INSTITUTION PROFILE / AI & MACHINE LEARNING
European Commission
It proposed the EU AI Act and directly enforces the rules for general-purpose AI models. Its reach extends to companies outside the EU
The European Commission is the executive body of the European Union. It proposes laws and sees that adopted laws are applied. In AI and machine learning, it proposed the EU AI Act (Regulation (EU) 2024/1689) and, through its AI Office, directly supervises the obligations on providers of general-purpose AI (GPAI) models. The act itself was adopted by the European Parliament and the Council, and market surveillance for high-risk AI belongs to the Member States. Because this area moves quickly, application dates and the status of the "Digital Omnibus on AI" are given with a check date (15 October 2026).
- The European Commission in 30 seconds
- What kind of body it is: the four types of influence
- What it does for AI and machine learning
- How far its influence reaches (powers and geography)
- Companies and organizations it works with
- Outlook
- Glossary, references and claim-to-source audit
1. The European Commission in 30 seconds
The Commission is not the body that "makes" the AI Act. It proposes the law and enforces part of it itself. The AI Act (Regulation (EU) 2024/1689) was adopted by the European Parliament and the Council, and is dated 13 June 2024 Sourced. The Commission has exclusive powers to supervise and enforce the rules on providers of GPAI models, and it entrusts that work to the AI Office (Article 88) Sourced. Supervision and enforcement of AI systems such as high-risk AI belong to the market surveillance authorities of the Member States Sourced. So the Commission's influence comes from three things: the power to propose laws, the power to police GPAI models directly, and the power to shape practice through guidelines and codes of practice.
Some AI Act application dates were pushed back by the "AI Omnibus", which entered into force in July 2026. The AI Omnibus is Regulation (EU) 2026/1744, dated 8 July 2026 and published in the Official Journal on 24 July 2026. It amends three regulations, including the AI Act Sourced. Older explainers say high-risk AI applies "from 2 August 2026". It now applies from 2 December 2027 for the Annex III use cases and from 2 August 2028 for AI embedded in Annex I products Sourced. The stages are laid out in the tables in Section 3. We did not check how the rest of the Digital Omnibus, the parts other than the AI Act, is progressing Not yet confirmed.
2. What kind of body it is: the four types of influence
Unlike the companies in this series, none of the institutions that appear in AI coverage builds AI models. What separates them is the route by which they influence the industry, and that gives four types.
3. What it does for AI and machine learning
The Commission's work falls into running the AI Act, supervising GPAI models, and investing in compute Sourced. First, the stages of the AI Act's application.
| Date | Stage | What happens |
|---|---|---|
| 1 Aug 2024 | Entry into force | The AI Act enters into force |
| 2 Feb 2025 | Applies | Prohibited AI practices (eight categories) and AI literacy obligations |
| 2 Aug 2025 | Applies | Governance rules and obligations for GPAI models. Guidance including the GPAI Code of Practice was published in July 2025 |
| 2 Aug 2026 | Applies (general date) | The act applies in general. The AI Office and Member State authorities enforce it. Fines on GPAI providers become possible. Transparency duties (telling people they are talking to a machine, labelling generated content) also start in August 2026 |
| 2 Dec 2026 | Applies (set by the AI Omnibus) | Ban on AI that generates non-consensual sexual imagery or child sexual abuse material (the ninth prohibition). Deadline for generative AI systems placed on the market before 2 August 2026 to meet the output-marking duty (Article 50(2)) |
| 2 Dec 2027 | Scheduled (set by the AI Omnibus) | Duties for high-risk AI in Annex III use cases (biometrics, critical infrastructure, education, employment, migration and border control, and others). The original date was 2 August 2026 |
| 2 Aug 2028 | Scheduled (set by the AI Omnibus) | Duties for high-risk AI embedded in Annex I products (machinery, toys, lifts and others). The original date was 2 August 2027 |
The AI Omnibus itself went through these steps.
