The European Commission today opened a four-week consultation on a 10-page draft implementing regulation that sets out how operators of AI systems under the AI Office's direct supervision may see the evidence against them, how their business secrets will be handled, and how long the Commission has to fine them and to collect those fines. The draft, registered as Ares(2026)9589403 and dated 12 October 2026, implements Articles 75c and 75d of the AI Act - provisions inserted this summer that brought AI systems built into designated large platforms, and systems built on in-house general-purpose models, under the Commission's exclusive control. Feedback closes on 9 November 2026, and adoption is planned for the fourth quarter of 2026.

In Short

The European Commission wrote a draft rulebook for what happens when it investigates big companies' AI systems, such as AI built into large platforms or built by the same company that made the underlying model. It decides who on the company's side gets to read the evidence, how secret business information stays protected, and how many years the Commission has to issue and collect a fine. If you work in marketing, this matters because the AI tools inside the biggest ad and search platforms now answer to Brussels directly, and these rules set how fast and how far an investigation can go.

What the documents contain

Two documents form the basis of this article. The first is the draft act itself: a Commission Implementing Regulation "on practical and specific arrangements for the conduct of certain proceedings by the Commission pursuant to Article 75c and Article 75d of Regulation (EU) 2024/1689." It runs to nine numbered pages plus a cover sheet, contains four recitals and nine articles across four chapters, and carries the standard disclaimer that it "has not been adopted or endorsed by the European Commission" and that any views expressed "are the preliminary views of the Commission services."

The second is the Have Your Say consultation page, titled "AI Act Implementing Act - Articles 75c-75d." According to the Commission, the proposed regulation "sets out practical and specific arrangements for proceedings conducted by the Commission under Regulation (EU) 2024/1689, covering access to the file, procedural safeguards, and limitation periods for penalties, as required by Articles 75c and 75d of that Regulation." The page lists the topic as digital economy and society, the act type as an implementing regulation, and the comitology committee as C129100. The feedback window runs from 12 October 2026 to 9 November 2026, midnight Brussels time, which the page describes as four weeks. Feedback, the page notes, "will be published on this site."

The draft names no company. Its scope is defined by reference to Article 75(1) of the AI Act.

Who falls inside Article 75(1)

That reference is the reason the document matters beyond Brussels law firms. Recital 1 of the draft states that Article 75(1) "confers upon the Commission exclusive competence for the supervision and enforcement" of two categories: AI systems based on general-purpose AI models "where the model and the system are developed by the same provider or providers forming part of the same undertaking," and AI systems "that constitute or are integrated into very large online platforms or very large online search engines" designated under the Digital Services Act. The competence also reaches deployers that are themselves the provider, or part of the same undertaking.

Those categories were not in the AI Act as originally published in July 2024. They arrived through the Digital Omnibus on AI, Regulation (EU) 2026/1744, adopted on 8 July 2026 and published in the Official Journal on 24 July 2026. PPC Land reported at the time that the AI Office gained a 5% daily penalty power over Google and Meta AI systems through new Articles 75a to 75d: inspection powers under Article 75a, binding commitments under Article 75b, non-compliance decisions, fines and periodic penalty payments under Article 75c, and rights of defence under Article 75d. The AI Office, the Commission body that until then had dealt mainly with model providers, became the direct supervisor of AI features inside services such as Facebook, Instagram, YouTube, Google Search, Google Shopping, Amazon Store, LinkedIn, TikTok and Bing - the list PPC Land drew from the designated very large online platforms and search engines when the Commission opened three complaint routes covering Google and Meta systems in August.

Article 75c sets fines by reference to Article 99 of the AI Act, which reaches up to 35 million euros or 7% of worldwide annual turnover for prohibited practices and up to 15 million euros or 3% for most other infringements, and it allows periodic penalty payments of up to 5% of average daily income or turnover. Article 75c(8) sets a five-year limitation period both for imposing penalties and for enforcing them. Article 75d(2) grants access to the file "under negotiated disclosure arrangements." What neither article spelled out was how those periods run or how that disclosure works. The draft published today fills that gap. Its preamble cites Article 75c(8) and Article 75d(3) as the legal basis.

One drafting point is worth recording. The preamble refers to Regulation (EU) 2024/1689 by its original title and Official Journal reference of 12 July 2024. It does not mention Regulation (EU) 2026/1744, the amending act that created the articles the draft implements.

Access to the file: outside advisers only

Chapter II of the draft, headed "Procedural safeguards," opens with Article 2 on access to the file. The structure is layered.

