Who can investigate an AI provider under the EU AI Act?
A new Commission overview maps the AI Office, national authorities and the EDPS, along with complaint routes and maximum penalties. It clarifies the framework but does not announce a new law or enforcement case.
The short version
- What happened
- The Commission's AI Office oversees general-purpose AI providers and certain connected systems; national authorities handle other AI systems, while the EDPS covers EU institutions.
- Who it affects
- Individuals and organisations now have a clearer route for allegations within the AI Office's remit, but the identified complaint form is not anonymous.
- What remains unproven
- The Commission says the overview is informational, does not replace the AI Act and does not bind the Commission.
Keep in mind
The Commission says the overview is informational, does not replace the AI Act and does not bind the Commission.
The page publishes no complaint denominator, investigation outcome, response time, sanction or remedy.
The linked complaint and whistleblower pages were last updated 6 October 2026, so their existence should not be presented as a 20 October launch.
Source analysis · 2 linked sources. Primary analysed source date: 20 October 2026. Earliest linked supporting source: 6 October 2026.
Read the full report · 3 min The evidence, methods, implications and limitations
The map separates three enforcement routes
The European Commission has published a consolidated map of AI Act enforcement. The AI Office covers providers of general-purpose AI models, systems built by the same provider or business group, and AI integrated into designated very large online platforms or search engines. National competent authorities cover other AI systems, while the European Data Protection Supervisor enforces the rules for EU institutions.
For people and organisations, that division determines where a complaint goes. The identified AI Office complaints route requires contact details and covers alleged infringements inside the Office's remit; submissions can use any official EU language. Eligible people professionally connected to a provider can use a separate anonymous whistleblower channel. Matters outside the Office's remit may be referred to national or fundamental-rights authorities with consent.[1][2]
The Office has tools, but this page reports no case outcome
The overview says the AI Office can request information, require access for model evaluations, ask providers to take measures and, where necessary, restrict public availability. It also summarises maximum penalties already set by the Act: up to €35 million or 7% of worldwide annual turnover for prohibited practices, €15 million or 3% for other breaches including general-purpose-model duties, and lower limits for some information failures.
The page is not a new regulation, enforcement decision or finding that a provider broke the law. Commission services explicitly say it is informational and non-binding. Its value is procedural clarity for complainants and providers; evidence of practical impact will come from published cases, response times, referrals, remedies and court or supervisory scrutiny.[1]
The distinction that matters
Which authority handles which AI system?
The responsible body depends on the provider, system and institution involved.
AI Office
GPAI providers and certain connected systems
EU-level investigation and sanctions
National
Other AI systems
Member-state market surveillance
EDPS
AI used by EU institutions
Institutional supervision