On 30 September 2026 Lucilla Sioli, Director of the European AI Office in the Commission’s DG CONNECT, gave an extended interview on how her office applies the AI Act. The Commission’s enforcement powers over providers of general-purpose AI models, meaning models that can perform many distinct tasks and be built into other systems, became applicable on 2 August 2026. The interview matters because it sets out what the Office asks for in practice, which is not what the text obliges a provider to do.
How the Office proceeds
Sioli described a settled order of steps. The Office starts from the model reports that providers publish or share with it. Where those do not answer its questions, it sends a request for information, an informal demand it can address to a provider anywhere. If the reply does not satisfy it, the Office can issue a request by decision, require particular measures, and finally impose a sanction. Sioli presented that last step as a necessary threat rather than an aim, saying of the providers her office supervises: “We are not interested in sanctioning them.” The Commission’s page on the AI Office sets out the same ladder, from evaluating models to restricting a model’s availability and issuing fines.
The Office can act only on models placed on the EU market or intended for it, and a provider that keeps a model out of the Union is beyond its powers. One qualification matters outside the EU: Sioli treated a provider’s notice that a model under development will be a general-purpose model with systemic risk, a category the Commission says covers only a small number of providers of the most advanced models, as evidence in itself of an intention to place that model on the market.
A voluntary code that behaves like a standard
The General-Purpose AI Code of Practice, published on 10 July 2025, remains voluntary. The Commission’s page on the code describes it as an adequate voluntary tool for demonstrating compliance, confirmed as such by the Commission and the AI Board, and relates its transparency and copyright chapters to Article 53 of the Act and its safety and security chapter to Article 55. A provider signs by sending a signatory form to the AI Office, and may sign in part: the page records that xAI signed only the safety and security chapter and must show transparency and copyright compliance by other means. Sioli said the model reports show the code performing almost the function of a standard without being standardised, and that formal standardisation is still under consideration.
Reporting more than the minimum
The sharpest practical point concerns incidents. Sioli drew a distinction between the dedicated report that a serious incident calls for and the wider flow of information she would like to receive, saying that she wants “to be informed about all incidents, not only a selection of them”. An expectation voiced in an interview is not an obligation, and a provider’s duty remains what the Act and its implementing measures impose. A provider that reports only the minimum should expect the difference to be noticed by the body that will later weigh its good faith.
Two things are worth watching. The first is whether the code becomes a formal standard, which would change its legal weight and the value of signing it. The second is resourcing: the Commission’s page on the AI Office, last updated on 8 September 2026, gives it more than 125 staff across six units, among them a dedicated AI safety unit, while Sioli put the figure above 150, with some 40 further posts being recruited.
Sources: European Commission, General-Purpose AI Code of Practice; European Commission, European AI Office; The EU AI Act Conversations, interview with Lucilla Sioli, 30 September 2026.