EU AI Act Art.94: AI Office Commitments and Settlement Decisions for GPAI — Developer Guide (2026)

Art.90 requests documents. Art.91 inspects premises. Art.92 interviews staff. Art.93 issues emergency orders. Art.94 lets you close the investigation before any of that concludes.

Article 94 is the final provision in the Chapter VII enforcement architecture — and structurally, it is the most significant one for GPAI providers who engage early. While Art.90–93 describe escalating AI Office powers, Art.94 describes provider power: the right to offer binding commitments during an investigation and to have those commitments accepted in lieu of a formal infringement finding.

For providers with good compliance posture who find themselves under investigation, Art.94 represents the optimal enforcement resolution pathway. No formal finding of infringement. No Art.99 penalty. No General Court proceedings. Instead: a binding commitment decision, a compliance programme on provider-negotiated terms, and the enhanced regulatory relationship that comes from cooperative enforcement resolution.

The catch is timing and content. Art.94 is only available during an ongoing investigation. Commitments offered too late — or too vague — will be rejected. Understanding the window, the content requirements, and the monitoring obligations that follow is what separates providers who successfully use Art.94 from those who proceed to Art.93.

What Article 94 Actually Says

Article 94 establishes the commitment mechanism, the AI Office's acceptance discretion, the binding effect of accepted commitments, and the consequences of non-compliance.

Article 94(1) — Provider Right to Offer Commitments:

Where, during proceedings pursuant to this Chapter, a provider of a general-purpose AI model with systemic risk offers commitments to ensure compliance with this Regulation, the AI Office may, by decision, make those commitments binding on the provider and declare that there are no further grounds for action.

Three conditions trigger Art.94(1) availability:

1. Active Chapter VII proceedings: Art.94 is available only during ongoing proceedings under Art.90, 91, or 92 — not before investigation begins, not after a formal infringement finding.
2. Systemic risk designation: The GPAI model must carry systemic risk designation under Art.51 — Art.94 is a Chapter VII provision applicable only to the GPAI enforcement pathway.
3. Provider initiative: The provider must offer the commitments — the AI Office cannot impose Art.94 commitments unilaterally. This distinguishes Art.94 from Art.93 and is the source of the provider's strategic leverage.

The AI Office retains full discretion. "May" in Art.94(1) is not "shall" — the AI Office can reject commitments that are insufficient, unverifiable, or that it concludes would not adequately address the investigation subject matter. This discretion means commitment design is as important as commitment timing.

Article 94(2) — Monitoring and Compliance Obligations:

The decision referred to in paragraph 1 shall set out the modalities for monitoring compliance by the provider with the commitments and the obligations flowing from them.

Art.94(2) makes monitoring mandatory in every commitment decision. The decision must specify:

• How compliance with each commitment will be monitored
• What documentation the provider must produce
• The monitoring timeline and review intervals
• The reporting obligations to the AI Office
• The consequences of identified non-compliance

This creates a compliance programme framework that is more structured than the underlying investigation but less adversarial than a formal infringement proceeding. The provider is effectively agreeing to an ongoing supervised compliance relationship with the AI Office.

Article 94(3) — Revocation on Material Changed Circumstances:

Where the AI Office finds that the provider of a general-purpose AI model with systemic risk has failed to comply with the commitments given, or that the decision referred to in paragraph 1 was based on incomplete, incorrect or misleading information provided by the provider, the AI Office may reopen the proceedings.

Revocation triggers:

1. Non-compliance with commitments: If the provider fails to implement the committed measures, the AI Office can reopen proceedings — returning to the investigation posture where Art.90–93 tools are available again.
2. Material incorrect information: If the AI Office discovers that the commitment decision was based on incomplete, incorrect, or misleading information from the provider, it can reopen proceedings regardless of whether the provider has technically complied with the formal commitment terms.
3. Reopened proceedings: Reopening under Art.94(3) means the investigation restarts from where it left off — the prior Art.90–93 activity remains on record, and the AI Office can proceed immediately to Art.93 interim measures if urgency conditions are now met.

The Art.94 Commitment Framework: What Must Be Offered

The text of Art.94 does not enumerate required commitment content, but the acceptance test — that commitments "ensure compliance with this Regulation" — and the monitoring framework in Art.94(2) constrain what the AI Office can accept. Effective Art.94 commitments address the specific investigation subject matter with verifiable, time-bound, monitoring-compatible obligations.

