EU AI Act GPAI Enforcement Starts 2 August 2026: What Changes

From 2 August 2026, the European Commission, acting through the AI Office, can supervise and enforce the EU AI Act's rules for providers of general-purpose AI (GPAI) models. It can request documentation and information, run model evaluations, order corrective measures such as market restriction, recall or withdrawal, and impose fines of up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher. The obligations themselves have applied since 2 August 2025. What changed in August 2026 is the enforcement layer.

This is an educational overview, not legal advice. Check the Regulation and the Commission's guidance against your own facts.

What changed on 2 August 2026

The Chapter V obligations for GPAI model providers have applied since 2 August 2025. The Commission's supervision and enforcement powers against those providers only start on 2 August 2026, after a one-year adjustment period. According to the Future of Life Institute's explainer, providers of GPAI models released before 2 August 2025 must be compliant by 2 August 2027 (Enforcement of Chapter V under the EU AI Act).

The European Commission states that the AI Office enforces the rules for providers of GPAI models, including models that may pose systemic risks. It also covers AI systems developed by the same provider, or by a provider in the same business group, as the underlying GPAI model (European Commission, enforcement framework).

Which obligations depend on the model

A GPAI model is, in broad terms, a model trained on large amounts of data at scale that can perform many distinct tasks and be integrated into different AI systems. Obligations differ by licence and risk profile:

Model situation	Obligations described in the sources reviewed
Released under a free and open-source licence, no systemic risk	Copyright policy and training-content summary
Any GPAI model with systemic risk, including open-source models	Also model evaluations, risk assessment and mitigation, serious-incident recording and reporting, and an adequate level of cybersecurity

The open-source label therefore does not remove duties for models that present systemic risk. Whether a specific model meets the systemic-risk threshold is a classification question that should be documented rather than assumed.

What the Commission can do

Article 101 sets the fine ceiling for GPAI providers. The Commission may impose fines not exceeding 3% of annual total worldwide turnover in the preceding financial year or EUR 15 million, whichever is higher. A fine requires a finding that the provider intentionally or negligently infringed the Regulation, failed to answer a request for documents or information under Article 91, failed to comply with a measure under Article 93, or failed to give the Commission access to the model for an evaluation under Article 92 (AI Act Explorer, Article 101).

The Commission's enforcement page summarises the toolset:

Requests for information (RFIs): simple RFIs can lead to fines if the reply is incorrect or misleading. RFIs issued by Commission decision can also lead to fines if the provider fails to reply or replies incompletely.
Model evaluations and access: the AI Office, or independent experts it appoints, can require access to a model to evaluate it.
Measures: the Commission can require compliance, risk-mitigation or market-restriction, recall and withdrawal measures.

The Commission's page also states that prohibited AI practices carry the highest penalties, up to EUR 35 million or 7% of worldwide annual turnover, while other breaches, including of GPAI obligations, carry up to EUR 15 million or 3% (European Commission).

What this means for providers and integrators

For a GPAI provider, the practical risk is procedural as much as substantive. A late or incomplete reply to a formal request can create exposure on its own, and a simple RFI answered inaccurately can also be sanctioned. Response playbooks, named owners and version-controlled technical documentation are therefore part of compliance, not an administrative afterthought.

For companies that build products on third-party GPAI models, enforcement is mostly indirect. The Commission's scope covers the model provider and, in some cases, AI systems built on that model by the same provider or group. SignorCrypto's analysis is that downstream teams should still ask model vendors for the documents they need to answer their own customers and regulators, and should confirm those documents in contracts.

A practical checklist:

Identify whether your organisation develops a GPAI model, modifies one, or only builds systems on a vendor model. Whether modification changes your role is a question for counsel and Commission guidance.
Keep an evidence file with the copyright policy, training-content summary, model documentation and any evaluation records.
Record the licence and systemic-risk assessment for each model in use, with the date and the reasoning.
Assign an owner and a response timeline for information requests, and review every reply for accuracy and completeness before sending.
Map which of your AI systems rely on each model, so you can answer scope questions quickly.

Open questions

The sources reviewed describe the powers and fine ceilings but do not yet show how the AI Office will prioritise cases, or what level of detail it will expect in routine replies. They also do not report a fine under Article 101 at the time of writing. These are open points to monitor, not settled practice.

FAQ

Who enforces the AI Act against AI systems that are not GPAI models?

Enforcement is shared. The European Commission's AI Office, the European Data Protection Supervisor and national competent authorities designated by Member States each have roles. The AI Office covers GPAI providers and certain AI systems tied to them or to very large online platforms and search engines under the Digital Services Act.

What is the maximum fine for a GPAI provider?

Under Article 101, the ceiling is 3% of annual total worldwide turnover or EUR 15 million, whichever is higher. Prohibited AI practices fall into a higher band.

Does an open-source licence exempt a model from enforcement?

Not entirely. Open-source GPAI models are exempt from most documentation duties unless they present systemic risk, but they must still meet the copyright policy and training-content summary obligations.

Sources

If you are turning GPAI compliance evidence and AI integration into a product or internal workflow, contact SignorCrypto to discuss your project.