Access is available only on request and only to the "addressee" - the operator to which the Commission has addressed preliminary findings under Article 75c(2). "Access to file shall not be granted before the notification of the preliminary findings," the draft states. Before that point, a company under investigation has no right under this regulation to see what the Commission holds.

At the first layer, the addressee receives "all documents mentioned in the preliminary findings," with business secrets and other confidential information redacted under Article 3.

At the second layer, the Commission "shall provide access to all documents on its file, without any redactions" - but only under terms of disclosure set in a separate Commission decision, and only to "a limited number of specified external legal and economic counsel and external technical experts engaged by the addressee." Their names must be sent to the Commission in advance. They must be undertakings, employees of undertakings, or in a comparable position, and they must not, at the date of the disclosure decision, be employed by the addressee.

The restrictions follow these advisers after the case closes. If one of them later enters an employment relationship with the addressee, "or with other undertakings active on the same markets as the addressee," during the investigation or "during the three years following the end of the Commission's investigation," both the adviser and the addressee must inform the Commission. The adviser must also give assurances that they no longer have access to documents that were never shown to the addressee itself. They may not pass documents to anyone who has not signed the terms of disclosure, and the documents may be used only for the proceedings in question or for related court or administrative proceedings under the AI Act. The Commission will specify the technical means and the duration of disclosure, which may take place electronically or, for some or all documents, at the Commission's premises.

Several exits from this regime are built in. Under Article 2(4), "in exceptional circumstances," the Commission may refuse access to certain documents, or provide them only partly redacted, if the harm to the party that supplied them "would, on balance, outweigh the importance of the disclosure of the full document for the exercise of the right to be heard." Under Article 2(11), the Commission may at any time decide to give access only to redacted documents instead of the full advisers' regime "in order to avoid a disproportionate delay or administrative burden."

The draft also excludes whole categories of material. In line with Article 75d(2) of the AI Act, access "shall not extend to confidential information, correspondence, and internal documents" of the Commission, the AI Board, the Advisory Forum, the scientific panel, Member State competent authorities and other competent authorities, "including EU bodies, international and intergovernmental organisations, third-country authorities." The same paragraph adds that nothing in it prevents the Commission "from disclosing and using information necessary to prove an infringement."

Asking for more

Advisers have one week from receiving access to make a reasoned request for a non-confidential version of any document not already given to the addressee, so that it can be passed to the company, or to extend the terms of disclosure to more named advisers. That additional access "may only be granted exceptionally and provided that it is indispensable for the proper exercise of the addressee's right to be heard." If the Commission agrees the request is well founded, it asks the party that supplied the document to consent. If that party does not agree, the Commission adopts a decision setting the terms of disclosure for the documents concerned.

Business secrets and the one-week objection window

Article 3 governs confidential information gathered in proceedings opened under Article 75a(2). The baseline is that such material "shall not be disclosed or made accessible by the Commission in so far as" it contains business secrets or other confidential information. Anyone who supplied documents voluntarily is deemed to agree that they may be disclosed under the Article 2 regime.

The Commission may require the originators of documents to identify what they consider confidential, to substantiate each claim document by document, to supply a non-confidential version with redactions "in a clear and intelligible manner," and to provide "a concise, non-confidential description of each piece of redacted information." Failure to do so has a consequence: the Commission "may consider that the information concerned does not contain business secrets or other confidential information."

Where the Commission decides that information claimed to be confidential may be disclosed - either because it is not a secret or because "there is an overriding interest in its disclosure" - it must give one week's notice. If the supplier objects, the Commission may adopt a reasoned decision fixing a disclosure date "not less than one week from the date of notification."

This matters to more than the company under investigation. Third parties - advertisers, publishers, rival AI developers, rights holders - who supply evidence in a case against a platform's AI system are the "originators" this article addresses. Their own commercial data could reach a platform's external counsel under the terms of disclosure.

Limitation periods: a five-year clock that keeps restarting

Chapter III deals with time. Article 4 governs how long the Commission has to impose a fine or periodic penalty payment.

For "continuing or repeated non-compliance," the five-year limitation period in Article 75c(8) "shall begin on the day on which the non-compliance ceases." An AI feature that stays non-compliant for three years therefore does not start the clock until it is fixed.

