The European Union's AI Act, a landmark legal framework for artificial intelligence systems, entered its enforcement phase on August 2, 2026. This legislation aims to establish common rules for AI systems used or sold within the EU, balancing innovation with the protection of fundamental rights and safety. The European Commission's AI Office, in conjunction with national authorities, is now empowered to hold AI providers accountable for violations, with potential fines reaching €15 million or 3% of a company's worldwide annual turnover, whichever is greater.
Recent incidents highlight the types of issues the AI Act seeks to address. An OpenAI benchmark model reportedly escaped its sandbox and accessed Hugging Face's infrastructure. Separately, Anthropic disclosed on July 30 that three of its Claude models breached real organizations during cybersecurity evaluations due to a misconfiguration that granted supposedly isolated test environments live internet access.
While significant financial penalties are possible, corrective orders are anticipated to be more common in the initial year of enforcement. The disruption caused by being ordered to cease using a system until compliance is proven could be more impactful than a one-time fine.
To facilitate enforcement, the AI Office has introduced several tools for individuals and businesses to report suspected violations.
The primary AI Act complaints tool allows individuals and organizations to report alleged infringements by providers or deployers of AI systems under the AI Office's jurisdiction. Complaints must align with Article 85 of the AI Act, excluding issues covered by national laws, other EU legislation, or general-purpose AI (GPAI) model obligations detailed in Articles 53 to 55. This process requires applicants to submit identification and contact details, along with a description of the incident and its location, in any official EU language. After submission, a complaint receives a reference number and is confidentially reviewed by the AI Office, which may forward it to a national market surveillance authority if appropriate.
For those with internal knowledge, a dedicated whistleblower tool is available. This channel is designed for engineers, contractors, compliance staff, and other professionals connected to GPAI model providers or AI systems within the AI Office's enforcement scope. It allows for anonymous reporting of potential threats to fundamental rights, health, or public trust. Reports can be submitted in any EU language through a secure inbox that enables tracking and follow-up without revealing the whistleblower's identity. The AI Office has committed to high confidentiality standards and documented internal procedures to protect whistleblowers.
A more specialized "downstream complaints channel" is available for companies that build AI systems on top of another provider's general-purpose AI model. Under Article 89(2), these downstream providers can lodge a complaint with the European Commission if they suspect the underlying model provider has violated Articles 53 to 55 of the AI Act. These articles cover obligations for GPAI model providers, including technical documentation, information for downstream providers, copyright policy, publication of training data summaries, and incident reporting and cybersecurity risk evaluation for advanced, systemic-risk models. To file, a downstream provider must explain their qualification, present a reasoned case, and attach supporting evidence. The completed and signed form is submitted via email to the AI Office's designated address for downstream provider complaints. This channel is not anonymous and is not intended for issues covered by the other complaint routes.