Capability-Based Commitments (addressing Art.51 systemic risk profile):

Commitments addressing the model's systemic risk capabilities are the most directly responsive to the investigation trigger. These typically include:

• Implementation of specific capability limitations with technical specificity (not "we will reduce CBRN capability" but "we will implement output filters that reject queries in categories X, Y, Z within 90 days, verified by [specific test protocol]")
• Mandatory capability evaluation cycles (red-teaming schedules, third-party assessment, AI Office notification of results)
• Pre-deployment systemic risk assessment obligations for new capability releases
• Capability access controls for high-risk application categories

Documentation Commitments (addressing Art.53/Annex XI/XII gaps):

Where the investigation was triggered by or surfaced documentation deficiencies:

• Completion of Annex XI technical documentation within specific timelines
• Annex XII transparency reporting updates
• Model card maintenance obligations with version-specific requirements
• AI Office notification when documentation is updated

Incident Reporting Commitments (addressing Art.73 gap):

Where the investigation identified gaps in serious incident reporting:

• Enhanced Art.73 incident reporting procedures
• Lower thresholds than statutory minimum for AI Office notification
• Post-incident root cause analysis obligations
• Downstream deployer notification requirements

Governance Commitments (addressing oversight framework):

• Appointment of a designated GPAI compliance officer with AI Office reporting obligations
• Internal audit programme with results available to AI Office
• Board-level accountability mechanisms for systemic risk management
• Third-party auditor appointment for specific capability evaluations

Infrastructure Commitments (addressing CLOUD Act / jurisdiction risks):

Where the investigation surfaced infrastructure jurisdiction concerns:

• Migration of specific data categories to EU-sovereign infrastructure within defined timelines
• Implementation of access controls preventing non-EU person access to specific model components
• Legal structure commitments (EU-based legal entity for model operations, local law requirements for data access)

The Art.94 vs Art.93 Strategic Choice Matrix

The relationship between Art.93 and Art.94 is the operational core of Chapter VII enforcement strategy. They are not sequential — a provider cannot exhaust Art.93 and then offer Art.94 commitments. They are alternatives, and the window for Art.94 closes when Art.93 conditions are met.

The strategic implication is that Art.94 is superior to Art.93 from a provider perspective in almost every dimension — if it is available. The condition is timing. Art.94 requires "ongoing proceedings" — it is not available before the AI Office opens an investigation (though pre-investigation voluntary compliance may reduce investigation probability), and it is not available after proceedings conclude with a formal finding.

The Art.94 window is the period between Art.90 investigation opening and Art.93 interim measure issuance or formal infringement decision. The optimal moment to offer Art.94 commitments is after sufficient Art.90/91/92 activity has identified the specific investigation concerns (so commitments can be precisely targeted) but before the AI Office concludes that Art.93 urgency conditions are met.

Timing the Art.94 Offer: Investigation Phase Analysis

Understanding the investigation lifecycle helps identify the optimal Art.94 commitment window.

Phase 1 — Art.90 Information Request (First 30-60 days): This is typically too early for Art.94. The AI Office is still building its factual record. Commitments offered before the investigation subject matter is defined risk being too broad (accepting obligations beyond what the investigation concerns) or too narrow (missing the AI Office's actual concerns). Exception: if the Art.90 request makes the investigation focus entirely clear, early Art.94 offers demonstrate exceptional cooperation and may be accepted.

Phase 2 — Art.91 Inspection and Art.92 Interview (30-120 days): This is the primary Art.94 window for most providers. The AI Office has identified specific concerns. The provider has produced documentation. The investigation subject matter is defined enough to draft targeted commitments. Crucially, the AI Office has not yet concluded that Art.93 urgency conditions are met — which means the cooperative resolution pathway is still open.

Phase 3 — AI Office Evaluation (Post-inspection, Pre-decision): This is the final Art.94 window. The AI Office is evaluating whether to proceed to formal findings or interim measures. An Art.94 offer at this stage is high-pressure and may receive less favorable treatment — but it remains available. Providers who reach this stage without offering commitments are likely facing Art.93 or formal proceedings.

