EU AI Act Art.92: AI Office Interview Powers — Voluntary and Compulsory Testimony Developer Guide (2026)

Art.90 requests documents. Art.91 inspects premises. Art.92 interviews people.

Article 92 is the person-centric leg of the AI Office's GPAI enforcement toolkit. Where the other investigative powers target information artefacts — training records, evaluation outputs, model weights — Art.92 targets the humans who created them: the engineers who designed training pipelines, the safety evaluators who ran red-team assessments, the executives who made systemic risk deployment decisions. For organisations within the AI Office's enforcement scope, the practical question is not whether an Art.92 interview could happen, but whether your staff is prepared for one when it does.

What Article 92 Actually Says

Article 92 establishes the AI Office's authority to interview natural and legal persons, the procedural framework for those interviews, and the consequences of providing false or misleading responses.

Article 92(1) — Voluntary Interview Authority:

The AI Office may interview any natural or legal person who consents to being interviewed for the purpose of collecting information relating to the subject matter of an investigation.

The consent requirement in Art.92(1) is critical: this provision covers voluntary interviews only. The AI Office can approach any person — an employee, a former contractor, a third-party evaluator, a model developer — and request their participation. The person can agree or decline. If they agree, the interview proceeds under Art.92's procedural framework. If they decline, the AI Office cannot compel participation under Art.92(1) alone — it must escalate to Art.92(2).

Article 92(2) — Compulsory Interview Authority:

Where the AI Office has sufficient reason to believe that a natural or legal person possesses information relevant to the subject matter of an investigation, it may by formal request require that person to provide such information.

Art.92(2) is the compulsory instrument. "Sufficient reason to believe" is a lower threshold than probable cause in criminal law — the AI Office must demonstrate a reasonable basis for believing the person has relevant knowledge, but it does not need to demonstrate wrongdoing. The formal request must identify: the legal basis (Art.92(2)), the subject matter of the investigation (without necessarily revealing all details), and the scope of information sought.

Failure to respond to an Art.92(2) formal request, or providing false, incomplete, or misleading answers, constitutes an infringement subject to penalties under Art.99.

Article 92(3) — Procedural Protections:

Persons being interviewed shall be informed of the legal basis for and the purpose of the interview, whether the interview is voluntary or compulsory, and of their right to be accompanied by a lawyer or another person of their choice.

Three disclosure obligations on the AI Office before the interview begins: legal basis (which provision authorises the interview), purpose (the subject matter of the investigation), and whether participation is voluntary or compulsory. The right to legal counsel attaches from the moment an interview is scheduled — not just during the interview itself.

Article 92(4) — Privilege Against Self-Incrimination:

Persons being interviewed shall not be required to provide answers which might expose them to criminal liability.

This is the individual's primary substantive protection under Art.92. The privilege applies to natural persons only — individuals. Legal persons (companies, organisations) do not have a privilege against self-incrimination under EU administrative law; they must answer questions that could implicate the organisation in wrongdoing.

The practical consequence: an engineer who designed a training pipeline that might constitute a violation cannot be compelled to describe their design choices in a way that exposes them personally to criminal prosecution. But their employer cannot invoke the same protection on behalf of the company.

Article 92(5) — Record Keeping and Verification:

The questions and the persons' answers shall be recorded. A copy of the record shall be provided to the person interviewed for verification and, where applicable, correction.

Every Art.92 interview produces a record. That record becomes part of the enforcement file — accessible to the interviewed party under the Art.89 right to be heard, and potentially accessible to the investigated provider in enforcement proceedings. The verification and correction procedure exists specifically to prevent AI Office mischaracterisation of interview content, but it also creates an obligation for the interviewee to identify inaccuracies promptly.

Article 92(6) — False Statement Consequences:

Providing false, incomplete, or misleading answers in the context of an interview under this Article constitutes an infringement subject to the penalties provided for in Article 99.

The Art.99 penalty for false or misleading statements: up to 3% of worldwide annual turnover, or €15 million for organisations where turnover is not available. This applies to both voluntary and compulsory interview contexts — if you agree to be interviewed and provide false information, the penalty exposure is identical to refusing to participate in a compulsory interview.

Voluntary vs Compulsory: The Decision Framework

The distinction between Art.92(1) voluntary and Art.92(2) compulsory interviews shapes the legal calculus differently for organisations and individuals.

