Background
October 2026 saw three key developments for the European legal framework for artificial intelligence (“AI”) and cybersecurity.
- The European Commission launched the consultation process on a draft implementing regulation establishing detailed arrangements for Artificial Intelligence Act (“AI Act”) proceedings that are subject to the Commission’s direct oversight.
- Providers of high-risk AI systems now have a harmonised standard, EN 18286:2026 (Artificial intelligence – Quality management system for EU AI Act regulatory purposes), which creates a presumption of conformity for the quality management system required under Article 17 AI Act.
- In Germany, the Bundestag adopted the Act implementing the Cyber Resilience Act (CRA) (Gesetz zur Durchführung der Verordnung (EU) 2024/2847) and designated the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, “BSI”) as the competent central supervisory authority.
While these developments increase legal certainty for affected businesses, they also require companies to prepare for new compliance and implementation challenges. This article outlines the recent changes and examines their practical implications.
1. Consultation on the proposed implementing regulation on penalty proceedings, procedural rights and limitation periods
On 12 October 2026, the Commission launched a consultation on the draft implementing regulation to be adopted under Article 75c(8) and Article 75d(3) AI Act. The proposed regulation sets out the practical arrangements for certain proceedings involving economic operators that fall under the direct supervision of the Commission, or more specifically, the Commission’s AI Office. Under Article 75(1) AI Act, this covers AI systems based on general-purpose AI models where the model and the specific system are developed by the same provider or originate from the same undertaking, and AI systems that constitute or are integrated into a very large online platform or very large online search engine designated in accordance with the Digital Services Act (Regulation (EU) 2022/2065). The proposed regulation applies to the provider of these systems and to deployers that are also providers or belong to the same undertaking as the provider. The concentration of supervisory powers within the AI Office stems from the Digital Omnibus Regulation of 8 July 2026, which is discussed in our article of 30 July 2026 (Simplification of the AI Act (Digital Omnibus) | Gleiss Lutz).
The implementing regulation is based on the following Commission proceedings: Where there are reasonable grounds to suspect non-compliance with the AI Act, the AI Office may start an investigation against the economic operators referred to above (Article 75a(2) AI Act). If, in the course of these proceedings, the Commission communicates preliminary findings to the economic operator concerned pursuant to Article 75c(2) AI Act, that operator becomes the addressee for the purposes of the draft regulation. The case file consists of documents that are submitted to the Commission during the proceedings, whether in response to a request or on a voluntary basis. These documents may originate from the economic operator concerned or a third party, such as a competitor. During the proceedings, the economic operators concerned may offer commitments to ensure compliance with the relevant provisions. The AI Office may then make those commitments binding on the operator and declare that there are no further grounds for action (Article 75b(1) AI Act). Where the Commission finds that an economic operator has failed to comply with the AI Act or has breached a commitment, it may impose penalties pursuant to Article 75c(1) and (4) in conjunction with Article 99(3) to (7) AI Act, as well as periodic penalty payments under Article 75c(5) AI Act. To protect addressees, all of these procedures are subject not only to the specific procedural rights set out in the AI Act but also to the procedural rights provided for in Article 18 Market Surveillance Regulation (Regulation (EU) 2019/1020).
In addition to laying down the arrangements for access to the file and the negotiated disclosure of information, which will be discussed in more detail below, the draft implementing regulation also deals with limitation periods, including the circumstances under which these may be interrupted or suspended.
The draft has not yet been adopted and merely reflects the preliminary views of the Commission services. The consultation, which is open to all interested parties – in particular industry experts, non-governmental organisations and trade associations – will run until 9 November 2026, meaning that the draft may still undergo changes. Following its adoption by the Commission, the implementing regulation, as amended, will enter into force on the twentieth day following its publication in the Official Journal of the European Union.