| Date | Stage | What happens |
|---|---|---|
| 19 Nov 2025 | Proposal | The Commission proposed it as part of its digital simplification package |
| 7 May 2026 | Political agreement | The European Parliament and the Council agreed |
| 8 Jul 2026 | Adopted (signed) | Made as Regulation (EU) 2026/1744. This is the date of the act |
| 24 Jul 2026 | Published | Published in the Official Journal of the European Union |
| 27 Jul 2026 | In force | Entered into force on the third day after publication |
The regulation's recitals give the reasons for the delay: harmonised standards that providers need to meet the high-risk duties were late, and Member States were slow to set up their governance and conformity assessment arrangements Sourced. That link between standards and legal timing is also why our institution profile of ISO matters here.
Next, what the Commission actually does.
| Activity | When | What it covers | Binding force |
|---|---|---|---|
| AI Office enforcement for GPAI models | From 2 August 2026 | Evaluating models, requesting technical documentation, requiring corrective measures, restricting a model's availability, and fines. The ceiling is 3% of worldwide annual turnover or EUR 15 million, whichever is higher (Article 101) | Legally binding (EU regulation) |
| GPAI Code of Practice | Published 10 July 2025 | Three chapters: transparency, copyright, and safety and security. The Commission and the AI Board have confirmed it as an "adequate voluntary tool". Signing is optional | Voluntary. Signing makes it easier to show compliance |
| Guidelines and the training-data summary template | July 2025 (GPAI) and later | Guidance on the scope of GPAI duties, a template for summarizing training data, and guidelines on prohibited practices, the definition of an AI system, and transparency duties | Interpretive guidance, not law itself |
| AI Pact | Described on the Commission's page | A voluntary initiative inviting providers and deployers in Europe and beyond to meet key AI Act obligations early | Voluntary |
| AI Factories | Being set up | Hubs for generative AI built on the EuroHPC Joint Undertaking's supercomputers. 19 AI Factories and 13 antennas are being set up. A call for tenders for up to seven AI Gigafactories has also been launched, backed by up to EUR 10 billion in EU and national funding and expected to unlock at least EUR 20 billion in private investment | Funding. The Gigafactories are Not yet confirmed |
| Action plan on Cybersecurity and AI | July 2026 | A coordinated approach to cybersecurity challenges from the most advanced models. The Commission will launch a call to build EU capacity to evaluate AI models before they reach the EU market, expected to be operational by 2027 | A plan. Not yet confirmed |
For engineers who build with AI, the statute is only part of the story. What matters just as much is the standards and guidance that spell out how to meet it. For GPAI, the Code of Practice has been confirmed as a voluntary way to show compliance Sourced. For high-risk AI, late standards were given as a reason for delaying the application date. For more, see our explainers on the EU AI Act and on AI safety evaluation and risk management.
4. How far its influence reaches (powers and geography)
| Aspect | What the Commission has | What the Commission does not have |
|---|---|---|
| Powers | The right to propose laws. Exclusive supervision and enforcement powers over GPAI model providers (carried out by the AI Office). Issuing guidelines, confirming codes of practice, and drafting delegated and implementing acts | The power to adopt laws (held by the European Parliament and the Council). Market surveillance of high-risk AI and the designation and supervision of conformity assessment bodies (done by Member State authorities). The final say on fines: the Court of Justice of the EU has unlimited jurisdiction to review them |
| Geography | The EU market. The AI Act applies to providers placing AI systems or GPAI models on the EU market whether they are established in the EU or in a third country. It also covers third-country providers and deployers when the AI's output is used in the EU | Power over AI that is neither offered nor used in the EU. AI used exclusively for military, defence or national security purposes (excluded from the act) |
| Timing | Staged application (see the table in Section 3). High-risk duties start in December 2027 | At the check date, the high-risk duties did not yet apply |
| Size | About 33,000 staff across the Commission. The AI Office has more than 125 staff, in six units plus two advisers | Headcount and budgets of the Member State authorities that enforce the act were not in the Commission material we checked |
The figure of about 33,000 is the headcount of the whole Commission, not of AI work. The AI Office's "more than 125" is the size of the unit that handles the AI Act Sourced. What applies when differs by stage, and the AI Omnibus changed several dates. Fines on GPAI providers have been possible only since 2 August 2026, and we did not find any case in which a measure or fine has actually been imposed Not yet confirmed.