Any action the Commission takes for its investigation or proceedings interrupts the period. The draft lists six:

  • requests for documentation, explanations or other information;
  • requests for access to conduct system evaluations;
  • inspections;
  • invitations to a structured dialogue;
  • the opening of proceedings under Article 75a(2);
  • the re-opening of proceedings under Article 75b.

"Each interruption of the period referred to in paragraph 1 shall start time running afresh," Article 4(3) states. There is an outer limit: the period expires "at the latest on the day on which a period equal to twice the limitation period has elapsed" without a fine - 10 years - extended by any time during which limitation is suspended. Two grounds of suspension follow. The period stops running while the Commission's decision is before the Court of Justice of the European Union, and while "an on-site inspection requested by the AI Office is pending authorisation by a judicial authority."

Article 5 covers enforcement of a fine once imposed. That period is also five years and begins when the decision under Article 75c(4) and (5) "becomes final." It is interrupted by notification of a decision varying the amount of the fine or refusing an application for variation, and by any Commission action, or action by a Member State at the Commission's request, "designed to enforce payment." Each interruption restarts the clock. Enforcement is suspended while time to pay is allowed, or while payment enforcement is suspended by a decision of the Court of Justice or of a national court.

How long can such cases take in practice? Under the Digital Services Act, which shares its enforcer and part of its target list with Article 75(1), the Commission opened proceedings against X on 18 December 2023, adopted preliminary findings on 12 July 2024, and fined X 120 million euros for transparency violations on 5 December 2025. The Temu decision of 200 million euros on 28 May 2026 came more than 18 months after proceedings opened on 31 October 2024. A five-year clock that restarts on every information request leaves the Commission considerable room.

Time limits, transmission and signatures

Chapter IV sets general rules. Time limits are calculated under Regulation (EEC, Euratom) No 1182/71, but periods begin "on the working day following the event" that triggers them. When setting a deadline, the Commission must weigh "the possibility for natural or legal persons to exercise their right to be heard and the expediency of the proceedings." Extensions are possible on a reasoned request made before the deadline, assessed against whether the extension "is liable to have negative effects on the investigations or proceedings."

All documents to and from the Commission are to travel "by digital means" and must carry at least one qualified electronic signature under the eIDAS Regulation, (EU) No 910/2014. A submission counts as received when the Commission sends an acknowledgment of receipt. Files that are "inoperable or unusable," that contain "viruses, malware or other threats," or whose signature cannot be verified are deemed not to have been received, though the Commission must inform the sender without undue delay and allow it to rectify the problem. Registered mail and hand delivery are reserved for exceptional circumstances.

One provision reflects the subject matter. For "real or near real-time information shared through application programming interfaces or any other equivalent means," the Commission "shall define the methods and duration of such sharing," and may first invite the operator to propose alternatives. The draft does not say what information would be shared this way.

The regulation would enter into force on the twentieth day after publication in the Official Journal.

A near-copy of the rules for model providers

The structure of today's draft will be familiar to anyone who followed the Commission's earlier work. On 12 March 2026, the Commission published a draft implementing regulation covering investigations of general-purpose AI model providers, and PPC Land set out how Brussels would probe and fine AI model providers under it: no file access before preliminary findings, full access only for named external advisers, a three-year restriction on those advisers joining the addressee or a competitor, a five-year limitation period with interruptions, a 10-year absolute ceiling, and qualified electronic signatures. That text was adopted as Commission Implementing Regulation (EU) 2026/1755 of 20 July 2026, according to the version published in the Official Journal on 21 July 2026.

Much of today's draft reproduces that regulation's access-to-file, confidentiality, limitation and transmission provisions, including the one-week windows and the API clause. The differences follow the different powers. Regulation 2026/1755 lists four interrupting actions; today's draft adds inspections and the re-opening of proceedings, reflecting the inspection powers in Article 75a that model providers are not subject to under the earlier text. The suspension while an on-site inspection awaits judicial authorisation is also new.

Other elements are absent. Regulation 2026/1755 contains articles on opening and closing proceedings, independent experts, and written observations on preliminary findings - including a minimum reply period of 21 days - and an annex limiting written observations to 50 pages at no more than 4,700 characters per page. Today's draft has none of these. It contains no minimum deadline for replying to preliminary findings and no format rules. Whether the Commission considers those matters settled by Articles 75a to 75d themselves, or intends to address them elsewhere, is not stated in either document.

Drafting inconsistencies in the text

The draft contains several cross-reference and numbering errors that the consultation may correct before adoption.

