The European Commission has published draft rules for how its AI Office can investigate and fine the companies behind ChatGPT, Gemini and other general-purpose AI systems. According to a report on the draft, the implementing regulation was published on 12 October 2026. It sets out how the AI Office will run proceedings that can end in fines under the AI Act.
If you run a shop, a clinic or a logistics company, this draft is not addressed to you. It targets the large providers that the AI Office supervises directly. Your customer chatbot, your content workflows and your order automations probably run on one of their models, though. When the rules for your vendor get sharper, your vendor may change how it works, and that reaches your business.
One caution before the details: so far this story has been reported by a single outlet. Check the Commission's own consultation page for the official text and dates before you rely on specifics.
What the draft covers
The draft is procedural. According to the report, it covers how a provider under investigation gets access to the case file, how trade secrets are protected during proceedings, and limitation periods, including a 10-year cap.
That sounds dry, and it is. It still tells you something useful. Regulators write rules on file access and deadlines when they expect to open cases. A law on paper becomes enforcement in practice through exactly this kind of document. For the AI Act, the machinery for supervising the biggest model providers is being put in place.
Why rules for big providers reach small businesses
Most small businesses do not use AI models directly. They use tools: a website chat widget, a writing assistant, an email triage add-on, a workflow platform with an AI step. Behind many of those tools sits a model from one of the providers the AI Office supervises.
When a provider faces clearer enforcement, it has reasons to adjust. It might update its terms of use, limit a feature in the EU, change how it handles data, or ask business customers for more information about how they use the model. None of this is certain. All of it has happened with other regulations, and none of it asks your permission.
Picture the practical side. Your support team relies on a chatbot that answers delivery questions. The chatbot's vendor builds on a single model. If that model's availability or terms change, the vendor has to react, and your customers notice the gap before you do. The same goes for an automation that reads incoming orders and writes them into your system so your team stops retyping them.
Where this leaves your own obligations
Read this draft as a vendor-risk signal. It adds no direct obligation for your business. The AI Act has separate rules for organisations that use AI, and those depend on what you use it for. This document deals with how the AI Office proceeds against the providers it supervises.
That said, a small amount of housekeeping now puts you in a better position if a vendor changes course or if a customer, partner or auditor asks how you use AI. Most of it is a few hours of work, and the result is a document you will keep using.
What to do this week
- List every AI tool you use. Include chatbots, content and writing tools, AI steps inside your automations, and AI features in software you already pay for, such as your CRM or helpdesk. One spreadsheet is enough.
- Note the model provider behind each tool. Many tools are built on a model from a large provider. Check the vendor's documentation or ask their support team directly, and write the answer next to each tool.
- Collect vendor compliance documentation. Save each vendor's AI Act statements, data processing agreement and current terms in a shared folder, with the date you downloaded them. When terms change, you can compare.
- Check how locked in your customer-facing automations are. For anything your customers touch, ask your developer or agency how long it would take to switch to a different model. If the answer is weeks, plan a fallback now, even a simple one like routing chats to a person.
- Have your say if you want to. Feedback on the draft is open until 9 November. Business associations often submit on behalf of members, so your trade body is a practical route if you lack the time to write your own response.
The AI Act will mostly reach small businesses through their vendors, and this draft is an early sign of how. A short inventory, a folder of vendor documents and a plan B for your most important automations cost little and save a scramble later. If you want help mapping your AI stack or building automations that can switch models without a rebuild, Stolos sets this up for businesses like yours.