5. Companies and organizations it works with
| Party | Relationship described in primary sources | Link to this series |
|---|---|---|
| OpenAI, Anthropic, Google, Microsoft, Amazon, Mistral AI | Listed as signatories of the GPAI Code of Practice on the Commission's page (updated 7 October 2026) | See our company profiles, where written. Signing is an optional way to show compliance |
| xAI | Signed only the "Safety and Security" chapter. It must show compliance with the transparency and copyright obligations by other means | See our company profile, where written |
| Meta, DeepSeek | Their names do not appear on the Commission's signatory list. This does not mean they have not signed, because the page says the list is still being updated | See our company profiles, where written. GPAI obligations apply whether or not a provider signs |
* Signing or not signing is not a judgment of any company's merits or compliance. The code is voluntary, and a provider that does not sign must show compliance in another way.
6. Outlook
| What we can read from the sources | Primary evidence | Type |
|---|---|---|
| High-risk AI duties for Annex III use cases are scheduled to apply on 2 December 2027 | Regulation (EU) 2026/1744 amends Article 113. The Commission's AI Act page gives the same date | Sourced (adopted) |
| Whether standards for high-risk AI are ready by December 2027 is likely to be the focus | The recitals of Regulation 2026/1744 cite late standards as a reason for the delay, and the Commission's announcement of the agreement says the rules will apply once support tools such as standards are in place | Inference |
| The AI Office's enforcement may move from the GPAI duties to actual investigations and measures | Powers to investigate, require corrective measures and fine have been available since 2 August 2026. We found no actual measure at the check date | Inference |
| EU capacity to evaluate AI models before they reach the market is expected to be running around 2027 | The Commission's page says it is "expected to be operational by 2027" | Not yet confirmed |
| The AI Gigafactories (up to seven) are at the call-for-tenders stage | The Commission's AI Factories page says a call for up to seven has been launched. We found no selection results | Not yet confirmed |
7. Glossary
- AI Office
- The AI unit inside the European Commission. It enforces the GPAI rules and supports the running of the AI Act.
- GPAI
- General-purpose AI. A model that can perform a wide range of tasks and underpins many AI systems.
- AI Omnibus
- The amending Regulation (EU) 2026/1744 that simplifies how the AI Act is applied. It includes the delay to the high-risk application dates.
- Market surveillance authority
- A national authority designated by a Member State to supervise and enforce compliance of AI systems.
- Notified body
- An independent body that carries out conformity assessment before a product is placed on the market. It is designated and supervised by a Member State's notifying authority.
- AI Factory
- A hub that uses EuroHPC Joint Undertaking supercomputers to support AI model development.