Phase 4 — Post-Art.93 (Closed to Art.94): Once Art.93 interim measures are issued, the proceedings have concluded in the AI Office's favour. Art.94 commitments cannot substitute for an existing Art.93 order — though they remain available in any subsequent proceedings opened under Art.93(4).

What the AI Office Evaluates When Deciding to Accept

The AI Office's acceptance discretion under Art.94(1) is not unlimited. The legal standard — commitments that "ensure compliance with this Regulation" — creates an implicit sufficiency test. In practice, the AI Office's evaluation considers:

Specificity: Generic commitments ("we will improve our compliance programme") are not sufficient. The AI Office requires specific, verifiable, time-bound obligations. "We will implement capability evaluation protocol [X] on a 90-day cycle, with results delivered to the AI Office within 14 days of completion" is specific. "We will enhance our evaluation processes" is not.

Verifiability: Every commitment must have a monitoring mechanism. Commitments that cannot be independently verified will not be accepted under Art.94(2)'s mandatory monitoring framework.

Proportionality to investigation subject: Commitments must address the specific investigation concerns. An investigation triggered by CBRN capability concerns requires CBRN-specific commitments — broad governance commitments that do not directly address the identified risk will be insufficient.

Timeliness of implementation: The AI Office assesses whether the compliance gap can be closed within reasonable timelines. Commitments to complete Annex XI documentation within 6 months may be acceptable; commitments to "substantially improve" documentation within 5 years are not.

Provider's compliance track record: A provider with a history of regulatory cooperation (code of practice participation, proactive AI Office engagement, timely Art.90 responses) is more likely to have Art.94 commitments accepted than one whose investigation was triggered by non-cooperation.

Art.94 and the Code of Practice Framework

The relationship between Art.94 commitments and GPAI codes of practice under Art.56 deserves specific attention. Codes of practice represent the standard compliance pathway for GPAI systemic risk providers. Art.94 commitments are the enforcement resolution pathway when standard compliance has been insufficient.

A provider already participating in a code of practice that offers Art.94 commitments has a structural advantage: the commitment content can reference the code of practice's specific obligations, demonstrating that the investigation concerns are being addressed within an existing, AI-Office-approved compliance framework.

Commitments structured as "enhanced implementation of Code of Practice Section X obligations, with accelerated timeline Y and additional monitoring mechanism Z" are more likely to be accepted than commitments that operate entirely outside the code framework. The code of practice provides the substantive compliance reference; the Art.94 commitment provides the binding enforcement mechanism.

CLOUD Act Intersection with Art.94 Commitments

For GPAI providers whose model infrastructure operates on US cloud providers (AWS, Azure, GCP), Art.94 commitments interact with CLOUD Act jurisdiction risk in two important ways.

Commitment credibility: An Art.94 commitment to keep specific data categories in EU-sovereign infrastructure is significantly more credible — and more difficult to challenge — if the provider can demonstrate that migration to EU-sovereign infrastructure is already underway or completed. Commitments to make future infrastructure changes may be accepted but will face higher scrutiny than commitments reflecting existing facts.

Monitoring access: Art.94(2) requires monitoring mechanisms. For providers on US cloud infrastructure, the monitoring mechanism may require the AI Office to access specific technical documentation or systems to verify compliance. A CLOUD Act request from US law enforcement to produce data stored in Europe — while the provider is simultaneously demonstrating EU compliance under Art.94 monitoring — creates the precise jurisdictional conflict that Art.94 commitments on EU-sovereign infrastructure are designed to prevent.

Providers operating EU-sovereign infrastructure eliminate this conflict: the Art.94 commitment monitoring programme operates entirely within EU jurisdiction, with no CLOUD Act exposure for the monitored data.

