EU publishes draft rules to restart five-year deadline for AI fines

The European Commission opened a consultation on October 12 on draft rules that would let investigative steps restart the five-year deadline for imposing AI Act fines. The proposal also sets conditions for companies to examine evidence against them, putting enforcement timelines and defense rights into the same procedural rulebook.

The draft follows changes made in July through the EU’s Digital Omnibus legislation. Those changes gave the Commission direct supervisory powers over specified AI systems and established penalties, but left practical details about evidence access and deadlines to an implementing regulation.

The scope covers AI systems built on general-purpose models developed by the same company or corporate group, alongside AI integrated into designated very large online platforms or search engines. The draft names no companies. It is a procedural proposal, not a company-specific enforcement action.

A document request would restart the clock

Under the proposal described by PPC Land, the Commission would generally have five years to impose a penalty. For continuing or repeated violations, that period would begin only when the noncompliance stops. Investigative or procedural actions would interrupt the period and start it afresh.

The draft expressly identifies six steps that would trigger a reset:

• Requests for documents, explanations or other information; and requests for access to evaluate an AI system.
• Inspections; and invitations to a structured dialogue, a technical exchange before corrective measures.
• Opening formal proceedings; and reopening proceedings previously closed with commitments.

Those resets would not allow an investigation to run indefinitely without a penalty. The draft sets an outer limit of ten years, extended by suspension periods. The clock would pause during a challenge to a Commission decision before the EU’s Court of Justice, or while an on-site inspection awaits judicial authorization.

Collection would have its own reset rules, including actions designed to enforce payment and decisions changing the amount. The proposal leaves existing fine amounts unchanged, according to Pasquale Pillitteri’s account. Its focus is how proceedings work, rather than increasing the financial penalties available.

Evidence access would come in layers

A company could request access to the investigation file only after receiving preliminary findings setting out the Commission’s objections. It would receive the cited documents with confidential information removed. Unredacted access would generally be reserved for a limited group of named outside legal, economic and technical advisers under disclosure terms.

That access would have limits. Certain internal institutional documents would remain excluded, and the Commission could exceptionally withhold material where harm to its supplier outweighed its importance to the defense. Advisers would have one week to request additional non-confidential documents for their client, with approval limited to exceptional, indispensable cases.

Confidentiality duties would also reach third parties supplying evidence. The Commission could require them to identify each claimed secret, justify protection and provide a redacted version. Failure to comply could let the Commission treat the information as non-confidential. Voluntarily supplied documents could enter the restricted disclosure process for the investigated company’s advisers.

Consultation comes before adoption

These arrangements are not yet adopted: the draft expressly reflects preliminary views of Commission services. Public feedback remains open until November 9, 2026, through the Commission’s Have Your Say portal. Individuals, companies and associations can participate with a free EU Login account, and comments are published. Adoption is planned for the fourth quarter of 2026.