EU AI Office Requests: A Response Playbook for GPAI Providers
The EU AI Office can request information and documentation, conduct model evaluations, and pursue remedial measures under Articles 91 through 94 of the AI Act. This guide maps an inquiry to evidence owners and response controls while defining how narrow enterprise API records can corroborate downstream model use without replacing provider-side material.
Articles 91 through 94 of the EU AI Act give the European Commission powers to request information and documentation from general-purpose AI model providers and conduct model evaluations. The Commission can also request measures and protect procedural rights. A response needs a controlled evidence index before anyone starts exporting folders.
My opinion is blunt: a provider that discovers its model-version register after the request arrives has already lost a week. The response team should be able to identify the exact model and evaluation from one screen. The same screen should identify the release and incident owners, plus the contact owner.
TL;DR
- Build an inquiry register that maps each EU AI Office request to one owner and source record, plus its review status and response version.
- Separate provider-side model documentation and evaluations from enterprise downstream API evidence.
- Preserve legal review and confidentiality claims, plus delivery proof and remedial commitments.
- Gateway events can corroborate managed downstream use but cannot supply provider-side model weights or the provider's training and evaluation records.
Articles 91 through 94 define distinct powers
The official EU AI Act text sets out Commission powers concerning general-purpose AI models in Articles 91–94. The European Commission's AI Office page explains the office's role in implementing and enforcing the Act, including GPAI oversight.
Create a request record when an inquiry arrives. Capture the issuing authority and legal basis; the model or system named and requested items; the date received and response deadline; the confidentiality status and responsible counsel; and the technical owner and delivery channel. Preserve the original document byte for byte.
Then split each requested item into an evidence row. The row should identify the source system and custodian; the model version and relevant period; the reviewer and redactions; and the translation and final response location. A 63-file ZIP with names such as final-v4-new.pdf is not an evidence index.
Provider documentation needs provider owners
Training documentation and model architecture material, capability evaluations and systemic-risk work, plus incident records and cybersecurity controls belong with the GPAI provider's model and safety teams, supported by its security and legal teams. Keep version history and approval evidence for every supplied artifact.
An enterprise customer using the provider's API may hold downstream records. Those can show which approved endpoint and model identifier received a managed request. They can also show the authenticated caller and policy decision, together with the response path. They cannot prove how the model was trained or evaluated.
The EU AI Act GPAI guide covers provider obligations more broadly. For an inquiry response, narrow the work to the exact request and avoid sending unrelated customer content or security material.
Model evaluations require a reproducible pack
For each evaluation, preserve the model and checkpoint identifier; the test suite version and configuration; the evaluator and execution date; the environment and raw result reference; and the interpretation and limitations, plus approval. If the AI Office conducts or commissions an evaluation, the provider also needs a controlled route for access and technical support, with confidentiality and observation.
Record disagreements as evidence, not email rhetoric. Identify the disputed method or result and supporting test, plus the owner and proposed resolution. Legal counsel should map procedural rights and response timing to the specific action.
A useful rehearsal puts a printed request on the table at 10:15 a.m. and asks the team to produce one model card and one evaluation run, plus one incident record and the associated release approval in 30 minutes. The elapsed time exposes missing indexes faster than another policy draft.
Remedial measures need change control
When the Commission requests a measure, translate it into a controlled action. Name the requirement and affected model; the owner and target date; the implementation record and validation test; and the residual risk and response status. Preserve the version before and after the change.
An API route policy may support a downstream restriction, such as preventing a named model version from receiving a prohibited data class. The route event can prove the policy outcome for one request. Provider-side changes to model weights and safeguards, plus evaluation methods and release criteria, need provider evidence.
The AI audit trail requirements guide explains how to keep technical events joined to the legal file without pretending one log proves every obligation.
Confidentiality and delivery need their own controls
Review each artifact for personal data and trade secrets, security-sensitive information and legal privilege, plus contractual limits. Record the reason for any redaction or confidentiality claim. Use an approved delivery method and preserve a checksum and recipient, plus the time and receipt.
Maintain a disclosure copy that matches what was sent. Keep internal working notes separate. If a later correction is required, identify the original response and changed statement, the reason and approver, plus the new delivery proof.
Downstream customers should avoid volunteering provider claims they cannot verify. Their useful contribution is bounded evidence about their own configured model route and use case, plus their controls and observed incidents.
DeepInspect
DeepInspect can preserve identity-bound decisions for authenticated enterprise requests routed to GPAI endpoints over HTTP. The event can show the application-supplied identity and role, the approved model destination and data classification, plus the policy version, decision, and timestamp.
Those events can corroborate downstream use and route restrictions. They do not replace a GPAI provider's training documentation and model evaluations, weight security and systemic-risk analysis, or response to the EU AI Office.
Book a technical deep dive at deepinspect.ai.
Frequently asked questions
- Can an enterprise API log answer an EU AI Office request?
It can answer a narrow downstream-use question when the log covers the relevant authenticated HTTP route. It may identify the caller and model destination, the data class and policy, plus the result and time. Provider-side requests for training documentation and model evaluations, model weights and systemic-risk analysis, plus infrastructure controls require records held by the provider.
- What belongs in the inquiry register?
Keep the legal basis and authority contact; the received time and deadline; the requested items and named model; the owners and source records; the confidentiality status and review decisions; the delivery version and receipt; and the open questions and commitments. Use stable identifiers that join the request to each artifact and response.
- How should a company test readiness?
Choose one released GPAI model and simulate an Article 91 information request. Ask owners to retrieve the approved model documentation and evaluation pack, the release record and incident list, plus the cybersecurity evidence. Time the exercise and record missing links. Repeat after remediation using the same evidence checklist.