Python Tooling for Art.94 Compliance

from dataclasses import dataclass, field
from datetime import datetime, timedelta
from typing import Optional
from enum import Enum

class CommitmentStatus(Enum):
    DRAFT = "draft"
    OFFERED = "offered"
    ACCEPTED = "accepted"
    MONITORING = "monitoring"
    FULFILLED = "fulfilled"
    REVOKED = "revoked"

@dataclass
class Art94Commitment:
    """
    Tracks a single Art.94 commitment offered to the AI Office.
    """
    commitment_id: str
    description: str
    investigation_reference: str  # Art.90/91/92 proceeding ID
    offered_date: datetime
    acceptance_date: Optional[datetime] = None
    deadline: Optional[datetime] = None
    monitoring_mechanism: str = ""
    status: CommitmentStatus = CommitmentStatus.DRAFT
    verification_evidence: list[str] = field(default_factory=list)

    def days_until_deadline(self) -> Optional[int]:
        if not self.deadline:
            return None
        delta = self.deadline - datetime.now()
        return max(0, delta.days)

    def is_overdue(self) -> bool:
        if not self.deadline:
            return False
        return datetime.now() > self.deadline and self.status == CommitmentStatus.MONITORING

    def compliance_summary(self) -> dict:
        return {
            "id": self.commitment_id,
            "status": self.status.value,
            "days_remaining": self.days_until_deadline(),
            "overdue": self.is_overdue(),
            "evidence_count": len(self.verification_evidence),
            "monitoring_mechanism": bool(self.monitoring_mechanism),
        }


@dataclass
class Art94CommitmentPackage:
    """
    Manages the full set of Art.94 commitments offered in a single proceeding.
    Art.94(1): provider offers commitments → AI Office may accept by decision.
    Art.94(2): decision sets out monitoring modalities.
    Art.94(3): non-compliance or incorrect information triggers reopening.
    """
    package_id: str
    model_name: str  # Must be Art.51 systemic risk designated
    proceeding_type: str  # "art90" | "art91" | "art92"
    offer_date: datetime
    commitments: list[Art94Commitment] = field(default_factory=list)
    ai_office_acceptance: Optional[datetime] = None
    monitoring_start: Optional[datetime] = None
    next_monitoring_report: Optional[datetime] = None

    def add_commitment(self, commitment: Art94Commitment):
        self.commitments.append(commitment)

    def all_fulfilled(self) -> bool:
        return all(c.status == CommitmentStatus.FULFILLED for c in self.commitments)

    def any_overdue(self) -> bool:
        return any(c.is_overdue() for c in self.commitments)

    def any_revoked(self) -> bool:
        return any(c.status == CommitmentStatus.REVOKED for c in self.commitments)

    def package_status(self) -> str:
        if self.any_revoked():
            return "REVOKED — Art.94(3) reopening risk"
        if self.any_overdue():
            return "OVERDUE — immediate remediation required"
        if self.all_fulfilled():
            return "FULFILLED — proceedings closed"
        if self.ai_office_acceptance:
            return "MONITORING — active compliance programme"
        return "PENDING — awaiting AI Office acceptance"

    def monitoring_report_due(self) -> bool:
        if not self.next_monitoring_report:
            return False
        return datetime.now() >= self.next_monitoring_report

    def revocation_risk_assessment(self) -> dict:
        """Art.94(3): assesses risk of proceedings being reopened."""
        overdue_count = sum(1 for c in self.commitments if c.is_overdue())
        unverified_count = sum(
            1 for c in self.commitments
            if c.status == CommitmentStatus.MONITORING
            and not c.verification_evidence
        )
        return {
            "overdue_commitments": overdue_count,
            "unverified_commitments": unverified_count,
            "revocation_risk": "HIGH" if overdue_count > 0 else "MEDIUM" if unverified_count > 0 else "LOW",
            "immediate_action_required": overdue_count > 0,
        }


def assess_art94_readiness(
    investigation_phase: str,
    systemic_risk_designated: bool,
    has_identified_concerns: bool,
    art93_issued: bool,
    formal_finding_issued: bool
) -> dict:
    """
    Evaluates whether Art.94 commitment offer is appropriate.

