The European Commission has published documentation for three separate routes into its AI Office for reporting suspected breaches of the EU AI Act. The newest of them, a complaints channel reserved for companies that build products on somebody else's general-purpose AI model, carries a publication date of 31 July 2026 and a last update of 7 August 2026. Two of the three require complainants to give their names. Case files are held for 10 years after closure.

The three channels sit on different legal footings and answer to different thresholds, and the distinctions matter more than the shared branding suggests. One handles complaints about AI systems under the exclusive competence of the AI Office. One handles complaints by downstream providers against the providers of the general-purpose models underneath their products. One accepts anonymous reports from people professionally connected to those providers.

Pessi Honkasalo, Tech, Data and IP Partner at Finnish law firm Krogerus, summarised the set in a LinkedIn post that drew 131 reactions, 11 comments and 21 reposts. According to Honkasalo, "The European Commission has launched three new AI Act enforcement channels". His post described a general complaints tool for individuals and organisations, a separate channel for downstream providers, and a secure anonymous whistleblower tool for eligible professionals.

The downstream channel puts model providers on the receiving end

The complaints channel for downstream providers rests on Article 89(2) of the AI Act. According to the Commission page, a downstream provider of an AI system built on a general-purpose AI model may lodge a complaint with the European Commission where it considers that the model provider has infringed Articles 53 to 55 of the Act.

Those three articles carry the substance of what a model provider owes the market. According to the Commission, the obligations at stake concern technical documentation, the provision of certain information to downstream providers, copyright policy, publication of a summary of the data used to train the model, reporting of serious incidents together with an adequate level of cybersecurity, and, for providers of the most advanced models with systemic risks, the duty to conduct evaluations and to assess and mitigate systemic risks.

The channel is narrow by design. According to the page, it is limited only to infringements of the rules for general-purpose models by the providers that placed those models on the EU market. Anything concerning AI systems within the AI Office's exclusive competence goes to the other tool.

Submission is by email rather than through a web form. According to the Commission, the complaint form must be filled in and signed, then sent to EU-AIOFFICE-DOWNSTREAM-PROVIDER-COMPLAINTS@ec.europa.eu. The complaint must explain why the complainant qualifies as a downstream provider, must be duly reasoned, and must include sufficient information to allow the Commission to assess the alleged infringement. Supporting documents or other evidence are encouraged. Complaints may be filed in any official EU language.

Two downloads accompany the page: a template for complaints under Article 89(2), and a privacy statement covering the same processing operation.

After submission, a reference number is generated. According to the Commission, all complaints will be dealt with in a confidential manner, and the AI Office will inform complainants where a complaint falls outside its remit or is ineligible.

The general tool draws a perimeter around platform AI

The AI Act Complaints Tool operates on a different basis. According to the tool itself, the European AI Office uses it in accordance with Article 85 of the AI Act to handle complaints in relation to AI systems falling within the Office's exclusive competence.

That competence is set by Article 75(1), and the tool page reproduces its two limbs. The first covers AI systems built on a general-purpose AI model where the system and the model are developed by the same provider, or by providers within the same undertaking. The page notes that this does not include AI systems covered by Annex I, Annex III point 2, or Annex III point 8. The second limb covers AI systems integrated in, or constituting, very large online search engines or very large online platforms within the meaning of the Digital Services Act.

That second limb is where the advertising industry enters the picture. The consolidated AI Act text that took effect on 27 July 2026 hands the AI Office exclusive supervision over AI systems inside designated platforms, a set that includes Facebook, Instagram, YouTube, Google Play, Google Maps, Google Shopping, Amazon Store, LinkedIn, TikTok, Google Search and Bing. The designation regime behind that list was upheld by the General Court in the Zalando case on 3 September 2025.

The tool page also sets out what the form is not for. According to the Commission, it must not be used for infringements outside the scope of the AI Act, for infringements of other EU laws, for infringements of national laws, for infringements of Articles 53 to 55, or for matters falling under Article 89(2). Complaints relating to other AI systems are dealt with by national competent authorities through mechanisms established at national level.

Submissions must indicate the country in which the incident occurred and provide a detailed description of the alleged infringement. According to the Commission, the AI Office may refer a complaint to the relevant national market surveillance authority, or to an authority responsible for supervision or enforcement of EU law obligations related to fundamental rights, with the complainant's prior consent and where appropriate.