The strategic consideration for organisations: voluntary interview participation is often preferable to compulsory because it signals cooperation (which Art.99 recognises as a mitigating factor), allows more control over timing and preparation, and avoids the formal enforcement record a compulsory request creates.

Art.92 in the Enforcement Sequence

Article 92 sits alongside Art.90 and Art.91 in the AI Office's investigative toolkit — not strictly after them in sequence, but available in parallel at any stage:

The AI Office can open an investigation, issue Art.90 document requests, and simultaneously schedule Art.92 interviews with the technical staff who created those documents — before reviewing what the documents actually say. This parallel approach allows investigators to cross-reference documentary evidence against individual testimony, identifying inconsistencies that neither source would reveal alone.

Who Can Be Interviewed

The scope of Art.92 is broader than many organisations assume. The AI Office can approach:

Internal personnel:

• Software engineers who designed training pipelines
• Safety researchers who conducted capability evaluations
• Data scientists responsible for training dataset curation
• Technical leads who approved deployment decisions
• Executives who made systemic risk assessments under Art.51-55

Former employees: The AI Act does not limit Art.92 to current employees. Former engineers, former compliance officers, and former executives who were involved during relevant periods can be interviewed. This creates a specific risk: former employees who left under difficult circumstances may not align their interview responses with the organisation's enforcement posture.

Third parties:

• External red-team evaluators who assessed model capabilities
• Third-party auditors who reviewed safety documentation
• Infrastructure providers with operational knowledge of model deployment
• Academic researchers who collaborated on training data or evaluation methodology

Legal persons: Companies that provided services to the GPAI provider — compute providers, data providers, evaluation contractors — can be compelled to respond to formal Art.92(2) requests (without the self-incrimination protection that individual employees have).

The Individual Privilege in Practice

The Art.92(4) privilege against self-incrimination is the most technically consequential provision for engineering staff. Understanding its boundaries determines when individual employees can lawfully decline to answer.

What the privilege covers:

• Questions where the answer would constitute a direct admission of criminal conduct by the individual
• Technical descriptions where the honest answer would expose the individual to criminal prosecution under applicable national law
• Design decisions where the individual's personal culpability (not just organisational liability) would be established by their answer

What the privilege does NOT cover:

• Questions where the answer might implicate the organisation but not the individual personally
• Technical descriptions of systems the individual worked on (unless the answer would directly establish personal criminal liability)
• Factual questions about events the individual witnessed (as opposed to actions they personally took)
• Questions answered in a way that could lead to civil rather than criminal consequences

The organisational consequence: When an employee invokes Art.92(4) privilege, the AI Office records this — it becomes part of the enforcement file. The silence itself communicates that the individual believes answering honestly would expose them to criminal liability. For investigative purposes, this is informative even if it is not evidence.

GDPR Intersection: Interview Records as Personal Data

Art.92 interviews create records that contain personal data about the interviewed individuals. Multiple GDPR obligations attach to these records:

For the AI Office (as controller):

• Art.5 GDPR data minimisation: interview records may only capture what is relevant to the investigation
• Art.17 GDPR right to erasure: unlikely to apply during active investigation (Art.17(3)(b) public interest exception), but may apply after investigation closes
• Art.15 GDPR right of access: interviewees can request access to their own interview records (distinct from the verification right under Art.92(5))

For the investigated organisation (when records are shared with them in enforcement proceedings):

• Receiving interview records of named individuals creates controller obligations
• Retention and security obligations apply to enforcement file copies
• Onward transfer restrictions apply if records are shared with legal counsel outside EU

The practical tension: Interview records often contain statements about third parties — the engineer who describes their colleague's design decisions is creating a record that implicates someone who was not interviewed. The AI Office must balance investigative thoroughness with data protection obligations for third parties mentioned in interview records.

Cloud Act Intersection: When Interview Subjects Are in the US

For GPAI providers with US-based technical staff, Art.92 creates a specific jurisdictional complication. The AI Office's interview authority is EU administrative law — it operates on the basis of EU law, not US law. But US persons are simultaneously subject to US legal requirements, including potential conflicts between EU investigative cooperation and US law.

The scenario: A GPAI provider's training pipeline was designed by engineers based in San Francisco. The AI Office issues Art.92(2) formal requests to interview those engineers about training data selection methodology. The engineers' employer is an EU entity subject to the AI Act. The engineers themselves are US persons.

