AI Office Establishment and Role

Legal Framework

Article 64 of the AI Act establishes the AI Office as an independent administrative body within the European Commission, tasked with overseeing the implementation and enforcement of the AI Act's provisions on general-purpose AI (GPAI) models. The Office functions as the central Union-level authority responsible for evaluating and classifying GPAI models, particularly those presenting systemic risk.

Recital 113 elaborates on the Office's monitoring mandate, establishing a qualified alert mechanism through which the scientific panel can notify the AI Office of GPAI models that may warrant classification as carrying systemic risk. This alert system operates alongside the Office's own monitoring activities, creating a dual-track surveillance architecture. The rationale is to ensure that GPAI models meeting the systemic risk threshold—whether through training compute exceeding 10^25 FLOPs or otherwise—do not escape regulatory oversight simply because the provider failed to notify the Commission or the risk profile was not initially apparent.

The AI Office's establishment reflects a deliberate institutional choice: rather than fragmenting GPAI oversight across national competent authorities, the Act centralizes this function at Union level. This design addresses the cross-border nature of GPAI models and the technical capacity required to evaluate them, which exceeds what most national regulators can independently sustain.

Key Developments

The AI Act's institutional architecture draws from lessons in data protection enforcement, particularly the GDPR's experience with the one-stop-shop mechanism. The CJEU's jurisprudence on establishment—most notably in Google Spain (C-131/12)—established that even minimal but stable activity through a subsidiary can trigger Union jurisdiction. The AI Office's mandate similarly rests on a broad jurisdictional foundation: providers placing GPAI models on the Union market fall within its scope regardless of where the model was developed, provided there is a Union-level nexus.

The interplay between the AI Office and national authorities mirrors tensions seen in GDPR enforcement. The Office's exclusive competence over GPAI models, while national authorities handle high-risk AI system compliance, creates a bifurcated enforcement landscape that practitioners must navigate carefully. The scientific panel's qualified alert function introduces an expert-driven trigger mechanism distinct from traditional complaint-based enforcement models.

Practical Guidance

• Providers of GPAI models must establish direct compliance channels with the AI Office, as the Office—not national authorities—holds primary enforcement competence over GPAI obligations under Article 64. This includes notification obligations when training compute thresholds are met.

• Monitor for systemic risk designation proactively: Recital 113 makes clear that the Commission can unilaterally designate a GPAI model as carrying systemic risk if the provider failed to notify or if new information emerges. Providers should conduct internal risk assessments exceeding the statutory minimum to anticipate potential designation.

• Engage with the scientific panel process: The qualified alert mechanism means that external expert assessment—not just the Office's own monitoring—can trigger regulatory scrutiny. Providers should maintain technical documentation robust enough to withstand independent expert review.

• Distinguish GPAI obligations from downstream AI system obligations: The AI Office governs the model level, while national competent authorities govern AI system deployment. Providers operating at both layers must maintain separate compliance frameworks for each regulatory interface.

• Prepare for post-market monitoring cooperation: The Office's monitoring activities under Recital 113 extend beyond initial placement on the market, requiring ongoing documentation of model modifications, capability updates, and risk profile changes throughout the model lifecycle.