member States, including their administrative authorities, must, inter alia, assist each other.¹³⁶ The Court further held that a national competition authority may, in examining an abuse of a dominant position by an undertaking within the meaning of Article 102 TFEU, find that the undertaking’s terms of use relating to the processing of personal data Article 3(50) AI Act: ‘personal data’ means personal data as defined in Article 4, point (1), of Regulation (EU) 2016/679. are not consistent with the GDPR, provided that that finding is necessary to establish the existence of such an abuse. However, the national competition authority cannot depart from a decision by a competent lead supervisory authority concerning those general terms or similar terms.¹³⁷ It has been noted that such an approach may not suffice where a function overlaps with multiple authorities.¹³⁸ For now, the Meta Platforms judgment leaves open questions as to the extent to which a national authority is bound by the decisions of other national authorities and the extent to which the duty of sincere cooperation applies. It also raises questions about the ability of one national supervisory authority, in separate proceedings, to make findings that produce broad effects whose consequences may (even unforeseeably) impact the Commission’s supervision and enforcement of the AI Act. Nevertheless, in the absence of a specific mechanism in the AI Act, the judgment provides a relevant guiding principle about the relationship between potentially competing regulatory authorities. Whether it is the optimal mechanism is beyond the scope of this commentary.

85It appears that the Commission recognises that there may be undesirable regulatory overlap between the AI Act and other EU legislation as, in November 2025, the Commission proposed the Digital Omnibus on AI Regulation.¹³⁹ This proposes ‘targeted simplification measures to ensure timely, smooth, and proportionate implementation of certain of the AI Act’s provisions’. One such proposal concerns ‘Guidelines on the AI Act’s interplay with other Union legislation, for example joint guidelines of the Commission and European Data Protection Board on the interplay of the AI Act and EU data protection law, guidelines on the interplay between the AI Act and the Cyber Resilience Act, and guidelines on the interplay between the AI Act and the Machinery Regulation’.¹⁴⁰ In this regard, it is of note that the Digital Omnibus proposes to amend Article 75(1). That amendment would mean that the AI Office Article 3(47) AI Act: ‘AI Office’ means the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the Commission. will also be responsible for the supervision, investigation, enforcement and monitoring of the obligations under the AI Act relating to AI systems Article 3(1) AI Act: ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. that are integrated within very large online platforms and search engines within the meaning of the DSA.¹⁴¹