AI Act Fining Clock: EU Draft Lets Regulator Restart Limits for Google and Meta AI
EU draft lets the AI Office restart the AI Act fining clock via investigative steps, with a 10-year cap and fines up to 7% of turnover.
The European Commission has published a draft implementing regulation that allows the AI Office to restart the AI Act fining clock each time it takes certain investigative steps against large platforms such as Google and Meta. The draft, referenced Ares(2026)9589403 and dated 12 October 2026, governs how the Commission supervises AI systems integrated into Very Large Online Platforms and search engines. Public consultation runs from 12 October to 9 November 2026, and adoption is planned for the fourth quarter of 2026.
The text implements Articles 75c and 75d of the AI Act. Enforcement powers for the AI Office and national competent authorities already apply from 2 August 2026, so the draft fills in the procedural rules for powers that are already in force. Until now, the Commission had no detailed procedure for probing AI systems built into platforms, and the draft closes that gap.
How the limitation clock resets
Under the draft, the Commission has five years to adopt a fining decision. That period starts on the day the infringing conduct was carried out. For continuing or repeated conduct, the five-year count starts only when the conduct stops. The draft also lets six types of investigative action reset the five-year period, including information requests and inspections. A request for information sent in year four therefore pushes the deadline out again, rather than letting the original window run down.
The restarts have a ceiling. A 10-year absolute cap applies to issuing a fine, so no sequence of investigative steps can extend the Commission's power indefinitely. For a platform, the practical reading is that an investigation stays open for a decade at most, while the regulator can keep the file alive through routine steps in the meantime.
Information requests carry a separate risk. The Commission's enforcement guidance states that, for simple requests for information, a fine can be imposed if a provider's reply is incorrect or misleading. A thin or inaccurate answer to a routine request can therefore create penalty exposure in its own right, not only extend the timetable.
Fine levels and penalty tiers
The draft sets out three penalty tiers, summarised below.
| Infringement type | Maximum penalty |
|---|---|
| Prohibited practices | EUR 35 million or 7% of global turnover |
| General infringements | EUR 15 million or 3% of global turnover |
| Periodic penalty payments | Up to 5% of average daily turnover |
For the two fixed-and-percentage tiers, the higher of the two amounts applies. For a company with large global revenue, the percentage component is what determines the exposure, since 7% of turnover exceeds EUR 35 million once annual turnover passes EUR 500 million. Periodic penalties are a separate lever that can compel a company to answer requests or open its systems, even before a final fine is decided.
The 3% tier is also the one that applies to general infringements already in the regime. Coverage of the AI Act's existing enforcement powers describes the same EUR 15 million or 3% ceiling for providers, which means the draft adds a 7% tier for prohibited practices on top of the figures companies were already planning around.
Access to files and the business secrets question
The draft limits access to investigation files to external legal and technical advisers. The rule is intended to protect business secrets, which means a platform's in-house engineers and executives would not see the Commission's file directly. Companies must therefore route their defence through outside counsel and outside technical experts, which adds cost and lead time to every response.
The rule also changes who can challenge the Commission's evidence in practice. Smaller providers without large outside legal budgets may find the access limit harder to work around than the largest platforms, which already retain external firms across several jurisdictions.
Early enforcement record
The Commission has not yet issued a fine under these powers. Lawfare reports that proceedings opened against TikTok, AliExpress, Meta and others during the first year did not produce fines, but that they showed the Commission was willing to use its investigative tools quickly and against major platforms. The reset mechanism in the draft would make that willingness more durable, because an open investigation no longer has to finish within the original five-year window to stay valid.
The draft has also drawn technical criticism. Coverage of the text reports several numbering and cross-reference errors. Those errors do not change the penalty figures or the clock rules, but they will need correction before adoption, and any mismatch between article numbers and cross-references could affect how companies read their obligations during the consultation period.
Trade-offs for platforms and AI providers
The draft gives the Commission a flexible toolkit. Repeated information requests keep a case alive without a formal decision, and periodic penalties add pressure while the case is still open. The cost falls on companies that must answer each request, retain outside advisers, and plan for a multi-year exposure window. Firms that answer early requests fully and quickly reduce the number of new triggers they create, while firms that answer slowly or incompletely give the Commission more reasons to restart the clock.
The access restriction works in the opposite direction. It protects trade secrets from disclosure to competitors and internal staff, but it concentrates the review of sensitive technical material in a small group of outside specialists. Companies will need to decide early whether their existing advisers are cleared to handle AI system documentation at the depth the Commission may require.
What compliance teams should do now
Legal and compliance teams should map which of their AI systems sit inside a Very Large Online Platform or a search engine, since the draft covers those integrations explicitly. They should also log every information request and inspection by date, because each one can restart the five-year period and the 10-year cap runs from the original conduct. A tracking register of this kind turns the reset rule from an abstract risk into a dated schedule that can be audited.
Why this matters
The draft turns the AI Office's fining power from a time-limited right into a process that can be extended by routine steps, bounded only by the 10-year cap. Platforms integrating AI into search and social services face the most direct exposure, since the rules cover those systems explicitly. Compliance teams should track the consultation window that closes on 9 November 2026 and the Q4 2026 adoption target.
Sources
The enforcement framework of the AI Act | Shaping Europe's digital future
Photo by Brecht Corbeel on Unsplash
Related Articles
- EU AI Act Enforcement Is Underway: What Enterprises Face From August 2 [Update]
- EU AI Act Article 50 Compliance: 17 Days Until Transparency and Labeling Rules Take Effect
- EU AI Act Article 50 Compliance: Six-Day Countdown to August 2 Transparency Rules
✔Human Verified
Researched and cross-referenced against primary sources by the Bytevyte editorial team. This article was generated with the assistance of artificial intelligence and reviewed by the Bytevyte editorial team.