Access to the file as right of defence
Article 2 of the draft sets out, for the first time, the right of access to the file. This right will be granted to the operator who is the addressee of the Commission’s preliminary findings pursuant to Article 75c(2) AI Act, namely the provisional allegation of non-compliance together with the measures it is considering taking or that it considers the operator concerned should take. Access will be granted upon request, but only once the preliminary findings have been notified. Documents may be redacted to protect business secrets and other confidential information. However, the right of access will not extend to internal documents, confidential information and correspondence of the Commission and other authorities. Under the draft, any documents obtained by the addressee through access to the file may only be used in the relevant proceedings and in any associated judicial or administrative proceedings concerning the application of the AI Act.
Negotiated disclosure of information
The proposal generally requires the Commission to grant access to the unredacted file contents (Article 2(3) of the draft) under terms set out in a Commission decision, including the technical means of the disclosure and its duration. Access may be provided by electronic means and/or (for some or all of the documents) at the Commission’s premises, and will only be granted to a limited number of external legal and economic counsel and technical experts who have been named in advance. In contrast, access will not be granted to employees of the addressee. This also means that the aforementioned advisers engaged by the addressee may not, at the time of the decision, be in an employment relationship with the addressee or a comparable situation. If they enter into such a relationship with the addressee or a competitor during the investigation or less than three years after its conclusion, the Commission will have to be informed immediately. They will also be required to provide the Commission with an assurance that they no longer have access to the contents of the file. Furthermore, advisers may neither disclose the contents of the files to any persons who have not signed the terms of disclosure, nor use such information for purposes other than the proceedings in question and any related judicial or administrative proceedings.
Under the proposal, advisers may submit a reasoned request to the Commission within one week of receiving access, asking for the non-confidential versions of individual documents to be passed on to the addressee or for additional advisers to be granted access. However, the Commission will only grant such a request in exceptional circumstances if it is indispensable for the proper exercise of the addressee’s right to be heard. If the Commission considers the request to be well-founded, it will ask the originator – i.e. the natural or legal person who submitted the documents in question – to agree to making a non-confidential version available to the addressee or to granting access to additional advisers, which is why this is referred to as “negotiated disclosure”. If the originator does not agree to this, the Commission will adopt a decision setting out the terms of disclosure for the documents concerned. It may in exceptional circumstances refuse or restrict access to individual documents if the potential harm that the party who submitted the documents would likely suffer would outweigh the addressee’s interest in being heard. The reason for this is that the Commission is itself bound to protect business secrets and, subject to the rules on access to the file, is generally prohibited from disclosing or granting access to documents or other information insofar as they contain business secrets or other confidential information. It should be noted that under the draft, parties who voluntarily submit their own documents to the Commission are deemed to consent to those documents being made available as part of access to the file.
Where addressees are granted access to the file, the Commission may set a time limit for the originators of the documents in question to substantiate their claims for business secrets for each individual document, submit a redacted version and provide a concise description of each piece of redacted information. If an originator fails to comply with this time limit, they risk the information being treated as non-confidential. If the Commission intends to disclose information designated as confidential because it does not constitute a business secret or because there is an overriding interest in its disclosure, the originator will have one week to lodge an objection. If the originator objects, the Commission may adopt a reasoned decision specifying the date of disclosure, which must be at least one week after the date of notification. Companies submitting information to the Commission would therefore be well advised to flag confidential material from the outset, explain why it merits confidential treatment, and have redacted versions ready for disclosure. Companies seeking access to the file as addressees should request such access as soon as they receive the preliminary findings and have suitable external advisers in place to enable them to respond as swiftly as possible. That will be particularly important, because advisers will have only one week to submit a reasoned request for extended access, which may only be granted in exceptional cases. Care will also have to be taken to ensure that the documents obtained are used only for their intended purpose.