The complication: EU administrative law requires the employer to facilitate the interviews. US law may separately implicate the engineers' testimony if the investigation touches on matters with US regulatory dimensions (CFIUS-reviewed technologies, export-controlled capabilities, or matters of interest to US intelligence). There is no clean resolution — each case turns on the specific subject matter of the investigation and the specific legal position of the individuals involved.

The EU sovereign infrastructure angle: This conflict does not arise for organisations whose technical operations and technical staff are EU-based. When the engineering team designing a GPAI model is operating from EU premises, on EU-controlled infrastructure, the jurisdictional conflict disappears — the AI Act's enforcement framework operates without interference from extraterritorial US legal claims. This is one of several concrete reasons EU-native infrastructure and EU-located technical teams reduce compliance risk beyond abstract GDPR compliance.

Python Implementation: Art.92 Interview Management

from dataclasses import dataclass, field
from datetime import datetime, timedelta
from enum import Enum
from typing import Optional

class InterviewType(Enum):
    VOLUNTARY = "voluntary"          # Art.92(1) — consent-based
    COMPULSORY = "compulsory"        # Art.92(2) — formal request

class IntervieweeType(Enum):
    NATURAL_PERSON = "natural_person"    # individual — self-incrimination protection applies
    LEGAL_PERSON = "legal_person"        # company — no self-incrimination protection

@dataclass
class Art92InterviewRequest:
    """Received interview request — voluntary or compulsory."""
    request_type: InterviewType
    interviewee_type: IntervieweeType
    subject_matter: str
    legal_basis: str = "Art.92(1) EU AI Act" 
    received_date: datetime = field(default_factory=datetime.now)
    response_deadline: Optional[datetime] = None
    legal_counsel_requested: bool = False
    
    def __post_init__(self):
        if self.request_type == InterviewType.COMPULSORY:
            self.legal_basis = "Art.92(2) EU AI Act"
            if self.response_deadline is None:
                # Compulsory requests typically specify 10-15 business days
                self.response_deadline = self.received_date + timedelta(days=15)
    
    def has_self_incrimination_protection(self) -> bool:
        """Only natural persons have Art.92(4) privilege."""
        return self.interviewee_type == IntervieweeType.NATURAL_PERSON
    
    def can_decline_without_penalty(self) -> bool:
        """Only voluntary interviews can be declined without Art.99 consequence."""
        return self.request_type == InterviewType.VOLUNTARY
    
    def days_until_deadline(self) -> Optional[int]:
        if self.response_deadline is None:
            return None
        delta = self.response_deadline - datetime.now()
        return max(0, delta.days)
    
    def escalation_required(self) -> bool:
        """Trigger legal review if compulsory request received."""
        return self.request_type == InterviewType.COMPULSORY

@dataclass
class Art92InterviewRecord:
    """Interview record produced under Art.92(5)."""
    interview_date: datetime
    interviewee_id: str  # anonymised identifier
    interview_type: InterviewType
    questions: list[tuple[str, str]]  # (question, answer) pairs
    privilege_invocations: list[str] = field(default_factory=list)  # questions where Art.92(4) invoked
    record_verified: bool = False
    corrections_submitted: bool = False
    verification_deadline: Optional[datetime] = None
    
    def __post_init__(self):
        if self.verification_deadline is None:
            # Reasonable time to review and correct record: 10 business days
            self.verification_deadline = self.interview_date + timedelta(days=14)
    
    def add_privilege_invocation(self, question: str, reason: str) -> None:
        """Document Art.92(4) privilege invocation for a specific question."""
        self.privilege_invocations.append(f"Q: {question} | Reason: {reason}")
    
    def is_verification_overdue(self) -> bool:
        return not self.record_verified and datetime.now() > self.verification_deadline
    
    def questions_answered(self) -> int:
        return len(self.questions) - len(self.privilege_invocations)
    
    def privilege_invocation_rate(self) -> float:
        if len(self.questions) == 0:
            return 0.0
        return len(self.privilege_invocations) / len(self.questions)

class Art92InterviewManager:
    """Track all Art.92 interview requests and records for an organisation."""
    