The front end is not built in house. The tool's footer carries a copyright notice reading EQS Group GmbH 2011 to 2026, and its navigation offers a Secure Inbox alongside the home and privacy statement pages.

Anonymity exists, but only on one route

Both complaint channels are explicit on identification. According to the Commission, the general tool is not an anonymous reporting channel, and complainants are required to provide identification and contact details so that standing can be assessed. The downstream page repeats the point in the same terms.

The AI Act Whistleblower Tool is the exception. According to the Commission, it allows individuals who are professionally connected to providers of general-purpose AI models, or of AI systems falling within the AI Office's enforcement remit, to report harmful practices or other violations anonymously, in any EU language, with supporting documents, through a secure inbox. That inbox lets whistleblowers track progress and answer follow-up questions while remaining anonymous.

Alongside the tool, according to the Commission, the AI Office commits to a high standard of confidentiality and has documented internal procedures intended to maximise the protection of whistleblower identities. The whistleblower page carries a last update of 31 July 2026, as does the general complaints tool page.

What Brussels collects, and how long it keeps it

The privacy statement attached to the downstream channel is the most technically detailed of the documents. It is registered as processing operation DPR-EC-34748, with the European Commission's Directorate-General for Communications Networks, Content and Technology, AI Office, Units A.2 and A.3 named as data controller.

The legal basis section is notable for what it cites. Alongside Regulation (EU) 2024/1689, the statement names Regulation (EU) 2026/1744 of 8 July 2026, the amending act known as the Digital Omnibus on AI, together with corresponding implementing and delegated acts. The main provision is given as Article 89(2). The intake, in other words, was documented against the amended text rather than the original.

According to the privacy statement, the categories of personal data processed include identification data relating to the complainant and to the person submitting the complaint, including full name; contact details including email and postal address; information concerning the status or capacity of the person submitting; and personal data contained in supporting information and evidence, including documents, correspondence, screenshots, images or other records.

Fields marked mandatory in the complaint form are necessary for registration and assessment. According to the statement, failure to provide that information will prevent the Commission from processing the complaint. Complainants are asked not to supply personal data on third parties who are natural persons unless strictly necessary for assessment or investigation.

Retention runs long. According to the statement, personal data is kept for an administrative period of 10 years after the closure of the file, after which files transfer to the Historical Archives of the European Commission under a separate processing record, DPR-EC-00837.

The recipient list is broad. Access within the Commission extends beyond the AI Office to case handlers in other units of the directorate-general and other directorates-general participating in an investigation, plus their hierarchy and services consulted between departments. Files may reach other EU institutions, including in the context of complaints to the European Ombudsman or the European Data Protection Supervisor, and certain data may be transmitted to European bodies, their national members, or expert groups such as the EU AI Board. National competent authorities, including market surveillance authorities, receive information where necessary for coordination and enforcement.

Two further categories are worth noting for anyone weighing whether to file. Parties concerned by a complaint, and their representatives, obtain access to the file in the exercise of the rights of defence, and documents obtained that way may contain personal data. The Commission may also transmit personal data to external experts and auditors assisting with monitoring, bound by the conditions in Article 29 of Regulation (EU) 2018/1725.

One reassurance is stated plainly. According to the privacy statement, personal data will not be used for automated decision-making including profiling.

Where the documents do not quite line up

Several points in the published material sit awkwardly against each other, and none is resolved on the pages themselves.

The general tool page describes the exclusions from the first limb of Article 75(1) as Annex I, Annex III point 2, and Annex III point 8. The consolidated regulation, as reported in early August, keeps a wider set of carve-outs with national authorities, covering Annex I products, critical infrastructure under Annex III point 2, systems provided by law enforcement, border authorities and financial institutions, and systems used in the administration of justice. The tool page presents a shorter list than the operative text.

Referral is described two ways. The tool page conditions referral to a national authority on the complainant's prior consent. The privacy statement, covering the downstream channel, describes transmission to a relevant authority where legally permissible and in accordance with the information provided to the complainant. Consent and legal permissibility are not the same standard.

