R4XNBlog
Visit r4xn.com

Guide

EU AI Act GPAI Enforcement Is Live: A Plain Guide for Product Teams That Integrate Models

R4XN TECH5 min read79 views

EU AI Act compliance checklist beside cloud model API keys and technical documentation

Since 2 August 2026, the European Commission’s AI Office has held full enforcement authority over providers of general-purpose AI (GPAI) models under the EU AI Act. The underlying Chapter V duties have applied since 2 August 2025; the one-year gap functioned as an adjustment period before fines and compulsive powers switched on.

If you train foundation models for the EU market, this is obviously your problem. If you only integrate GPT-, Claude-, Gemini-, or open-weight APIs into a SaaS product, it is still your problem—just a different slice of it. Downstream deployers inherit documentation gaps, copyright policy holes, and contractual silence when something goes wrong.

This guide is for product, security, and engineering leads who need a public-interest briefing without a 200-page memo.

GPAI enforcement is live: documentation, copyright policy, and training-content transparency now sit behind Commission powers.

The two clocks (and why August 2026 mattered)

  • 2 August 2025: GPAI provider obligations in Articles 53–55 became binding for models placed on the market from that date. Models already on the market before that date generally have until 2 August 2027 to comply (Art. 111(3)).
  • 2 August 2026: Commission enforcement powers for GPAI (Articles 88–94, with Article 101 fining power) became usable. The AI Office can request documents, seek model access for evaluations, order mitigation, restrict or withdraw models, and fine up to the higher of €15 million or 3% of worldwide annual turnover.

Secondary analyses (Taylor Wessing, Cloud Security Alliance research notes, and EU AI Act explainers) emphasise that Regulation (EU) 2026/1744 (Digital Omnibus on AI) moved some high-risk system dates but did not move the GPAI Chapter V or Article 101 dates. Always re-check the consolidated text before making compliance bets—Omnibus packages keep editing adjacent calendars.

Duties from August 2025; compulsive enforcement and fines from August 2026.

What every GPAI provider owes (baseline)

For non-systemic-risk GPAI models, the recurring baseline is:

  1. Technical documentation (Annex XI) kept up to date.
  2. Information for downstream providers (Annex XII) so integrators can build compliant systems.
  3. An EU copyright-compliance policy.
  4. A publicly available summary of training content, in the form specified by the AI Office.

Providers must also cooperate with the Commission and avoid incorrect, incomplete, or misleading responses to information requests. That cooperation duty is easy to underestimate until an information request lands.

When “systemic risk” adds the heavy programme

A model is presumed to present systemic risk when cumulative training compute exceeds 10^25 FLOPs, or when the Commission designates it. Systemic-risk providers face additional duties: adversarial evaluation and testing, systemic-risk assessment and mitigation across the lifecycle, serious-incident tracking and reporting, and heightened cybersecurity for model and infrastructure.

Most product teams will never train at that scale. They will, however, consume models that do—and need contractual clarity on incident notices, eval summaries, and usage restrictions.

What integrators and fine-tuners should do now

  1. Clarify your role in writing. Are you a GPAI provider, a downstream AI-system provider, a deployer, or “only” a customer of an API? Fine-tuning and substantial modification can change the answer. Put the conclusion in your security pack, not in Slack folklore.
  2. Demand Annex XII-class information in vendor onboarding. If a model vendor cannot supply the documentation and intended-use information your lawyers expect under the Act’s logic, treat that as a procurement defect—especially for EU user traffic.
  3. Map high-risk use cases separately. GPAI duties are not the whole Act. Annex III high-risk application dates were moved by the 2026 Omnibus package (commonly cited toward 2 December 2027 for many Annex III systems—verify current law). HR screening, creditworthiness, and critical-infrastructure use cases still need their own controls calendar.
  4. Log model IDs, versions, and eval harnesses. When Sol replaces Astra routes, or Opus 5.5 replaces Opus 5, your incident response and DPIA files need reproducible version pins. Mid-September’s price war made version churn normal; governance still needs a changelog. For the commercial context of those swaps, read GPT-6 Sol & Luna vs Claude Opus 5.5 pricing.
  5. Prefer vendors with a credible Code of Practice story—or equivalent evidence. Signing the GPAI Code of Practice is a voluntary route that can support a presumption of conformity for covered obligations. Non-signatories are not automatically unlawful, but they should demonstrate compliance another way. Ask which path your vendor claims and keep the answer on file.
  6. Watch open-weight supply chains. Open-weight models can shift who counts as “provider” when you further train, quantise, or hard-bundle weights into an EU product. Legal review beats reverse-engineering after a complaint.

Minimum viable programme: inventory endpoints, classify use cases, collect vendor packs, close EU-traffic gaps.

How this intersects with ESG reporting season

September 2026 also delivered simplified ESRS rules and Malaysia’s NSRF assurance deferral. Those files look unrelated until a board asks one question: “Which AI systems touch personal data, critical decisions, or energy-heavy inference—and who owns the evidence?” GPAI documentation, GHG of inference, and vendor risk belong in the same control conversation even when they sit in different regulations.

A 30-day minimum viable programme

  1. Inventory every model endpoint in production and staging (vendor, model ID, region, fine-tunes).
  2. Classify each use case: content assist, decision support, or Annex III-adjacent.
  3. Collect vendor GPAI packs (docs, copyright policy pointers, training-summary links, incident contact).
  4. Close gaps with contractual schedules or alternative models for EU traffic.
  5. Brief execs on fine exposure and on the 2027 deadlines that still apply to older models and high-risk systems.

Bottom line

GPAI enforcement going live in August 2026 does not mean every chatbot ships with a CE mark tomorrow. It does mean documentation, copyright policy, training-content transparency, and systemic-risk controls are now backed by a regulator that can compel access and fine at global-turnover scale. Product teams that only chase cheaper tokens without filing the paper will eventually meet both at once.

Sources