Limitation periods
Under the proposed rules, the Commission will no longer be allowed to punish an infringement with a fine or periodic penalty payment once the five-year limitation period set out in Article 75c(8) AI Act has expired, or even enforce a penalty already imposed. For one-time infringements pursuant to Article 75c(8) AI Act, the period will begin on the day the infringement is committed; for continuing or repeated infringements, it will begin on the day the infringement ceases. The five-year limitation period for the enforcement of penalties will begin as soon as the decision imposing the penalty becomes final.
Interruption and suspension of the limitation period
The draft incorporates two mechanisms that would extend the limitation period in the Commission’s favour and therefore warrant particular attention from the economic operators concerned.
The first is interruption of the limitation period. Any action taken by the Commission for purposes of investigating an economic operator or conducting proceedings against them will interrupt the limitation period for the imposition of penalties. Such action could include requests for information, requests for access to conduct system evaluations, inspections, invitations to structured dialogues, or the opening or re-opening of proceedings. The limitation period for the enforcement of penalties will be interrupted when a decision amending the penalty amount or rejecting a request for amendment is served, or when the Commission acts to enforce a decision, or when a Member State does so at the Commission’s request. This limitation period recommences each time it is interrupted, in line with the comparable provision in section 212 Civil Code (Bürgerliches Gesetzbuch, “BGB”). However, the limitation period would nevertheless expire at the latest after ten years had elapsed – twice the five-year limitation period – without the Commission having imposed a penalty.
This maximum period would be extended by any lengths of time over which the limitation period has been suspended – again, in line with the comparable provision in section 209 BGB. The limitation period for the imposition of penalties would be suspended for as long as any procedure regarding the Commission decision was pending before the Court of Justice of the European Union or any on-site inspection requested by the AI Office was pending authorisation by a judicial authority. The limitation period for the enforcement of penalties would be suspended for as long as time to pay is allowed or the Court of Justice of the European Union or a national court suspends enforcement.
Companies should therefore document the date on which a potential infringement ended as well as what action the Commission took and when it took it. This will be the only reliable way to track the relevant limitation periods – which will need to be differentiated from the procedural deadlines set by the Commission, such as for comments. Any request for extension would have to be sufficiently substantiated and submitted before the applicable deadline.
2. Harmonised standard EN 18286:2026 on quality management (Implementing Decision (EU) 2026/2274)
Since 14 October 2026, providers of high-risk AI systems have been able to rely on a presumption of conformity for the quality management system required under Article 17 AI Act if they comply with the EN 18286:2026 standard. This is based on Implementing Decision (EU) 2026/2274, under which the reference to the standard was published in the Official Journal of the European Union. The harmonised standard was developed by CEN and CENELEC in response to a standardisation request from the Commission to specify, in particular, the AI Act’s requirements for the quality management systems of providers of high-risk AI systems. The presumption of conformity is, however, rebuttable. Moreover, application of the standard remains voluntary: Providers may also meet the requirements by other means, but must then demonstrate compliance themselves.
EN 18286:2026 sets out the requirements that such a quality management system must meet and explains how it can be implemented, operated and maintained. The standard is not restricted to any particular industry, but is designed to be used alongside, rather than replace, existing international management system standards such as ISO/IEC 42001 on AI management systems and ISO 9001 on general quality management. Its annexes map its clauses to corresponding clauses in those standards.
3. National CRA Implementation Act
The European CRA entered into force on 10 December 2024; its provisions have been phased in since 11 June 2026 and will apply in full from 11 December 2027. For the first time, the CRA introduces binding horizontal cybersecurity requirements for products with digital elements and extends CE marking to cover cybersecurity.
On 14 October 2026, the Bundestag’s Committee on Internal Affairs concluded its deliberations on the draft national CRA Implementation Act and proposed amendments, but only with respect to the implementationact’s entry into force. The Bundestag adopted the bill on 15 October 2026. The Act does not impose any new substantive obligations on businesses; these still arise directly from the CRA itself. Instead, it primarily designates the competent authorities and regulates cooperation between them. For manufacturers, importers and distributors of products with digital elements, the Act primarily clarifies the competent authority: The BSI will generally serve as the central authority responsible for supervision, notifications and the imposition of fines.
