Who Must Act, and What Can Carry Over
Regulation (EU) 2026/1744 completes the EU AI Act’s date model with two practical questions: which authority owns a problem, and what happens to a system or operator that already exists when a new rule applies. This chapter maps the AI Office’s Union-level competence, its coordination and due-process limits, the proportional tools for SMEs and small mid-caps, and the conditional continuity rules for legacy systems. The aim is to identify the facts that determine responsibility without treating Union supervision, small-business relief, or a grace period as a blanket exemption.
The AI Office is a scoped supervisor, not a universal regulator
The amended Article 75 gives the AI Office exclusive competence for specified systems built on general-purpose AI models. The main case is an AI system based on a general-purpose model where the model and the system are developed by the same provider, or by providers forming part of the same undertaking. The rule also covers AI systems that constitute or are integrated into a very large online platform or a very large online search engine designated under the Digital Services Act.
This Union-level role responds to the way such systems can cross borders and affect large populations. A model, system, or platform with broad reach can create a fragmented enforcement problem if every national authority must separately investigate the same provider or if a platform’s digital-services obligations and AI obligations are assessed in isolation. The Digital Omnibus therefore places certain providers under the AI Office while preserving national supervision where the case belongs to a sector-specific or institutional authority.
The boundaries are part of the rule. The AI Office’s general-purpose-model competence does not cover every system that uses a general-purpose model. Exceptions include AI systems related to products covered by Annex I, certain systems in an Annex III category, specified systems provided by law-enforcement, border-management, or financial institutions, and a specified justice-related use. Systems placed on the market, put into service, or used by EU institutions, bodies, offices, or agencies remain under the relevant institutional supervision. The competence also generally reaches deployers only when they are the provider or form part of the same undertaking as the provider. A separate customer using the system is not automatically transferred to Union-level supervision.
That last relationship matters in real supply chains. One undertaking may develop both a model and an application, while another company deploys that application in a workplace or service. The AI Office’s exclusive role can attach to the provider and the related undertaking without swallowing the national authority that supervises an independent deployer. The result is a division of responsibility based on model relationship, platform status, sector, institution, and corporate connection—not simply on whether a system is technically advanced.
The AI Office receives powers comparable to those of a market-surveillance authority. It may investigate suspected non-compliance, request information, conduct remote or on-site inspections, examine books and data, obtain copies, ask for explanations, require retention of data or documents, and use external experts or Member State investigative teams. It may accept commitments that become binding, adopt decisions establishing non-compliance, order corrective measures, and impose fines or periodic penalty payments under the amended framework. Where applicable, periodic payments may not exceed 5% of average daily income or worldwide annual turnover in the preceding financial year per day.