The pages also do not state when each tool went live. Two carry a last update of 31 July 2026; the downstream page carries a publication date of 31 July 2026 and a last update of 7 August 2026. Last update is not the same as launch, and the Commission does not supply the latter.

Why this matters for the marketing community

The most consequential of the three, for adtech vendors specifically, is the one with the plainest email address.

An advertising technology company that builds a creative generation product, a copy assistant or a campaign planning agent on top of a third-party foundation model is a downstream provider in the language of the AI Act. Articles 53 to 55 are the articles that govern what that company is owed: the technical documentation, the information the model provider must pass down, the copyright policy, and the public summary of training data. Those are the same items that appear in procurement questionnaires and vendor due diligence. Until now, a vendor dissatisfied with the answers had bargaining power and little else. There is now a formal route to Brussels, and a template.

The pressure cuts both ways, because the route is on the record. A vendor filing against the model supplier it depends on does so under its own name, with contact details, into a file held for a decade and readable by the party complained against under the rights of defence. That is a commercial decision as much as a legal one, and it is likely to shape how often the channel is used.

The general tool matters differently. Because Article 75(1) pulls AI systems inside designated platforms into the AI Office's exclusive competence, complaints about ranking systems, creative generation tools and automated bidding engines operating inside those surfaces now have a single Union-level destination rather than 27 national ones. The exclusive competence applies to providers, though. An advertiser running campaigns on platform properties remains under its national regulator; the platform operating the underlying system does not.

Context from the wider enforcement build-out gives the channels their weight. The Commission published a draft implementing regulation on 12 March 2026 setting out how it will investigate and fine general-purpose model providers, and the consolidated text added inspection, sealing and cost recovery powers alongside periodic penalty payments of up to 5 percent of average daily turnover. Fine ceilings under Article 99 run to 15 million euros or 3 percent of worldwide annual turnover for most infringements. A complaint is the cheapest way to start a process that expensive.

The copyright limb of Articles 53 to 55 is the piece most likely to interest publishers. The General-Purpose AI Code of Practice published in July 2025 set out a voluntary route to demonstrating compliance on transparency, copyright and safety, and the Commission guidelines that followed required providers to maintain documentation for downstream providers throughout a model's lifecycle. The complaint channel supplies the enforcement counterpart to a framework that has so far run on voluntary adherence and bilateral pressure.

Timing places all of this immediately after the AI Act's general application date of 2 August 2026, and after the transparency obligations under Article 50 became binding on providers and deployers of generative systems. The regime now has both duties in force and a documented way for third parties to report suspected breaches of them.

Timeline

Summary

Who: The European Commission, acting through the AI Office within the Directorate-General for Communications Networks, Content and Technology, Units A.2 and A.3. Complainants may be natural or legal persons for the general tool, downstream providers of AI systems for the Article 89(2) channel, and individuals professionally connected to providers or deployers for the whistleblower route. Pessi Honkasalo, Tech, Data and IP Partner at Krogerus, described the three channels in a LinkedIn post.

What: Three documented reporting routes into the AI Office. A general complaints tool under Article 85 for AI systems within the Office's exclusive competence under Article 75(1). A separate email channel under Article 89(2) for downstream providers alleging infringement of Articles 53 to 55 by general-purpose model providers. An anonymous whistleblower tool with a secure inbox. The two complaint routes require identification; the whistleblower tool does not.

When: The downstream provider channel page carries a publication date of 31 July 2026 and a last update of 7 August 2026. The general complaints tool and whistleblower tool pages carry a last update of 31 July 2026. The AI Act became generally applicable on 2 August 2026, and the consolidated text incorporating Regulation (EU) 2026/1744 took effect on 27 July 2026.

Where: The European Union. Complaints may be submitted in any official EU language. The downstream channel runs through the address EU-AIOFFICE-DOWNSTREAM-PROVIDER-COMPLAINTS@ec.europa.eu, while the general tool operates as a web form whose footer carries an EQS Group GmbH copyright notice.

Why: The AI Act gives downstream providers a right to lodge complaints about general-purpose model providers and gives the AI Office exclusive competence over AI systems inside designated platforms and over systems built on models by the same provider. The published channels give both rights an operational form. For advertising technology vendors building on third-party models, and for publishers concerned with copyright policy and training data summaries, the practical change is a named destination and a template where previously there was only commercial bargaining power.