8. References
- European Commission AI Act (application timeline, prohibited practices, GPAI, the AI Omnibus timeline, governance; checked 15 October 2026). https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
- European Commission European AI Office (role, more than 125 staff, six units, powers). https://digital-strategy.ec.europa.eu/en/policies/ai-office
- European Commission Governance and enforcement of the AI Act (division of roles between the AI Office and market surveillance authorities, AI Board, Scientific Panel, Advisory Forum; updated 7 August 2026). https://digital-strategy.ec.europa.eu/en/policies/ai-act-governance-and-enforcement
- European Commission The General-Purpose AI Code of Practice (published 10 July 2025, signatory list; updated 7 October 2026). https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai
- European Commission AI Omnibus enters into force (27 July 2026). https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force
- European Commission EU agrees to simplify AI rules to boost innovation and ban 'nudification' apps to protect citizens (7 May 2026; political agreement). https://digital-strategy.ec.europa.eu/en/news/eu-agrees-simplify-ai-rules-boost-innovation-and-ban-nudification-apps-protect-citizens
- European Parliament and Council Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (dated 8 July 2026; OJ L 2026/1744, 24 July 2026). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744
- European Parliament and Council Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (dated 13 June 2024; Articles 2, 88, 101 and 113). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689
- European Commission AI Factories (19 AI Factories and 13 antennas, call for tenders for AI Gigafactories). https://digital-strategy.ec.europa.eu/en/policies/ai-factories
- European Commission Commission staff (about 33,000). https://commission.europa.eu/about/organisation/commission-staff_en
- European Commission About the European Commission (the EU's executive body, 27 Commissioners), and its page on EU law (proposing legislation, approval by Parliament and Council, infringement procedure). https://commission.europa.eu/about_en
9. Claim-to-source audit
| Claim in the text | Type | Source |
|---|---|---|
| Application stages (1 Aug 2024, 2 Feb 2025, 2 Aug 2025, 2 Aug 2026, 2 Dec 2027, 2 Aug 2028), the AI Omnibus timeline, the enforcement set-up from 2 August 2026, transparency duties, the action plan on Cybersecurity and AI | Sourced | Reference 1 https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai |
| The AI Office is a unit inside the Commission, has more than 125 staff and six units, and holds GPAI enforcement powers | Sourced | Reference 2 https://digital-strategy.ec.europa.eu/en/policies/ai-office |
| The roles of market surveillance authorities and notified bodies; the AI Board, Scientific Panel and Advisory Forum | Sourced | Reference 3 https://digital-strategy.ec.europa.eu/en/policies/ai-act-governance-and-enforcement |
| The GPAI Code of Practice (10 July 2025, three chapters), the signatory list, xAI's partial signature | Sourced | Reference 4 https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai |
| The AI Omnibus entered into force on 27 July 2026, and its main content | Sourced | Reference 5 https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force |
| The political agreement of 7 May 2026, and the intent to apply the rules once standards and other support tools are in place | Sourced | Reference 6 https://digital-strategy.ec.europa.eu/en/news/eu-agrees-simplify-ai-rules-boost-innovation-and-ban-nudification-apps-protect-citizens |
| The number and date of Regulation (EU) 2026/1744, the new Annex III and Annex I dates, the reasons for delay (late standards and national arrangements), the 2 December 2026 deadline, entry into force on the third day after publication | Sourced | Reference 7 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744 |
| The date of Regulation (EU) 2024/1689, its scope over providers outside the EU, the Commission's exclusive powers (Article 88), the fine ceiling (Article 101), the original application dates (Article 113) | Sourced | Reference 8 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689 |
| 19 AI Factories and 13 antennas; the AI Gigafactories call (up to seven, up to EUR 10 billion) | Sourced | Reference 9 https://digital-strategy.ec.europa.eu/en/policies/ai-factories |
| About 33,000 staff across the Commission | Sourced | Reference 10 https://commission.europa.eu/about/organisation/commission-staff_en |
| The Commission is the EU's executive body with 27 Commissioners; it proposes laws that Parliament and the Council approve | Sourced | Reference 11 https://commission.europa.eu/about_en |
| The four-type grouping of institutions; the selection of signatories | Our calculation | This article's own grouping |
| When the AI Office was founded; the progress of the rest of the Digital Omnibus beyond the AI Act; actual enforcement cases; AI Gigafactory selection results; suppliers to the AI Factories; Member State authority headcounts | Not yet confirmed | Not in References 1 to 11. This article does not estimate them |
| The outlook in Section 6 (readiness of standards, progress of AI Office enforcement) | Inference | This article's reading of References 1, 2, 6 and 7 |
Last updated 15 October 2026 / Troy Technical
Dates and figures come from the European Commission's website and the regulations on EUR-Lex. This field moves fast, so application dates and signatory lists are as of the check date. Items marked "Inference" are this article's reading of the primary information, not statements by the Commission.