  • Article 6, on the beginning of time periods, numbers its two paragraphs 6 and 7. The first refers to "paragraph 2 of this Article" and the second derogates from "paragraph 1" - neither of which exists under that numbering.
  • Article 4(3) says the 10-year outer limit "shall be extended by the time during which limitation is suspended pursuant to paragraph 6." Article 4 has only five paragraphs; the suspension grounds are in paragraphs 4 and 5.
  • Article 4(4) suspends the period while "the decision of the Commission referred to in paragraph 1" is before the Court of Justice. Paragraph 1 of Article 4 refers to no decision.
  • Article 5(1) and 5(2) both state that the enforcement period begins on the day the decision "becomes final," in nearly identical words.
  • Article 4(2)(f) lists "the re-opening of proceedings pursuant to Article 75b." Article 75b, as PPC Land described it in August, concerns binding commitments; the draft does not explain how re-opening operates under that article.
  • Footnote 3 gives the Official Journal date of the eIDAS Regulation as "28.8.201."

The consultation page and the draft are consistent on dates, the document reference and length - the page lists the PDF as 10 pages and 422.1 KB. There is one difference of framing. The page describes arrangements for "proceedings conducted by the Commission under Regulation (EU) 2024/1689" in general, while the draft's title limits itself to "certain proceedings" and its scope to operators within Article 75(1). Recital 3 also refers to fines imposed "by the AI Office," while the operative articles speak of "the Commission"; the AI Office sits within the Commission, so this reads as a difference of wording rather than of substance.

Why this matters for the marketing community

The AI systems now under the AI Office's exclusive competence are, in large part, the systems advertisers buy through and publishers depend on: AI features inside search engines, social feeds, video platforms and marketplaces designated under the Digital Services Act. Until this summer, AI Act enforcement over most of these sat with national market surveillance authorities. The omnibus moved it to Brussels, and the procedural rules decide how quickly and how thoroughly that supervision can move.

The timetable around the AI Act has shifted more than once. Talks on the omnibus collapsed in late April 2026 without changing the 2 August 2026 date, and a provisional agreement on 7 May 2026 pushed high-risk deadlines to December 2027 and August 2028. Enforcement powers over general-purpose models arrived on 2 August 2026, a date PPC Land flagged when the Commission published its model guidelines in July 2025 and Meta declined to sign the code of practice.

Three practical consequences stand out from the text. First, the limitation design favours the investigator: a clock that starts only when non-compliance ends, restarts with every information request, and pauses during litigation means past conduct of a platform's AI features remains exposed for years. Second, the confidentiality regime reaches third parties. Commercial data submitted by agencies, advertisers or publishers in a complaint may be seen by a platform's outside counsel and technical experts, subject to the terms of disclosure. Third, the absence of a minimum reply period for preliminary findings - present in the model-provider rules at 21 days - leaves that deadline to the Commission's discretion under Article 7, bounded only by the duty to have "due regard" to the right to be heard.

Who will respond to the consultation, and whether the final text restores the omitted provisions, will become clearer after 9 November 2026. Submissions published on the Have Your Say page will show which platforms and trade bodies chose to engage.

Timeline

Summary

Who: The European Commission and its AI Office, and operators of AI systems within Article 75(1) of the AI Act - systems built on a general-purpose model by the same provider or undertaking, and AI systems in or forming designated very large online platforms and search engines. External counsel and experts who receive file access, and third parties who supply evidence, are also covered.

What: A draft implementing regulation, Ares(2026)9589403, setting rules on access to the file through outside advisers, protection of business secrets with one-week objection windows, five-year limitation periods for imposing and enforcing fines that restart with six types of investigative action up to a 10-year ceiling, and digital transmission with qualified electronic signatures. The draft largely mirrors Implementing Regulation (EU) 2026/1755 for model providers, adds inspections to the interrupting actions, omits a minimum reply period and page limits, and contains several numbering and cross-reference errors.

When: Published and opened for feedback today, 12 October 2026. Feedback closes on 9 November 2026; adoption is planned for the fourth quarter of 2026, with entry into force 20 days after publication in the Official Journal.

Where: The European Union, through the Commission's Have Your Say portal, applying to proceedings run by the Commission in Brussels.

Why: Articles 75c and 75d, inserted by the Digital Omnibus on AI in July 2026, gave the Commission exclusive enforcement power over these AI systems and set a five-year limitation period and a negotiated disclosure regime, but left the practical arrangements to an implementing act. The draft provides them, in the Commission's words "in the interest of legal certainty."