As the central national competent authority, the BSI will perform the following key functions: First, it will serve as the national market surveillance authority and, under the Act, is required to cooperate closely and in a spirit of mutual trust with certain other market surveillance authorities at both federal and state (Länder) level, as well as with other supervisory authorities. An exception applies to products that are also classified as high-risk AI systems under the AI Act: Under Article 52(14) CRA, responsibility for these products lies with the market surveillance authorities designated under the AI Act, i.e. generally the Federal Network Agency (Bundesnetzagentur), unless a specialist authority has jurisdiction. The BSI will also establish a complaints office within its area of responsibility, where consumers can submit complaints concerning potential non-compliance with the CRA. In addition, the BSI will serve as the notifying authority within the meaning of the CRA and will be able to assess and monitor conformity assessment bodies where there is a public interest in their notification. However, this does not affect the general competence of the national accreditation body. The BSI will also support the affected economic operators, particularly small and medium-sized enterprises (SMEs), as well as open-source software stewards, in complying with the CRA’s requirements. This support will primarily take the form of specific awareness-raising and training activities and the establishment and operation of a regulatory sandbox for cyber resilience. Finally, the BSI will perform the tasks of a computer security incident response team (CSIRT) and will therefore be responsible, in particular, for receiving and assessing reports of actively exploited vulnerabilities and severe incidents under Article 14 CRA.
Under the government’s draft bill, the provisions designating the BSI as the market surveillance and notifying authority and the provisions governing notification were due to take effect on 11 June 2026, while its CSIRT functions were scheduled to take effect on 11 September 2026. Due to the length of the legislative process, however, those dates could no longer be met. The relevant provisions will therefore now enter into force on the day following promulgation. The remainder of the CRA will enter into force as planned on 11 December 2027. Irrespective of the national legislative process, companies should ensure compliance with the CRA obligations already in effect, particularly the reporting obligations relating to actively exploited vulnerabilities and severe incidents having an impact on the security of products with digital elements. They should also ensure that their products are ready to meet the requirements that will apply in full from 11 December 2027.
Conclusion and outlook
These three developments show that the European regulatory framework for AI and cybersecurity is moving from the rule-making phase to the enforcement phase.
- Commission proceedings under the AI Act: The draft implementing regulation is intended to establish, for the first time, clear rules on access to the file while ensuring strict protection of business secrets and other confidential information. The proposed rules on limitation periods for fines and periodic penalty payments would primarily benefit the Commission. Companies should already be taking steps to consistently identify confidential information in any documents submitted to the Commission and substantiate the need for its protection, have suitable external advisers available for any negotiated disclosure, and keep track of the applicable limitation periods by thoroughly documenting infringements and measures taken by the Commission. Affected parties should also take advantage of the consultation, which remains open for comments until 9 November 2026.
- Harmonised standard: EN 18286:2026 offers providers of high-risk AI systems a reliable benchmark for their quality management systems. Although application of the standard is voluntary, it creates a rebuttable presumption of conformity, making it easier to demonstrate compliance. Providers should therefore consider aligning their quality management systems with the new standard. Further harmonised standards covering the remaining requirements for high-risk AI systems are being developed. Companies should therefore closely monitor publications in the Official Journal of the European Union and adapt their internal compliance processes accordingly.
- CRA Implementation Act: Following the Bundestag’s adoption of the bill on 15 October 2026, it will now be considered by the Bundesrat before being certified and promulgated. The BSI will serve as the main point of contact for manufacturers, importers and distributors of products with digital elements. The provisions concerning the complaints office, support measures and fines will apply from 11 December 2027, when the CRA becomes fully applicable. Companies should ensure that they comply with the CRA obligations already in effect and prepare their products in good time to meet the remaining requirements once they take effect.
Forward
