European Commission maps AI Act enforcement powers and penalties

On October 20, 2026, the European Commission updated its AI Act enforcement framework, specifying that the AI Office oversees general-purpose AI models and related systems, national competent authorities supervise other AI systems, and the European Data Protection Supervisor covers EU institutions. The framework says the AI Office may request information and model access, conduct evaluations, order remedial measures and, where necessary, restrict a model’s availability; prohibited-practice breaches can attract penalties of up to €35 million or 7% of worldwide annual turnover. Law firms and legal departments should therefore distinguish provider-level exposure from deployer-level exposure and identify which regulator, evidence request and escalation path applies to each system in their portfolio. A second-order implication is that vendor diligence must cover cooperation with regulatory requests and model-access demands, not only security certifications and contractual warranties.