    def __init__(self):
        self.requests: list[Art92InterviewRequest] = []
        self.records: list[Art92InterviewRecord] = []
        self.legal_counsel_engaged: bool = False
    
    def receive_request(self, request: Art92InterviewRequest) -> dict:
        self.requests.append(request)
        assessment = {
            "request_type": request.request_type.value,
            "can_decline": request.can_decline_without_penalty(),
            "self_incrimination_protection": request.has_self_incrimination_protection(),
            "days_until_deadline": request.days_until_deadline(),
            "immediate_actions": [],
            "risk_level": "LOW"
        }
        if request.request_type == InterviewType.COMPULSORY:
            assessment["immediate_actions"].append("Engage legal counsel immediately")
            assessment["immediate_actions"].append("Do not respond without legal review")
            assessment["immediate_actions"].append("Notify C-suite within 24 hours")
            assessment["risk_level"] = "HIGH"
        else:
            assessment["immediate_actions"].append("Consult legal counsel before deciding to participate")
            assessment["immediate_actions"].append("Assess cooperation benefit vs privilege risk")
        if request.interviewee_type == IntervieweeType.NATURAL_PERSON:
            assessment["immediate_actions"].append(
                "Brief individual on Art.92(4) self-incrimination protection"
            )
        return assessment
    
    def assess_interview_posture(self) -> dict:
        """Evaluate organisation's current Art.92 exposure."""
        compulsory = [r for r in self.requests if r.request_type == InterviewType.COMPULSORY]
        overdue_verifications = [
            rec for rec in self.records if rec.is_verification_overdue()
        ]
        return {
            "total_requests": len(self.requests),
            "compulsory_requests": len(compulsory),
            "records_pending_verification": len(overdue_verifications),
            "legal_counsel_engaged": self.legal_counsel_engaged,
            "recommendation": (
                "IMMEDIATE LEGAL REVIEW REQUIRED" if compulsory
                else "Monitor and prepare"
            )
        }

def check_art92_readiness(
    staff_briefed_on_interview_rights: bool,
    legal_counsel_identified: bool,
    record_verification_procedure_exists: bool,
    former_employee_risk_assessed: bool,
    gdpr_interview_records_procedure_exists: bool
) -> dict:
    """Pre-investigation Art.92 readiness assessment."""
    gaps = []
    if not staff_briefed_on_interview_rights:
        gaps.append("Staff not briefed on Art.92(3) rights: legal counsel, voluntary/compulsory notice")
    if not legal_counsel_identified:
        gaps.append("No EU AI Act legal counsel identified for rapid engagement on compulsory requests")
    if not record_verification_procedure_exists:
        gaps.append("No procedure for reviewing and correcting Art.92(5) interview records")
    if not former_employee_risk_assessed:
        gaps.append("Former employees with relevant knowledge not assessed for interview risk")
    if not gdpr_interview_records_procedure_exists:
        gaps.append("No GDPR procedure for handling personal data in received interview records")
    return {
        "ready": len(gaps) == 0,
        "gaps": gaps,
        "risk_level": "HIGH" if len(gaps) >= 3 else "MEDIUM" if len(gaps) >= 1 else "LOW"
    }

Interview Preparation: What Organisations Should Do Before Any Interview Happens

The time to prepare for an Art.92 interview is not when the AI Office calls — it is now, as part of routine AI Act compliance maintenance.

For the organisation:

1. Identify all personnel with direct knowledge of GPAI model training, evaluation, and deployment decisions. These are the individuals most likely to be approached for voluntary interviews or named in compulsory requests.

2. Map the enforcement file risk: for each major compliance decision made in the past three years (training data selection, capability evaluation methodology, systemic risk assessment approach), identify who made the decision and what documentation exists. If an Art.92 interview would cover this decision, what would the interviewee say, and does that align with the written record?

3. Establish legal counsel protocols. On receipt of any Art.92 communication — whether it signals a voluntary request or a formal compulsory request — the organisation should have a defined escalation path: legal counsel notified within 24 hours, no response to the AI Office without legal review.

4. Brief staff on their Art.92 rights. Engineers and compliance personnel should know: the difference between voluntary and compulsory, the right to legal counsel from the outset, the Art.92(4) self-incrimination protection (and its limits), and the Art.99 penalty for false or misleading answers.

For individual employees:

1. Understand that the Art.92(4) privilege protects you personally from criminal exposure — it does not protect the organisation. If your honest answer would expose you to criminal liability, you may decline that specific question. But declining all questions in a compulsory interview is not an option.

2. Request legal counsel before any interview, voluntary or compulsory. This is an explicit right under Art.92(3). The AI Office cannot conduct an interview without first disclosing whether it is voluntary or compulsory and confirming your right to counsel.

