Why 2 August 2026 Is the Real Enforcement Date
The EU AI Act was adopted in 2024 and entered into force in August 2024. Several waves of obligations then switched on over time. According to the European Commission’s AI Act policy page, the core of the regulation becomes “fully applicable on 2 August 2026” — this is when most high-risk and GPAI obligations move from theoretical to enforceable.
Two things happen on that date that matter for GPAI providers:
- The Commission’s supervision and enforcement powers over GPAI model providers come into force. The AI Office gains the power to request documentation, conduct evaluations, demand corrective measures, and impose fines.
- Fines under Article 101 can reach up to 3% of global annual turnover or €15 million, whichever is higher, for non-compliance with GPAI obligations.
This is the deadline against which every foundation-model provider serving the EU market needs to be fully ready — not a soft target.
The Threshold: 10²⁵ FLOPs and Systemic Risk
The EU AI Act creates two tiers of GPAI obligation. Every provider has a baseline set of duties under Article 53. Providers whose model presents systemic risk carry the heavier set under Article 55.
Per Article 55 of the EU AI Act and the European Commission’s guidelines for GPAI providers, a GPAI model is presumed to have high-impact capabilities — and therefore systemic risk — when the cumulative amount of compute used for its training is greater than 10²⁵ floating-point operations (FLOPs). Providers must notify the Commission within two weeks of reasonably foreseeing or reaching that threshold.
The threshold is high enough that most fine-tuned or derivative models will sit below it. It is low enough that several frontier models already cross it, and more will do so through 2026. Being on the “systemic risk” side of the line is the assumption most frontier labs should plan for.
Article 53: The Baseline GPAI Obligations
Every GPAI provider placing a model on the EU market must, under Article 53:
- Maintain technical documentation of the model — training and testing processes, evaluation results — and provide it to the AI Office and national competent authorities on request.
- Make information available to downstream providers (companies building AI systems on top of the model), so they can meet their own obligations.
- Put in place a policy to comply with Union copyright law, including respecting opt-outs expressed under Article 4(3) of Directive (EU) 2019/790 on copyright in the Digital Single Market.
- Publish a sufficiently detailed summary of the content used for training, using the template issued by the AI Office.
Law firms tracking implementation — including in Orrick’s practical EU AI Act playbook — emphasise that the training-data summary and the copyright policy are the two areas most GPAI providers are least ready for.
Advertisement
Article 55: Extra Obligations for Systemic-Risk Models
When a GPAI model crosses into systemic-risk territory, Article 55 stacks additional duties on top:
- Model evaluation performed in accordance with standardised protocols and tools, including adversarial testing.
- Assessment and mitigation of possible Union-level systemic risks arising from the development, placing on the market, or use of the model.
- Tracking and reporting of serious incidents and possible corrective measures to the AI Office and national competent authorities, without undue delay.
- Adequate cybersecurity protection for the model and for the physical infrastructure of the model.
These are not box-ticking exercises — they are operating capabilities (red-teaming muscle, incident response, security engineering) that need to exist and function continuously.
What Providers Should Be Doing Now
For a GPAI provider serving the EU market in 2026, the practical pre-August checklist is short but demanding:
- [ ] Decide whether your model is above or below the 10²⁵ FLOP threshold; if above, file the notification within two weeks of reasonably foreseeing the crossing.
- [ ] Produce and maintain the technical documentation dossier (architecture, training, evaluation, limitations).
- [ ] Publish the training-data summary using the AI Office template.
- [ ] Publish a copyright compliance policy respecting Article 4(3) of the 2019 directive and opt-out signals from rights holders.
- [ ] Build a downstream-provider information package so system integrators can do their own compliance work.
- [ ] Stand up a red-team / evaluation programme aligned with EU expectations.
- [ ] Create an incident register and a reporting channel to the AI Office.
- [ ] Harden model and infrastructure security (weights handling, supply chain, insider risk).
For downstream deployers and enterprises building on GPAI models, the main implication is that the information you need for your own compliance (intended use, limitations, training summary, copyright posture) should become available from your upstream provider — ask for it explicitly in contracts.
Frequently Asked Questions
What exactly changes on 2 August 2026 under the EU AI Act?
2 August 2026 is the date on which the AI Act becomes fully applicable for most obligations, including the Commission’s supervision and enforcement powers over GPAI model providers. The AI Office can request documentation, run evaluations, require corrective measures, and impose fines up to 3% of global turnover or €15 million under Article 101.
What is the 10²⁵ FLOP threshold and does my model cross it?
A GPAI model is presumed to have high-impact capabilities — and therefore systemic risk — when the cumulative compute used for its training is greater than 10²⁵ FLOPs. Providers must notify the European Commission within two weeks of reasonably foreseeing or reaching that threshold. Most frontier large models from 2024 onward are at or above this level.
What is the difference between Article 53 and Article 55 obligations?
Article 53 applies to every GPAI provider and covers technical documentation, downstream provider information, a copyright policy, and a training-data summary. Article 55 adds obligations for systemic-risk GPAI only — systematic model evaluation including adversarial testing, risk mitigation, serious-incident reporting, and strong cybersecurity for the model and its infrastructure.
Frequently Asked Questions
What exactly changes on 2 August 2026 under the EU AI Act?
2 August 2026 is the date on which the AI Act becomes fully applicable for most obligations, including the Commission’s supervision and enforcement powers over GPAI model providers. The AI Office can request documentation, run evaluations, require corrective measures, and impose fines up to 3% of global turnover or €15 million under Article 101.
What is the 10²⁵ FLOP threshold and does my model cross it?
A GPAI model is presumed to have high-impact capabilities — and therefore systemic risk — when the cumulative compute used for its training is greater than 10²⁵ FLOPs. Providers must notify the European Commission within two weeks of reasonably foreseeing or reaching that threshold. Most frontier large models from 2024 onward are at or above this level.
What is the difference between Article 53 and Article 55 obligations?
Article 53 applies to every GPAI provider and covers technical documentation, downstream provider information, a copyright policy, and a training-data summary. Article 55 adds obligations for systemic-risk GPAI only — systematic model evaluation including adversarial testing, risk mitigation, serious-incident reporting, and strong cybersecurity for the model and its infrastructure.
Sources & Further Reading
- European Commission — AI Act Regulatory Framework
- European Commission — Guidelines for Providers of General-Purpose AI Models
- EU AI Act — Article 55: Obligations for Providers of GPAI Models with Systemic Risk
- Orrick — The EU AI Act: 6 Steps to Take Before 2 August 2026
- Latham & Watkins — EU AI Act: GPAI Model Obligations in Force
