EU GPAI Enforcement Went Live and Most Providers Are Not Ready

On August 2, 2026 the European Commission's enforcement and penalty powers over providers of general purpose AI models became applicable, ending a twelve month grace period that left GPAI obligations on paper but largely unenforceable. For model providers operating in or selling into the European Union, the shift from guidance to live supervisory risk is now real.

The substantive obligations under Chapter V of the EU AI Act have applied since August 2, 2025. What changed on August 2, 2026 is the machinery to police them: the AI Office can request technical documentation, evaluate models directly, demand corrective and risk mitigation measures, restrict or withdraw models from the EU market, and levy fines.

What the AI Office can do now

The Commission holds four primary instruments for GPAI models, all active since August 2:

Request information (Article 91): The Commission can require documentation and information needed to assess compliance.

Model evaluations (Article 92): The Commission can evaluate models themselves, including through source code or interface access, to investigate systemic risks.

Require measures (Article 93): The Commission can require providers to take corrective action, comply with obligations, or mitigate identified risks.

Restrict or withdraw (Article 93): As a last resort, the Commission can restrict a model on the market or withdraw it entirely.

Fines reach up to 15 million euros or 3 percent of total worldwide annual turnover, whichever is higher. Failing to supply requested information, or supplying it incompletely or late, is itself a finable act.

Who is exposed

This centralised GPAI track does not depend on national regulator readiness. A provider whose exposure runs through model level duties faces a supervisor that is operationally ready even where member state enforcement layers lag.

For companies building products on third party models, the duties in Articles 53 to 55 apply to the model supplier, not the downstream product builder. But they still matter: downstream buyers are entitled to information from suppliers, and substantial modification of a model can shift obligations.

Models placed on the market before August 2, 2025 have until August 2, 2027 to meet substantive obligations. That transitional period covers duties, not oversight. Models placed after August 2, 2025 face obligations without a transitional period, and enforcement is now active.

Context from the Digital Omnibus

The timing intersects with the Digital Omnibus on AI, published in the Official Journal on July 24, 2026 and in force from July 27. The omnibus reset stand alone high risk obligations under Annex III from August 2, 2026 to December 2, 2027, buying time for employment, education, credit scoring, and law enforcement use cases.

GPAI enforcement, however, was not delayed. The grace period that ended August 2 was specific to the Commission's penalty powers under Article 101, not to the underlying model provider duties.

Commission Implementing Regulation (EU) 2026/1755, in force since August 10, 2026, adds detailed procedural rules including interim measures on prima facie evidence and a five year limitation period for fines.

Practical implications

Any AI Office correspondence should now be treated as a formal regulatory matter. Providers should activate regulatory response protocols, involve EU counsel where past deadlines may have been missed, and communicate cooperatively rather than ad hoc.

For non EU providers, market access restrictions may prove more significant than fines. The GPAI code of practice published July 10, 2025 remains the practical compliance route: signatories can rely on it to make compliance plausible, lightening the burden of proof in supervisory conversations.

The industry spent a year knowing the rules existed but facing no enforcement apparatus. That year is over.

Sources

Taylor Wessing August 2026; AI in Europe August 3 2026; Praxikon August 2026; artificialintelligenceact.eu