General-purpose AI model duties are supervised principally by the Commission, acting through the AI Office, which can request information and documentation, carry out evaluations, and take enforcement steps set out in the Act where a provider does not meet its duties. Downstream providers and other parties have routes to raise concerns, and the Scientific Panel can provide independent scientific advice. National market surveillance authorities remain central to system-level enforcement, so a product chain can involve more than one supervisor.
What is the AI Office?
The AI Office is a function within the European Commission, established to support the implementation and enforcement of the AI Act, including for general-purpose AI models. It is not a separate legal person and it is not a national regulator. Its work includes developing guidance, facilitating codes of practice, monitoring systemic risks, and exercising the supervision and enforcement powers the Act gives the Commission for the model layer. Understanding that the AI Office acts as part of the Commission matters for correspondence: requests, notifications and submissions should be addressed and filed as Commission matters, with the AI Office as the operational contact. Teams should record the addressee, the date, and the reference for every exchange, so that the file shows a single coherent correspondence history.
What information and evaluation powers exist?
The Act gives the Commission powers to request information and documentation from general-purpose AI model providers, to carry out evaluations of models, and to require access where needed for those evaluations, subject to the conditions and safeguards in the Act. Evaluations can involve independent experts and can test the model against the duties in Articles 53 and 55. A provider should be ready to produce its controlled documentation set, its evaluation evidence, and its classification file at short notice, and should know who can authorise disclosure and who can answer technical questions. A request should be logged on receipt, assigned an owner, and answered from the controlled file rather than from ad hoc material. Where a request raises confidentiality or trade secret concerns, the provider should raise the issue through the procedure provided, rather than withholding material without explanation.
For the broader regulatory framework, see General-purpose AI models overview.
How can downstream providers raise concerns?
Downstream providers who integrate a general-purpose AI model have a route to complain to the AI Office where they consider that a model provider has infringed the Act, for example by failing to provide required information. That route matters because downstream providers often discover a problem first, in integration or in deployment, but cannot fix a model-level gap themselves. A downstream provider considering a complaint should first record the gap, the request made to the model provider, and the response received, so that the complaint is evidence-based. The complaint route is not a substitute for the downstream provider's own system duties: a downstream provider must still assess its own system and take the controls within its power, even while a model-level concern is being raised.
What corrective and penalty steps can follow?
Where a provider does not meet its Chapter V duties, the Commission can take steps including requiring corrective action, accepting commitments, and, where the Act provides, restricting or withdrawing a model from the market or imposing penalties. The specific step depends on the duty breached, the risk involved, and the procedure followed. This guide does not state penalty figures, because the applicable provision and the provider's circumstances determine the outcome and the consolidated text should be checked for the current position. The practical lesson for providers is to treat an information request or an evaluation finding as an early opportunity to correct the file, rather than as a dispute to be won. A prompt, documented correction with a timetable is more useful to a supervisor than a delayed response that contests the premise without addressing the evidence.
How does model enforcement relate to system enforcement?
System-level enforcement is carried out principally by national market surveillance authorities, while model-level supervision sits principally with the Commission through the AI Office. A single product can therefore be subject to both, for different questions. A market surveillance authority examining a high-risk system may ask about the underlying model, and the AI Office examining a model may need information about downstream deployment. Providers should keep model and system files distinct but linked, so that each supervisor receives the file relevant to its question without delay. Correspondence should be filed by supervisor and by duty, with cross-references where a question spans both layers. Mixing the two files into one undifferentiated bundle makes it harder for either supervisor to follow the reasoning.
Continue with Article 55 duties for systemic-risk models.
What does this guide not decide?
This guide does not decide whether a provider has breached a Chapter V duty, whether an evaluation finding is correct, whether a complaint should be made, or what enforcement step would follow in a particular case. It does not assess a Commission request, a model evaluation, or a penalty exposure. Those matters depend on the provider's evidence, the procedure followed, and the consolidated legal text as applied by the Commission. A provider facing a request, an evaluation or a complaint should seek qualified advice promptly, preserve the relevant records, and respond from its controlled file within the timetable set.
Frequently asked questions
Who supervises a general-purpose AI model provider?
Principally the Commission, acting through the AI Office, for the Chapter V model duties. National market surveillance authorities remain central to system-level enforcement. A product chain can therefore involve both, for different questions, and the files for each layer should be kept distinct but linked.
Can a downstream provider complain about a model provider?
Yes, in outline. The Act provides a route for downstream providers to complain to the AI Office where a model provider is considered to have infringed the Act. The complaint should be evidence-based, recording the gap, the request made, and the response received, and it does not replace the downstream provider's own system duties.
What should a provider do on receiving an information request?
Log the request, assign an owner, answer from the controlled documentation and evaluation file, and meet the timetable set. Raise any confidentiality or scope concern through the procedure provided, rather than withholding material without explanation, and keep a copy of the request and the response together.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗Commission AI Act Service Desk timeline ↗European Commission AI Act overview ↗