Article 92 of Regulation (EU) 2024/1689 — Power to conduct evaluations. Official text, practical interpretation, key obligations and compliance implications.
Article 92 lets the Commission stop reading and start testing: where paperwork is not enough, the AI Office can evaluate a general-purpose AI model directly — including with model access and independent experts.
Official Text Summary
The Commission may conduct evaluations of a general-purpose AI model to assess the provider's compliance where the information gathered under Article 91 is insufficient, or to investigate systemic risks at Union level — in particular following a qualified alert from the scientific panel under Article 90. The Commission may appoint independent experts, including from the scientific panel, to carry out evaluations on its behalf, and may request access to the model through APIs or other appropriate technical means and tools, including source code. Access requests respect protective conditions for trade secrets; and it is the finding of a serious and substantiated concern here that unlocks the Article 93 power to request measures.
Key Obligations
- The Commission may evaluate a GPAI model where the Article 91 information is insufficient, or following a qualified alert from the scientific panel under Article 90
- Evaluations may involve independent experts, including from the scientific panel
- The Commission may request access to the model through APIs or other appropriate technical means, including source code; a serious and substantiated concern found here is the express precondition for measures under Article 93
Compliance Timeline
Applies from 2 August 2026; the 2026 Digital Omnibus deferred the substantive high-risk obligations (Annex III to 2 December 2027, Annex I to 2 August 2028) but did not move this provision.
Official AI Act Compliance Deadline Calendar
Updated · Sources: Regulation (EU) 2024/1689 and the 2026 Digital Omnibus on AI.
| Obligation | Applies to | Original date | New date | Status | Countdown | Legal basis |
|---|---|---|---|---|---|---|
| Prohibited Practices (Art. 5) | All providers and deployers | active | — | AI Act Art. 5 | ||
| GPAI Rules (Chapter 5) | GPAI model providers | active | — | AI Act Art. 51-56 | ||
| Commission Enforcement Powers over GPAI | GPAI model providers | active | — | AI Act Art. 88-94, 101 | ||
| Transparency Obligations (Art. 50) | Providers and deployers of chatbots, generative, emotion recognition systems | active | — | AI Act Art. 50 | ||
| New Art. 5 Prohibition (CSAM / non-consensual intimate imagery) | Providers and deployers of generative AI systems | active | — | AI Omnibus 2026 Art. 5 | ||
| AI-Generated Content Marking (pre-existing systems) | Providers of generative AI systems on the market before 2 Aug 2026 | active | — | AI Act Art. 50(2) — transitional | ||
| Regulatory Sandboxes | National competent authorities | deferred | — | AI Omnibus 2026 Art. 57 | ||
| High-risk AI — Annex III (standalone) | Providers of standalone Annex III systems | deferred | — | AI Omnibus 2026 Art. 6(2) | ||
| High-risk AI — Annex I (embedded) | AI embedded in Annex I regulated products | deferred | — | AI Omnibus 2026 Art. 6(1) |
⬇ Download JSON · CC BY 4.0
AI Act meets DORA and NIS2
Is your organisation subject to both the AI Act and DORA? The two regulations intersect on the operational resilience of financial AI systems. Our sister site regulation-dora.eu covers DORA in depth — including what the AI Act adds on top of an existing DORA programme.
The AI Act for financial institutions ↗ Explore regulation-dora.eu ↗Frequently Asked Questions
Article 92(2) allows access requests through APIs or other appropriate technical means and tools, including source code, where necessary and proportionate for the evaluation. In practice, structured API access with evaluator tooling is the norm; source code is the deep end, subject to strict confidentiality under Article 78.
Assign a single technical counterpart, pre-stage the evidence (evaluation reports, adversarial-testing results, incident log), and negotiate the access modality early. The evaluation's factual record is what any later Article 93 request will be built on — accuracy at this stage is cheaper than advocacy later.
Stay ahead of AI Act changes
Get compliance alerts when deadlines or obligations change.
No spam. One-click unsubscribe.
Take compliance further with the AI Act Academy
Templates, training modules, and live Q&A — everything needed to implement AI Act compliance.