The EU AI Office is here: what it will do and when it matters

A new institution for a new law

The AI Act is the first comprehensive AI regulation in the world, and it needed a body to run it.^[1] The AI Office was established within the European Commission in February 2024, months before the regulation entered into force.^[6] Its job is to make the AI Act work: coordinate enforcement, support national authorities, publish guidance, run registries and bring together experts and industry.

It does not replace national authorities. In Sweden, for instance, companies report to the Swedish Authority for Privacy Protection (IMY) for most AI matters.^[7] The AI Office sits above that layer, setting the framework and ensuring consistency across the EU.

What the AI Office does

The office has several roles, set out in the AI Act itself and in the Commission decision that created it.^[8]

First, it coordinates enforcement. National authorities handle day-to-day supervision, but the AI Office can ask them to investigate specific cases, particularly for general-purpose AI models and prohibited AI practices.^[4] It issues opinions, proposes fines and monitors how member states apply the rules.

Second, it publishes guidance. The AI Act leaves many questions open, and the office is expected to clarify them through codes of practice, technical standards and Q&A documents. Its AI Act Service Desk already answers common questions and provides plain-language summaries of each article.^[9]

Third, it runs the AI Pact, a voluntary scheme where companies commit to start complying before the deadlines.^[2] Over 140 organisations have signed up, pledging to adopt AI governance, risk assessments and transparency measures ahead of the law. The pact is not binding, but participants can show early commitment.

Fourth, it manages registries. The EU database of high-risk AI systems, which goes live on 2 August 2027, will be maintained by the AI Office.^[5] Providers of high-risk AI under Annex III must register their systems there before placing them on the market. The office also keeps a list of prohibited AI practices and general-purpose AI models.

Finally, it convenes the advisory structures: the AI Board, made up of national representatives; the advisory forum, which includes industry, academia and civil society; and the scientific panel of independent experts.^[10] These bodies feed into the office's decisions and help the Commission adapt the AI Act as technology changes.

Who leads it

Lucilla Sioli was appointed head of the AI Office in May 2024.^[3] She has been with the Commission since 1987 and most recently led work on AI and digital industry policy in DG CONNECT. Before that, she worked on the Digital Single Market and data policy.

Dragoș Tudorache, a Romanian MEP and co-rapporteur for the AI Act in the European Parliament, joined the office as senior advisor in September 2024.^[11] Kilian Gross, formerly policy coordinator at DG CONNECT, serves as deputy head.^[12]

The office has around 140 staff, a mix of Commission officials and seconded national experts.^[13] It is part of DG CONNECT but reports directly to Executive Vice-President Henna Virkkunen, who oversees the tech and sovereignty portfolio.^[14]

When it matters for organisations

The AI Office is already active, but its work becomes binding at different dates.

For prohibited AI, the rules apply from 2 February 2025.^[15] The office can ask national authorities to investigate systems that manipulate behaviour, exploit vulnerabilities or use real-time biometric identification in public spaces without proper safeguards.

For transparency obligations under Article 50, the deadline is 2 August 2026.^[16] AI that interacts with people or generates content must inform users accordingly. The AI Office will issue guidance on what counts as adequate disclosure, and national authorities will enforce it.

For high-risk AI under Annex III, the requirements apply from 2 December 2027.^[17] Providers must meet obligations on logging, human oversight, technical documentation and conformity assessment before placing systems on the market. The EU database opens two months earlier, on 2 August 2027, so providers can register in advance.^[5]

For general-purpose AI models, the rules took effect on 2 August 2024 for the most capable models and will apply to all others from 2 August 2025.^[18] The AI Office has direct oversight here and can propose fines up to 3 per cent of global turnover for non-compliance.^[4]

The AI Pact is live now.^[2] Joining is voluntary, but it signals intent and may shape how the office and national authorities view a company's readiness.

What this means for you

If you are building or using AI in the EU, the AI Office will shape what compliance looks like. Here are questions worth asking:

• Does your AI fall into a high-risk category under Annex III? If so, do you know which national authority will supervise it, and have you checked the AI Office's guidance on what counts as compliant?
• Are you planning to register a high-risk system in the EU database? The portal opens on 2 August 2027, two months before general application. Early registration may avoid last-minute problems.
• Have you reviewed the AI Office's Q&A on Article 50 transparency obligations? If your AI interacts with customers or generates content, you need a plan for disclosure by 2 August 2026.
• If you provide a general-purpose AI model, have you assessed whether it meets the thresholds for systemic risk? The AI Office oversees these directly and can act faster than it can for other AI.
• Are you part of the AI Pact? If not, is there a reason to join before your legal obligations begin?

The office does not enforce the AI Act on its own, but it writes the guidance, coordinates the authorities and runs the registries. In practice, its view of the rules will matter as much as the text of the regulation.

What to watch

The AI Office publishes a rolling calendar of consultations, codes of practice and technical standards on its website.^[1] Three dates stand out:

• 2 August 2026: transparency obligations under Article 50 apply.
• 2 August 2027: the EU database of high-risk AI systems goes live.
• 2 December 2027: high-risk requirements for Annex III systems apply in full.

The office is also working on codes of practice for general-purpose AI, due in early 2025, and on harmonised standards for high-risk AI, which will clarify technical requirements.^[19] Both will be published on the AI Act Service Desk.

If your organisation uses or builds AI, the AI Office is no longer a future concern. It is operational, and its decisions are starting to define what the AI Act means in practice.