6 minute read | April.15.2024
The EU AI Act grants the European Commission new investigative and enforcement powers over providers of some AI technologies, including general-purpose AI models such as generative AI products. The Commission has previously exercised investigative and enforcement powers only in the realm of competition law, and this expansion is part of a new trend in regulating digital technologies in Europe.
This overview of the European Commission’s investigative powers in the AI Act explores who is impacted, lessons from the anti-trust realm and measures affected companies can consider to mitigate risk.
National market surveillance authorities will undertake most compliance investigations and enforcement actions under the AI Act. They will exercise power in accordance with EU Regulation 2019/1020 on market surveillance and compliance of products. However, an important exception pertains to providers of general-purpose AI models (GPAIMs) and general-purpose AI systems (GPAIS). (See “AI Act: Who is Covered?” for key definitions.)
The Commission will have exclusive jurisdiction to enforce the AI Act’s provisions relating to GPAIMs, and that jurisdiction will be delegated to a newly formed AI Office.
Article 91 of the AI Act empowers the Commission to request all documentation a provider created pursuant to Articles 53 and 55 of the AI Act covering technical documentation, capabilities, risk assessments or “any additional information” necessary to assess compliance. The AI Office may also evaluate a GPAIM.
Providers face fines if they supply incorrect, incomplete or misleading information.
In addition, the AI Office will have power where an AI system is based on a GPAIM and the same provider develops the system and model. In a case like that, the AI Office will have the power to monitor and supervise the AI system’s compliance, acting with the same powers accorded to market surveillance authorities under Regulation 2019/1020. These powers include the right to request information, evaluate systems and inspect sites.
In addition, national market surveillance authorities may ask the Commission to exercise its powers in relation to GPAIMs to help GPAIMs fulfill their tasks under the Act.
The Commission, market surveillance authorities and other bodies involved in applying the AI Act are subject to the act’s confidentiality provisions. Providers will have procedural rights, including the right to be heard before a measure, decision or order is taken or made, except in an emergency.
In contrast to powers granted to the Commission under the newly adopted EU Digital Markets Act 2022/1925 and EU Digital Services Act 2022/2065 (DSA), under the AI Act, the Commission is not directly empowered to conduct interviews, take statements or conduct inspections except when the Commission assumes the powers of market surveillance authorities.
It is worth noting that the DSA also enables the European Commission to obtain information regarding some algorithms, specifically when implemented by online intermediaries the Commission designates as “very large online platforms” or “very large online search engines.”
Chapter IV, Section 4 and Recital 140 of the DSA empower the Commission to access explanations regarding data, documents, databases and algorithms. The DSA took effect for “very large online platforms” in August 2023 and the Commission already is investigating several entities.
Under the AI Act, providers of general-purpose AI models and some providers of general-purpose AI systems will be subject to oversight by the European Commission via the AI Office.
The European Commission has a long track record of carrying out investigations, but only in relation to suspected violations of competition law. We are therefore entering a new era, and companies potentially subject to the Commission’s jurisdiction under the AI Act may benefit from the lessons learned in anti-trust.
European Commission investigations in competition cases are burdensome — even when they do not involve on-site inspections. Acting as the European competition authority, the Commission has important powers to investigate antitrust (anticompetitive agreements, abuse of dominance) and mergers.
During an antitrust investigation, the Commission can request information, take statements and collect copies of documents.
As with the AI Act, the Commission can request “any additional information” it considers necessary. In practice, that can mean hundreds of thousands of documents, including draft versions for each. Indeed, the European Commission attaches great importance to draft documents, which it believes can reveal an entity’s “true intentions.”
The European Commission also has the power to enter a company’s premises, carry out dawn raids and seize documents. It can deal with large volumes of information and can find issues in each document.
The only limits on the Commission’s powers in competition cases involve the exercise and protection of fundamental rights, including protection of legal privilege.
The Commission also cannot collect documents exchanged with an external EEA-qualified lawyer, whether for litigation or not. These documents can never be reviewed, let alone used as evidence.
The AM & S case recognized protection of legal privilege in 1982, and the European Court of Justice recently clarified its scope under EU law. The court held that it applies to all communication between EU-qualified external lawyers and clients and is not limited to advice relating to exercising rights of defense.
If a company unlawfully invokes legal privilege to avoid turning over information, the Commission can fine and penalize the company.
When confronted by the Commission’s broad powers and their increasingly aggressive exercise, more entities have challenged Commission decisions. In a recent example, a leading social media company challenged a Request for Information the Commission sent in a competition investigation.
During a competition law investigation, companies have a cooperation obligation. When a company does not cooperate, the Commission can consider it an aggravating circumstance or impose an independent penalty. Moreover, police forces may assist Commission officers if a company refuses an inspection even though the Commission has a national court order.
When the Commission views a company’s behaviour as an aggravating circumstance, the fine generally increases 10% to 30%. In a recent case involving industrial bags, an employee’s destruction of a document increased a fine 10%, or €10.5 million – even though the company later produced a copy of the documents.
We recommend companies:
For more information in relation to investigations and enforcement under the EU AI Act, contact: Julia Apostle or Malik Idri.
To read the other notes in our EU AI Act Essentials series, click here.