3. Review the interview record under Art.92(5) carefully. The record is the document that enters the enforcement file. Corrections submitted promptly and in good faith are legitimate — silence on an inaccurate record is not.

The 30-Item Art.92 Interview-Readiness Checklist

Phase 1 — Ongoing Pre-Investigation Preparedness (Items 1–10)

1. All personnel with GPAI training/evaluation knowledge identified and mapped
2. Legal counsel retained with EU AI Act enforcement experience
3. Legal counsel escalation protocol documented (≤24h from any AI Office contact)
4. Staff briefing on Art.92 rights completed (voluntary/compulsory distinction, counsel right, self-incrimination protection)
5. Former employee risk assessment completed (who left with relevant knowledge in last 3 years?)
6. Third-party evaluator/contractor knowledge map created
7. Interview response coordination procedure documented (who approves what an employee may say?)
8. GDPR procedure for handling interview records as personal data established
9. Enforcement file alignment check: do interview responses align with written documentation?
10. Infrastructure jurisdiction assessment: are relevant technical staff in EU or subject to conflicting US legal obligations?

Phase 2 — On Receipt of Interview Request (Items 11–20)

1. Legal counsel notified within 24 hours of any AI Office interview contact
2. Request type confirmed: voluntary (Art.92(1)) or compulsory (Art.92(2))
3. Interviewee type confirmed: natural person or legal person representative
4. For compulsory requests: response deadline noted and calendared
5. For natural persons: Art.92(4) self-incrimination assessment completed with counsel
6. Subject matter of investigation mapped against internal documentation
7. Inconsistencies between proposed interview responses and written records identified
8. Former employees with relevant knowledge assessed for independent interview risk
9. For voluntary interviews: cooperation vs. privilege trade-off assessed with counsel
10. AI Office confirmation obtained that Art.92(3) disclosures (legal basis, purpose, voluntary/compulsory) have been provided

Phase 3 — During and After Interview (Items 21–30)

1. Legal counsel present or available during interview
2. Art.92(4) privilege invocations documented with specific questions and stated reasons
3. Interview record received under Art.92(5) within agreed timeframe
4. Record reviewed against interviewer notes within 5 business days of receipt
5. Corrections submitted in writing to AI Office within verification period
6. Corrected record confirmed received by AI Office
7. Interview record copy stored securely under GDPR-compliant retention policy
8. GDPR access request procedure established for interviewee's own records
9. Art.89 right to be heard assessment: does interview record change adverse measure risk?
10. Post-interview enforcement posture update: has interview changed the investigation's likely trajectory?

Art.92 in the Wider Enforcement Architecture

Understanding where Art.92 sits in enforcement proceedings helps organisations anticipate how interview evidence will be used:

The strategic insight: cooperation in Art.92 interviews — when combined with strong documentary compliance under Art.90 and inspection readiness under Art.91 — creates a consistent enforcement posture that Art.99 explicitly recognises as a penalty-mitigating factor. The organisation that is unreachable, evasive, or inconsistent across documentary, inspection, and interview evidence presents a different risk profile than one that engages consistently and transparently.

Infrastructure Jurisdiction and Interview Risk

The intersection of Art.92 with infrastructure jurisdiction is indirect but real. The AI Office's authority to interview extends to all persons within the scope of the AI Act's territorial application — but the practical enforcement mechanisms differ depending on where those persons are located.

For an EU-based GPAI provider operating entirely on EU infrastructure, with EU-based technical staff:

• All Art.92 requests operate under a single legal framework (EU administrative law)
• No jurisdictional conflicts with extraterritorial US law
• The investigation and enforcement chain is predictable and navigable

For a GPAI provider with US-based technical infrastructure and US-based engineering staff:

• EU enforcement authority exists (the organisation is subject to the AI Act)
• US persons may face conflicting legal obligations depending on investigation subject matter
• Cloud infrastructure jurisdiction conflicts compound the interview jurisdiction question

Hosting technical operations on EU-sovereign infrastructure does not eliminate Art.92 exposure — the AI Office can still interview your staff. But it eliminates the jurisdictional overlay that makes interview preparation more complex when technical evidence lives on US cloud providers and technical staff are US persons.

Art.92 interview powers are the person-centric complement to Art.90 document requests and Art.91 inspection authority. The 30-item checklist covers the three operational phases: baseline readiness, request receipt, and post-interview record management. For infrastructure that keeps enforcement risk under a single legal order: sota.io