The EU's AI Office opens: what it means for organisations using AI

A central body for a continent-wide law

The AI Act applies across the EU, but enforcement sits with national authorities in each member state. That creates a coordination problem. A bank using AI in Spain and France deals with different supervisors, and a software provider serving customers in ten countries could face ten different interpretations of the same rule.

The AI Office, established within the European Commission's Directorate-General for Communications Networks, Content and Technology, exists to solve that problem ^[1]. It does not replace national authorities. It coordinates them, provides guidance and ensures the Act is applied consistently.

The Office opened in February 2024, months before the AI Act entered into force ^[1]. By the time the transparency obligations applied on 2 August 2026, it had already published guidance, launched the AI Pact and begun building the infrastructure for notifications and incident reporting ^[2].

Three jobs: guidance, coordination and enforcement support

The Office has three main functions. First, it issues guidance. That includes codes of practice on transparency, technical standards and answers to common questions about compliance ^[2]. Organisations preparing for the high-risk requirements, which apply from 2 December 2027 for systems in Annex III, can use that guidance to understand what the law asks for ^[3].

Second, it coordinates national authorities. Member states enforce the Act, but the Office brings them together, shares best practices and helps build supervisory capacity ^[1]. When a serious incident with a high-risk AI system is reported, the Office collects the information and can share it with relevant authorities ^[3].

Third, it monitors general-purpose AI models. For very large models, those with systemic risk, the Office has direct enforcement powers ^[1]. For other models, it works with national authorities.

The AI Pact and voluntary commitments

Before most of the Act's obligations applied, the Office launched the AI Pact ^[2]. It is a voluntary programme. Companies commit to taking steps towards compliance early, publish a pledge and share what they are doing.

The idea is to encourage good practice before the legal deadlines. A company joining the Pact does not get a lighter enforcement regime, but it does get access to guidance, peer exchange and a public signal that it takes the rules seriously.

As of late 2024, over 100 organisations had signed the Pact ^[2]. The Office updates the registry and publishes summaries of commitments.

Notifications and serious incidents

Article 49 of the AI Act requires providers of high-risk AI systems in Annex III to notify their system to a national database before it is placed on the market ^[3]. The Office coordinates those databases and makes the information available to supervisors.

When a serious incident occurs, defined as one leading to death, serious health damage or serious fundamental rights violations, providers must report it to the relevant authority ^[3]. The Office collects those reports and can ask the provider for further information, including technical documentation.

That creates a record. If a regulator later investigates, the notification and incident reports are already there.

What this means for you

If your organisation uses or provides AI covered by the Act, the Office is not your regulator, but it shapes what your regulator will ask for. Its guidance sets expectations. The codes of practice it publishes become the standard against which compliance is judged.

Three questions are worth asking now. First, have you reviewed the Office's guidance on your type of AI system? Second, if you provide high-risk AI in Annex III, do you know which national database you will notify to before 2 December 2027? Third, if a serious incident happened today, would you know what to report, to whom and how quickly?

The Office does not make the law easier, but it does make it clearer. Organisations that follow its guidance early are less likely to be surprised when enforcement begins in earnest.

What to watch

The high-risk requirements for systems in Annex III apply from 2 December 2027 ^[3]. The Office will publish further codes of practice before then, particularly on Article 12's logging requirements and Article 26's obligations for users.

For general-purpose AI models, the Office is expected to issue detailed technical standards on systemic risk evaluation in 2025. Providers of large models should watch for those.

The AI Pact remains open to new signatories. Joining is voluntary, but it gives access to early guidance and peer networks that can help with compliance planning.