The EU AI Office oversees providers of general-purpose AI models placed on the EU market, and the European Commission can request information, evaluate models and seek measures under defined conditions. A public taxonomy for recording AI companies’ safety judgments is a separate policy proposal, not an EU rule.
That distinction matters: the Office’s legal powers are already in effect, while the proposed taxonomy would add a way to make certain company decisions easier to compare.
Who the EU AI Office oversees
The European Commission’s AI Office directly supervises and enforces obligations for providers of general-purpose AI (GPAI) models placed on the EU market, whether those providers are based in the EU or elsewhere. For AI systems, the Office directly supervises obligations when the GPAI model provider and the AI system provider are the same. In other cases, it supports the Member State authorities responsible for market surveillance, according to the Commission’s GPAI guidance.
The Commission’s enforcement powers for GPAI providers began applying on August 2, 2026. They do not make the AI Office the direct supervisor of every AI system in the EU.
What Articles 91, 92 and 93 allow
The AI Act gives the Commission three related tools: requesting information, evaluating a model and asking a provider to take measures. Each has a different job and conditions.
| AI Act provision | What the Commission can do | Key condition |
| Article 91 | Request information and documentation from a GPAI provider | To monitor compliance with the provider’s obligations |
| Article 92 | Evaluate a model | When information gathered under Article 91 is insufficient to assess compliance, or to investigate systemic risks at the EU level |
| Article 93 | Request measures to meet obligations under Articles 53 and 54 | Systemic-risk mitigation measures require an evaluation that gives rise to serious and substantiated concern about systemic risk |
The Commission may also restrict a model’s market availability, withdraw it or recall it under the conditions set out in Article 93. Its enforcement guidance describes the scope of these powers and the limits attached to them (Commission guidelines).
What a model evaluation can access
The Commission can seek access to source code or model weights when those forms of access suit the evaluation’s purpose. Other possible means include APIs, internal access and hosting infrastructure. An access decision must specify the technical means, components, conditions and deadline; it is not a blanket grant of access to every model or system. These procedures took effect under Commission Implementing Regulation (EU) 2026/1755 on August 10, 2026 (EUR-Lex).
The regulation also requires appointed experts to remain independent, declare interests, protect confidential information and follow security protocols. Providers can make reasoned objections about an expert’s independence. In penalty proceedings, a provider must have at least 21 days to submit written observations and supporting evidence on preliminary findings. Protections for business secrets and confidential information also apply to file access and disclosure.
What the proposed public taxonomy would add
On November 2, 2026, Tech Policy Press published a proposal for a regulator-maintained taxonomy of the judgments companies make about AI safety across a model’s lifecycle. Providers would place their decisions and underlying principles in a shared structure. Independent accredited bodies would check whether those public placements match supporting evidence; under the proposal, they would not decide which safety position is correct.
That approach would make providers’ stated positions easier to compare. It is a proposal, not an adopted Commission or AI Office measure.
Codes of practice and company-led evaluators
The Commission describes adherence to an adequate General-Purpose AI Code of Practice as one way to demonstrate compliance. It distinguishes that from the presumption of conformity associated with harmonized standards. In other words, the Code can support a compliance case, but following it does not by itself carry the legal effect the Commission assigns to harmonized standards (Commission guidance).
In a September 2026 post, Anthropic CEO Dario Amodei said the company was committing to embedded third-party evaluators and planned to invite a team in the near future. He described intended, ongoing access to assess safety practices, models, training pipelines and processes, with permissions mostly comparable to those of internal risk-assessment teams. He also described exceptions for legal or contractual requirements and for protecting customer and partner information. The reviewers, he said, could publish key findings and disclose whether a redaction affected their conclusions (Amodei’s post).
