The Commission's enforcement powers over GPAI providers: information requests, evaluations and fines
Chapter IX Section 5 of Regulation (EU) 2024/1689, Art. 88 to 94, gives the Commission, acting through the AI Office, exclusive supervision of the general-purpose AI model duties in Chapter V: requests for documentation under Art. 91, evaluations with model access under Art. 92 and requested measures under Art. 93. Art. 101 adds fines. Art. 101 applies from the general application date In force; the Art. 53 to 55 duties applied earlier In force. This post reads each power from the consolidated text and names the record that answers it.
What the source says
Art. 88(1) gives the Commission "exclusive powers to supervise and enforce Chapter V" and entrusts the tasks to the AI Office. Art. 94 extends Art. 18 of Regulation (EU) 2019/1020 to providers of general-purpose AI models, so the provider holds the procedural rights of an economic operator under market surveillance law. Art. 88(2) lets a national market surveillance authority ask the Commission to use these powers. The regulation entry records what Regulation (EU) 2026/1744 changed: "none to the date. The Omnibus gave the AI Office exclusive competence over general-purpose AI systems under Art. 75 and added supervisory powers in Art. 75a to 75d." Art. 75(1)(a) covers AI systems based on a general-purpose AI model from the same provider, so such a provider faces two tracks: Chapter V for the model, and Art. 75a to 75c for the system, where Art. 75c(4) applies the Art. 99(3) to 99(7) penalty rules mutatis mutandis.
Art. 91(1) lets the Commission request the documentation drawn up under Art. 53 and Art. 55, or any additional information needed to assess the provider's duties, after an optional structured dialogue under Art. 91(2). Art. 91(4) fixes the content of the request: the legal basis, the purpose, the information required, the period for the reply and the Art. 101 fines for incorrect, incomplete or misleading information. Art. 91(5) places the reply on the provider or its representative; where lawyers supply the information, the provider "shall nevertheless remain fully responsible if the information supplied is incomplete, incorrect or misleading".
Art. 92(1) lets the AI Office, after consulting the Board, evaluate the model where the Art. 91 information is insufficient, or investigate systemic risks at Union level, in particular after a qualified alert from the scientific panel under Art. 90(1)(a). Art. 92(3) extends the request to access "through APIs or further appropriate technical means and tools, including source code", and Art. 92(7) opens a structured dialogue on "the internal testing of the model, internal safeguards for preventing systemic risks, and other internal procedures and measures". Art. 93(1) then lets the Commission request measures: steps to meet Art. 53 and Art. 54, mitigations where the evaluation gives rise to serious and substantiated concern of a systemic risk, or restriction, withdrawal or recall of the model. Under Art. 93(3) a commitment offered in the dialogue can be made binding by decision.
| Power | Article | Trigger | Record the provider supplies |
|---|---|---|---|
| Request for documentation and information | Art. 91 | Assessment of Chapter V duties | Annex XI technical documentation, Annex XII downstream information, Art. 55 records |
| Evaluation of the model | Art. 92 | Art. 91 information insufficient, or a qualified alert on systemic risk | API or other technical access, source code where requested, internal testing and safeguard records |
| Request for measures | Art. 93 | Findings from an Art. 91 request or an Art. 92 evaluation | Measures to meet Art. 53 and 54, mitigations, or a binding commitment under Art. 93(3) |
| Fines | Art. 101 | Infringement, non-compliance with Art. 91, 92 or 93, or incorrect information | Reply to the preliminary findings under Art. 101(2) |
Art. 99(3) to 99(5) do not list Chapter V, and Art. 88(1) reserves its enforcement to the Commission; Art. 101(1) caps the Commission's fine at 3 % of annual total worldwide turnover in the preceding financial year or 15 000 000 euro, whichever is higher, and the action that follows for the provider is the reply to the preliminary findings under Art. 101(2) and, where the fine stands, review by the Court of Justice under Art. 101(5). Art. 101(1) also requires the Commission to take account of commitments under Art. 93(3) or under a code of practice under Art. 56.
What changes for a provider or deployer
An Art. 91 request asks for documents the provider already owes under Art. 53(1). The Art. 53 obligation record lists the testable elements that decide whether the reply is complete: every Annex XI and Annex XII point traceable to a record, the architecture, parameter count and licence stated identically across the documentation and the public model card, and each evaluation result carrying the protocol name, dataset version and model version. PR-11-DOC v1.0 tests those elements and produces the Annex XI and XII completeness and consistency report. Art. 91(5) makes completeness and accuracy the provider's responsibility, so the reply rests on an evidence pack whose index names each item, its version, its source protocol and the gaps that remain.
An Art. 92 evaluation starts where the Art. 91 material is insufficient. For a model with systemic risk the records are those Art. 55(1) already requires: the model evaluation report per systemic risk and the adversarial testing campaign record, both PR-15-ROB v1.0 outputs, and the Safety and Security Model Report in the form of the published GPAI Code of PracticePublished, Safety and Security chapter. The Art. 55 record names the gap an evaluation exposes: adversarial testing recorded as a narrative summary without the attack set, the success criterion or the per-attack outcome. The model evaluation scenario gives the sequence that produces a record with those three fields.
AIAssuranceLabs runs PR-11-DOC v1.0 and PR-15-ROB v1.0 under the GPAI evaluation support service, within the limits on what we cannot do: the reply under Art. 91(5) is the provider's, and we do not represent a provider before the Commission or give an opinion on whether a model carries systemic risk under Art. 51. The Code of Practice evidence guide maps each chapter of the Code to the Art. 53 and Art. 55 records an Art. 91 request names.
What to do now
- Record whether Chapter V applies to the model and whether Art. 75(1)(a) applies to a system built on it, so that both tracks are known before a request arrives.
- Map the technical documentation to every Annex XI and Annex XII point and run a completeness and consistency check against the Art. 53 record (Art. 53(1)(a) and (b)).
- Make each evaluation result cited under Art. 53(1)(a) resolve to a stored record with protocol name, dataset version and model version (Art. 53(1)(a); Annex XI Section 2 point 1 for a model with systemic risk).
- For a model with systemic risk, keep the adversarial testing campaign record with its attack set, success criterion and per-attack outcome next to the Safety and Security Model Report (Art. 55(1)(a)).
- Name the person authorised under Art. 91(5) to reply, and add a verification step that maps each statement in the reply to the document and version behind it (Art. 91(4), Art. 101(1)).
- Where the AI Office opens a structured dialogue under Art. 91(2) or Art. 92(7), record what was shown and which commitment, if any, was offered under Art. 93(3).
Related pages
The pages below carry the Art. 53 and Art. 55 records, the two protocols, the guide, the service and the hub for general-purpose AI model providers.
- Protocols
- Services
- ICP hubs
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.