    Args:
        investigation_phase: "pre_investigation" | "art90" | "art91_art92" | "evaluation" | "concluded"
        systemic_risk_designated: model has Art.51 designation
        has_identified_concerns: AI Office has expressed specific concerns
        art93_issued: Art.93 interim measure already issued
        formal_finding_issued: formal infringement finding already made

    Returns:
        readiness assessment with recommendation
    """
    if not systemic_risk_designated:
        return {
            "available": False,
            "reason": "Art.94 only applies to Art.51 systemic risk designated GPAI models",
            "action": "Art.94 not applicable — check Art.95 voluntary code or Art.53 standard compliance"
        }

    if art93_issued or formal_finding_issued:
        return {
            "available": False,
            "reason": "Art.94 window closed — proceedings concluded with Art.93 order or formal finding",
            "action": "Focus on Art.93 compliance and Art.93(4) General Court appeal if justified"
        }

    if investigation_phase == "pre_investigation":
        return {
            "available": False,
            "reason": "Art.94 requires active proceedings under Art.90/91/92",
            "action": "Maintain compliance to prevent investigation opening; consider Art.56 code of practice participation"
        }

    if investigation_phase == "art90" and not has_identified_concerns:
        return {
            "available": True,
            "recommended": False,
            "reason": "Art.94 is available but premature — investigation subject matter not yet defined",
            "action": "Respond fully to Art.90 requests; monitor for subject matter clarity before drafting commitments"
        }

    if investigation_phase in ("art90", "art91_art92") and has_identified_concerns:
        return {
            "available": True,
            "recommended": True,
            "reason": "Optimal Art.94 window — investigation concerns identified, Art.93 not yet triggered",
            "action": "Draft targeted commitments addressing specific AI Office concerns; offer within 14 days",
            "priority": "HIGH"
        }

    if investigation_phase == "evaluation":
        return {
            "available": True,
            "recommended": True,
            "reason": "Last Art.94 window — AI Office evaluating Art.93 vs formal finding",
            "action": "Submit Art.94 commitments immediately with maximum specificity and rapid implementation timelines",
            "priority": "URGENT"
        }

    return {
        "available": False,
        "reason": f"Art.94 not available at investigation phase: {investigation_phase}",
        "action": "Consult legal counsel on current enforcement position"
    }

Art.94 Commitment Quality Self-Assessment

Before submitting Art.94 commitments, apply this sufficiency test to each commitment:

Art.94 Violations and the Art.94(3) Reopening Framework

The most significant risk in an accepted Art.94 commitment package is not the commitment content — it is the post-acceptance compliance programme. Art.94(3) creates a revocation mechanism that is structurally different from standard enforcement: the AI Office does not need to establish a new infringement. It only needs to establish that the provider failed to comply with its own committed obligations.

This creates a simpler enforcement path than proving an underlying Regulation violation. An AI Office that accepted Art.94 commitments and later found non-compliance can reopen proceedings with a factual record that is easier to establish than the original investigation. The "incomplete, incorrect or misleading information" ground is even broader — it allows reopening based on a finding that the commitment decision was induced by misrepresentation, regardless of whether the specific committed obligations have been technically met.

Practical implications for commitment compliance management:

1. Monitor every commitment: Each commitment needs a compliance owner with explicit responsibility for evidence collection and deadline tracking.
2. Report proactively: Art.94(2) monitoring obligations should be met before deadlines, not on deadline. Proactive reporting signals the cooperative posture that made Art.94 available.
3. Flag implementation difficulties immediately: If a committed obligation encounters implementation obstacles, notify the AI Office before the deadline. Proactive disclosure of implementation challenges is treated differently from missed deadlines discovered during monitoring.
4. Maintain accurate records: The "misleading information" ground in Art.94(3) means that representations made in the commitment offer — about current compliance status, implementation feasibility, technical capabilities — must be verifiable and accurate.

The Chapter VII Enforcement Architecture: Where Art.94 Fits

Articles 89–94 form a complete enforcement system with explicit procedural connections:

• Art.89 (Right to be heard) — procedural foundation for all adverse measures
• Art.90 (Information requests) — investigation opening, document production
• Art.91 (Inspections) — on-site investigation, infrastructure access
• Art.92 (Interviews) — witness and expert interviews
• Art.93 (Interim measures) — emergency unilateral orders for imminent risk
• Art.94 (Commitments) — cooperative resolution, provider-initiated settlement

Art.94 is the only provision in this sequence that is initiated by the provider rather than the AI Office. It is also the only provision that results in a decision without a formal infringement finding. This structural uniqueness — provider initiative, no formal finding, cooperative posture signal — makes it the optimal outcome for providers who identify investigation risk early and engage proactively.

The providers most likely to successfully use Art.94 share a profile: Art.51 systemic risk designation acknowledged (not contested), code of practice participation, complete Annex XI/XII documentation, proactive Art.90 response, and early Art.94 commitment offer before the investigation reaches the Art.93 urgency threshold.

