BRUSSELS — The European Union's landmark AI Act, two years after taking effect on paper, has at last reached the operational phase. Member states agreed on Friday to a long-delayed enforcement mechanism that creates a dedicated AI Office, defines its inspection authority, and establishes a procedure for handling the cross-border cases that have, since the law's adoption, threatened to stall the entire regime.

The agreement is procedural rather than substantive. It does not change the categories of high-risk systems, the obligations on providers, or the penalty structure. What it changes is the question that has shadowed the law since its adoption: who, in practice, will enforce it.

What the AI Office can now do

The AI Office, formally part of the Commission's Directorate-General for Communications Networks, gains the authority to conduct on-site inspections, request technical documentation directly from providers, and impose interim measures pending a final decision. Those powers are exercised in coordination with national supervisory authorities but no longer require their prior consent.

The change matters most for cases involving large foundation-model providers whose European footprint spans multiple member states. Until now, such cases have been routed through whichever national authority happened to be lead supervisor — a structure that proved unworkable in practice and consumed most of the regime's first eighteen months.

The cross-border procedure

The cross-border procedure that the agreement formalises is the part of the package that took the longest to settle. National authorities had asked for a shared decision-making structure that would preserve their substantive role in cases affecting their citizens; the Commission had pressed for a more centralised approach designed to deliver consistent outcomes across the bloc.

The compromise creates a tiered system. Cases that are clearly local remain the responsibility of national authorities. Cases that affect multiple member states are co-led by the AI Office and the most concerned national authority, with the Office holding final decision-making authority but committed to a structured consultation process.

The capacity question

The agreement does not, by itself, solve the capacity question that has been the regime's quieter constraint. The AI Office is currently staffed at roughly 110 posts; internal estimates put the requirement at closer to 280, and recruiting at the senior technical level has been slower than the Commission's hiring plan envisaged.

The agreement includes a commitment to accelerated recruiting in three priority categories: technical assessors with hands-on experience of large models, legal staff with cross-border procedural expertise, and policy staff with backgrounds in the regulated sectors. The first new hires under the accelerated pathway are scheduled to arrive in early summer.

What providers should expect

Providers of regulated systems should expect the first wave of formal inspections to begin in the autumn. Early inspections are likely to focus on documentation completeness rather than on substantive findings; the regime's stated approach is to establish baseline compliance before escalating to more substantive review.

That phasing reflects practical constraints rather than indulgence. Building the institutional muscle for substantive technical review of frontier systems will take longer than the legal framework alone has anticipated, and the Commission has acknowledged as much in internal discussions with member states.

The penalty regime

The AI Act's penalty regime — up to seven percent of worldwide turnover for the most serious violations — remains as drafted. The agreement clarifies the procedure under which penalties are imposed but not the substantive standards, which will continue to be developed through enforcement decisions.

The first significant penalty decisions are likely to arrive in 2027. Until then, the regime's effects on provider behaviour will be driven principally by uncertainty about how the new office will exercise its discretion.

The view from the United States

U.S. regulators have observed the European process with interest and have, in private discussions, signalled they expect the AI Office's first significant decisions to influence the trajectory of American policy in ways that go beyond the formal jurisdictional questions.

That influence is likely to flow most strongly through the documentation and disclosure expectations the Office establishes, which will set practical baselines that providers will find difficult to maintain in fragmented form across regulatory regimes.