Skip to content
NewsRegulation

EU AI Act enforcement powers over GPAI model providers take effect August 2

· by Pondero Newsdesk

The short version

The European Commission gains authority on August 2, 2026 to issue fines of up to 3% of global annual turnover against AI model providers that fail to meet EU AI Act obligations, with no grace period for models released since last August.

EU AI Act enforcement powers over GPAI model providers take effect August 2

The substantive GPAI obligations under the EU AI Act have existed in law since August 2025. As of August 2, 2026, they carry teeth: the European Commission's AI Office gains authority to issue fines, restrict models from the EU market, compel providers to hand over technical documentation, and run its own evaluations of models without provider cooperation.

What

Per the European Commission's regulatory framework page, the enforcement and penalty powers over general-purpose AI (GPAI) model providers enter into application on August 2, 2026, exactly one year after the substantive obligations took effect. The AI Office, operating within the Commission, is the exclusive competent authority for GPAI models across all EU member states. From August 2, it can request technical documentation under Article 91, evaluate models directly under Article 92, demand risk-mitigation measures under Article 93, and restrict or withdraw a model from the EU market.

Maximum fines for GPAI documentation and transparency violations sit at 3% of global annual turnover or EUR 15 million, whichever is higher, per Article 101 of the AI Act. For a frontier lab generating billions in annual revenue, 3% of global turnover greatly exceeds EUR 15 million. The percentage clause drives exposure for large providers; EUR 15 million serves as a floor only for smaller ones. A separate and higher ceiling (EUR 35 million / 7% of turnover) applies to prohibited AI practices under Article 99 and does not overlap with GPAI failures.

Two compliance deadlines run in parallel, per ComplianceHub.Wiki. Models placed on the EU market on or after August 2, 2025 must comply with GPAI obligations immediately. Models placed on the market before August 2, 2025 have until August 2, 2027.

The GPAI Code of Practice, finalized July 10, 2025, covers three chapters: Transparency, Copyright, and Safety & Security. Providers that signed it receive a presumption of conformity with the matching obligations. Anthropic, Google, Microsoft, OpenAI, Mistral AI, Amazon, IBM, and Cohere signed the full Code, per the Commission's Code of Practice signatories page. xAI signed only the Safety & Security chapter. Meta declined to sign, citing legal uncertainty, and must demonstrate compliance through its own documentation. Each EU member state is also required to have at least one national AI regulatory sandbox in operation by August 2.

Why it matters

Teams that deploy AI agents or applications touching EU users now carry indirect exposure to their model provider's compliance posture. If the AI Office restricts or withdraws a model, downstream services built on it face disruption. That risk is not theoretical: market-restriction and withdrawal powers are part of what activates on August 2.

Non-signatories face higher scrutiny. Without the Code's presumption of conformity, Meta and xAI (on the Transparency and Copyright chapters) must prove compliance through their own documentation and explain their approach to the AI Office on demand. For enterprises buying AI API access, that asymmetry is now a procurement question rather than a regulatory abstraction.

The EU's Digital Omnibus agreement (May 2026) delayed several high-risk AI system deadlines, pushing some Annex III obligations to December 2027. That reprieve did not touch GPAI. August 2, 2026 held as scheduled.

What to watch next

The first signal of how aggressively the AI Office moves will come from whether it opens formal proceedings against any non-Code-of-Practice signatories before year-end. Meta's situation is the most structurally unusual: as a primary open-weight GPAI provider, it cannot easily recall or restrict post-release model versions, which complicates any market-restriction remedy the Commission might attempt. Commission guidelines for classifying high-risk AI systems are due by year-end and will shape the next enforcement wave covering applications built on top of GPAI models.

Sources