AI Act: limitation periods, investigations, and file access in the draft implementing regulation

An open timetable

On 12 October 2026, the European Commission published for consultation a draft implementing regulation on proceedings run by the AI Office under the AI Act (Regulation (EU) 2024/1689). Document Ares(2026)9589403 spells out limitation periods for penalties and procedural safeguards (access to the file, business secrets). The draft states it has not been adopted; feedback is open until 9 November 2026. Entry into force is planned twenty days after publication in the Official Journal, once a final text is adopted.

Who falls under the AI Office?

The act does not cover every company using AI. It targets operators within Article 75(1), as amended by the Digital Omnibus: AI systems based on general-purpose AI models where the model and system are developed by the same provider (or undertakings in the same group); and systems that constitute or are integrated into a very large online platform or very large online search engine designated under the DSA. Penalties imposed by national authorities in other cases are outside this draft.

Limitation: five years, with interruptions

Article 75c(8) of the AI Act already sets a five-year limitation period for the Office to impose fines or periodic penalty payments, from the day of the infringement — or from the day continuing or repeated non-compliance ends. Draft Article 4 lists what interrupts that period: requests for documentation or explanations, access to evaluate a system, inspections, invitations to structured dialogue, opening or re-opening proceedings. Each interruption starts a fresh five-year period.

A maximum ceiling applies: limitation expires at the latest when a period equal to twice the initial limitation has elapsed without a fine or periodic penalty payment — ten years under the current draft. That ceiling can be extended by time during which limitation is suspended (for example while a Commission decision is before the Court of Justice of the European Union, or while an on-site inspection awaits judicial authorisation). Fixing a practice alone therefore does not necessarily end exposure if an investigation is opened or restarted.

Enforcement and defence

A second part (draft Article 5) governs enforcement of decisions: again a five-year period from the day a decision becomes final, with interruptions when payment is pursued or amounts vary. In parallel, Articles 2 and 3 organise access to the file after notification of preliminary findings: the addressee receives cited documents redacted for business secrets; unredacted access may be granted to a limited set of external counsel (lawyers, economists, technical experts) under confidentiality terms. If such counsel later joins the addressee or an active competitor on the same markets within three years after the investigation ends, the Commission must be informed.

• Map whether your organisation falls under Article 75(1) (same-group model + system, or VLOP/VLOSE integration).
• Assume any AI Office contact (including structured dialogue) may restart the limitation clock.
• Plan defence with eligible external experts if full-file access is needed to challenge a technical assessment.
• Track the consultation until 9 November and the adopted text before locking regulatory risk assumptions.