The providers least likely to have Art.94 commitments accepted share the opposite profile: contested systemic risk designation, no code of practice participation, documentation gaps identified in Art.90 requests, non-cooperative investigation posture, and late-stage commitment offers after the AI Office has already concluded Art.93 conditions are approaching.

30-Item Art.94 Commitment Readiness Checklist

Phase 1: Pre-Investigation Preparation (Items 1–10)

1. Systemic risk designation confirmed — Art.51 designation status known; if designated, Art.94 availability established
2. Code of practice participation — actively participating in AI Office code of practice process; commitment content aligned with code obligations
3. Annex XI documentation complete — technical documentation for model architecture, training data, capability evaluation results ready
4. Annex XII transparency report current — model card / system card up to date with capability profile
5. Art.73 incident reporting current — no outstanding serious incidents requiring notification
6. Capability evaluation programme active — regular red-teaming, CBRN assessment, cybersecurity evaluation on schedule
7. EU-sovereign infrastructure — identify which model components and training data are on EU-sovereign infrastructure vs US cloud
8. Legal entity structure — EU-based legal entity for model operations identified; response chain to AI Office established
9. Compliance officer designated — specific named individual with AI Office contact responsibility
10. Commitment template library — pre-drafted commitment types for likely investigation scenarios (capability restriction, documentation, governance)

Phase 2: During Investigation (Items 11–20)

1. Art.90 response fully complete — all requested documents produced within deadline; no outstanding requests
2. Investigation subject matter identified — specific AI Office concerns articulated in Art.90 requests or Art.91 inspection findings
3. Commitment drafting initiated — targeted commitments addressing identified concerns being drafted by internal team
4. Legal counsel briefed — external EU regulatory counsel engaged on Art.94 commitment strategy
5. Commitment specificity verified — each proposed commitment passes the specificity test (who, what, by when, how verified)
6. Monitoring mechanism defined — each commitment has explicit monitoring mechanism acceptable under Art.94(2)
7. Implementation feasibility confirmed — technical team has confirmed each commitment can be implemented within proposed timeline
8. Infrastructure commitment verified — any commitments involving infrastructure migration are technically feasible within stated timeline
9. No misleading representations — all factual claims in commitment offer verified against current system state
10. Optimal timing assessed — commitment offer timed to Phase 2 (Art.91/92) or early Phase 3 (evaluation) window

Phase 3: Post-Acceptance Compliance (Items 21–30)

1. Commitment owner assigned — each commitment has a named owner responsible for implementation and evidence collection
2. Implementation timeline tracked — project management tooling tracking each commitment deadline
3. Evidence collection system — systematic collection of implementation evidence for each commitment
4. Monitoring report template — Art.94(2) monitoring report format agreed with AI Office; templates prepared
5. Proactive disclosure protocol — internal escalation process for flagging implementation difficulties before deadline
6. Third-party auditor engaged — where commitments require third-party verification, auditor appointed and access confirmed
7. AI Office reporting calendar — all monitoring report deadlines in calendar with 14-day preparation lead time
8. Material change protocol — process for notifying AI Office of material changes to committed systems or infrastructure
9. Commitment modification request process — understood mechanism for requesting commitment modification if circumstances change materially
10. Fulfilment confirmation process — process for confirming full commitment fulfilment to AI Office and receiving formal closure of proceedings

EU AI Act Article 94 is the cooperative exit from Chapter VII enforcement. The Art.89–93 provisions describe what the AI Office can do; Art.94 describes what the provider can do. For GPAI providers who engage early and maintain complete documentation, Art.94 commitments offer the most favourable enforcement resolution available in the EU AI Act's GPAI oversight framework.

On EU-sovereign infrastructure, Art.94 compliance programmes gain a structural advantage: monitoring obligations, implementation verification, and AI Office access all operate within a single legal jurisdiction — eliminating the CLOUD Act conflict that creates jurisdictional uncertainty for providers operating on US cloud infrastructure. This is not a theoretical risk mitigation: it is the difference between a monitoring programme that the AI Office can verify and one that depends on the cooperation of US infrastructure providers who may face conflicting legal obligations.