On October 12, 2026, the European Commission published for feedback a draft Commission Implementing Regulation “on practical and specific arrangements for the conduct of certain proceedings by the Commission pursuant to Article 75c and Article 75d” of the AI Act (Ref. Ares(2026)9589403). The Have Your Say portal opened feedback on October 12 and closes it on November 9, 2026, with adoption foreseen in the fourth quarter of 2026.
The draft applies to the AI systems over which Article 75(1) of the AI Act gives the Commission exclusive competence: AI systems built on a general-purpose AI model where the model and the system come from the same provider or undertaking, and AI systems that constitute or are integrated into very large online platforms or search engines designated under the Digital Services Act. It sets out three things. First, access to the file: on request, an operator gets access to the Commission’s file, with sensitive material opened only to specified external legal and economic counsel and external technical experts under negotiated disclosure terms. Second, how business secrets and other confidential information are claimed, redacted and protected. Third, limitation periods.
The limitation rules are the sharpest part. For continuing or repeated non-compliance, the five-year limitation period for imposing fines starts only when the non-compliance ceases. Any investigative step - a request for information, a request for access to conduct system evaluations, an inspection, an invitation to a structured dialogue, or the opening or re-opening of proceedings - interrupts the period and starts it afresh, up to a hard stop at twice the limitation period, extended by suspensions such as pending Court of Justice proceedings. A separate five-year period governs enforcement of fines once a decision is final.
Why it matters: Articles 75a to 75d, added to the AI Act by the 2026 digital omnibus, gave the Commission’s AI Office direct enforcement powers over AI systems built by general-purpose model providers. This draft is the procedural plumbing for using them: it decides how much of the case file a company like a frontier lab can see, and how long the Commission has to fine it. Rules that let each information request reset the clock favour the regulator in long investigations.
What it does not show: this is a draft by the Commission services; the document itself says it has not been adopted or endorsed by the Commission and may change after feedback. It does not impose any penalty, open any proceeding, or name any company.