Who writes the rules for AI in Europe
The Commission is the executive power of the European Union - it proposes laws, but doesn't vote on them alone. A proposal passes through the European Parliament and the representatives of the 27 member states before it becomes binding on everyone. For the AI Act that road has already been walked, and the law is rolling out in stages: some of the bans have applied since last year, the fines kick in this year. A slow machine. But once it's moving, it's hard to stop.
The AI Office is the new unit created precisely because of this law. It's not some agency far away - it sits inside the Commission and has one job: to watch the models that can do harm at scale. Companies whose models cross a certain power threshold are required to come forward themselves and declare what they've built. The AI Office receives the documentation, reviews it, can ask for explanations. Starting this autumn, it also gets the power to fine.
GPAI sounds like a dry abbreviation, but behind it stands the thing you already use every day. These are models trained to do many different tasks, not just one - write, translate, comment on code, answer questions. ChatGPT is such a model. Claude is such a model. Fall into this category, and you owe transparency: a summary of what data was used for training, proof you haven't crossed copyright lines, readiness to share information with the oversight body and with the companies building products on top of you.
There's only one thing the law shuts completely, with no loophole for a business model or an exception for "innovation". A system that tracks people's behavior over time and slaps a score on them, later used against them in a completely different context - is banned. Not restricted, not regulated with forms. Banned. Credit scoring stays outside the scope, because it works with verifiable financial data, not general "behavior".
No fluff
There's no body sitting around the clock in front of every model's screen, counting tokens. The AI Office relies on the companies themselves to raise their hand and honestly say how powerful what they built is - and the history of tech giants isn't exactly a history of voluntary transparency. The mechanism works only because lying gets expensive: a fine of up to 15 million euros or 3% of global revenue, whichever is greater. For a company with billions in revenue, that's a serious sum, not a footnote.
The ban on social scoring is the most honest moment in the whole law, because it doesn't hedge. It doesn't ask "under what conditions", doesn't leave a loophole for "legitimate interest". It simply says: this isn't done in Europe. The rest - documentation, declarations, codes of good practice - is bureaucracy that works slowly and with friction. Social scoring is the line even bureaucracy won't negotiate past.