Why 2 August 2026 Is the Real Enforcement Date
The EU AI Act was adopted in 2024 and entered into force in August 2024. Several waves of obligations then switched on over time. According to the European Commission’s AI Act policy page, the core of the regulation becomes “fully applicable on 2 August 2026” — this is when most high-risk and GPAI obligations move from theoretical to enforceable.
Two things happen on that date that matter for GPAI providers:
- The Commission’s supervision and enforcement powers over GPAI model providers come into force. The AI Office gains the power to request documentation, conduct evaluations, demand corrective measures, and impose fines.
- Fines under Article 101 can reach up to 3% of global annual turnover or €15 million, whichever is higher, for non-compliance with GPAI obligations.
This is the deadline against which every foundation-model provider serving the EU market needs to be fully ready — not a soft target.
The Threshold: 10²⁵ FLOPs and Systemic Risk
The EU AI Act creates two tiers of GPAI obligation. Every provider has a baseline set of duties under Article 53. Providers whose model presents systemic risk carry the heavier set under Article 55.
Per Article 55 of the EU AI Act and the European Commission’s guidelines for GPAI providers, a GPAI model is presumed to have high-impact capabilities — and therefore systemic risk — when the cumulative amount of compute used for its training is greater than 10²⁵ floating-point operations (FLOPs). Providers must notify the Commission within two weeks of reasonably foreseeing or reaching that threshold.
The threshold is high enough that most fine-tuned or derivative models will sit below it. It is low enough that several frontier models already cross it, and more will do so through 2026. Being on the “systemic risk” side of the line is the assumption most frontier labs should plan for.
Article 53: The Baseline GPAI Obligations
Every GPAI provider placing a model on the EU market must, under Article 53:
- Maintain technical documentation of the model — training and testing processes, evaluation results — and provide it to the AI Office and national competent authorities on request.
- Make information available to downstream providers (companies building AI systems on top of the model), so they can meet their own obligations.
- Put in place a policy to comply with Union copyright law, including respecting opt-outs expressed under Article 4(3) of Directive (EU) 2019/790 on copyright in the Digital Single Market.
- Publish a sufficiently detailed summary of the content used for training, using the template issued by the AI Office.
Law firms tracking implementation — including in Orrick’s practical EU AI Act playbook — emphasise that the training-data summary and the copyright policy are the two areas most GPAI providers are least ready for.
Advertisement
Article 55: Extra Obligations for Systemic-Risk Models
When a GPAI model crosses into systemic-risk territory, Article 55 stacks additional duties on top:
- Model evaluation performed in accordance with standardised protocols and tools, including adversarial testing.
- Assessment and mitigation of possible Union-level systemic risks arising from the development, placing on the market, or use of the model.
- Tracking and reporting of serious incidents and possible corrective measures to the AI Office and national competent authorities, without undue delay.
- Adequate cybersecurity protection for the model and for the physical infrastructure of the model.
These are not box-ticking exercises — they are operating capabilities (red-teaming muscle, incident response, security engineering) that need to exist and function continuously.
What GPAI Providers and Enterprise Buyers Should Do Before August 2
The August 2, 2026 enforcement date is fixed. Orrick’s six-step EU AI Act playbook notes that most GPAI providers are least ready on training-data summaries and copyright policy — the two obligations that require third-party data audit and legal analysis, not just engineering effort. These four actions address the highest-risk gaps.
1. Produce the Training-Data Summary Using the AI Office Template Now
The AI Office has published a training-data summary template that providers must use. Producing it requires auditing the training data corpus, categorizing content by source type (publicly available web, licensed datasets, proprietary data), and documenting how opt-outs under Article 4(3) of Directive 2019/790 were honored. Latham & Watkins’ GPAI obligations analysis confirms that the summary is not a high-level description — it must be detailed enough for the AI Office to assess copyright compliance and for downstream providers to build their own disclosure documents on top of it. Teams that start this audit now have 14 weeks; teams that start in July will be producing a summary under enforcement-ready conditions with no review cycle.
2. Build the Downstream-Provider Information Package as a Living Document
Article 53 requires that downstream providers — companies building AI systems on GPAI models — receive the information they need for their own compliance. The practical requirement is a versioned document package: model card with intended use and known limitations, training-data summary, copyright compliance statement, and evaluation summary. Downstream providers in the EU are already requesting this documentation in procurement cycles; the August 2 deadline formalizes what is already becoming a de facto standard in enterprise AI contracting. Structuring this package as a living document with a version history means each model update requires a delta update rather than a full rebuild — and audit trails are preserved automatically.
3. Stand Up Red-Teaming and Incident Reporting Before the Deadline, Not After
Article 55 systemic-risk obligations — adversarial testing, risk mitigation, serious-incident reporting — are not check-box exercises. The AI Office can request evaluation documentation on demand from August 2, and the reporting obligation for serious incidents runs without undue delay from detection. Organizations that treat red-teaming as a one-time pre-launch activity will fail this obligation when the AI Office requests evidence of ongoing evaluation. The minimum viable programme: a quarterly red-team cycle documented in a shared incident register, with a named AI safety officer authorized to file reports to the AI Office. The incident register format does not need to be complex — a versioned log with date, incident type, severity, and corrective action is sufficient for initial compliance.
4. Update Enterprise Procurement Checklists to Request AI Act Evidence From Vendors
For enterprise buyers and Algerian organizations purchasing GPAI-based products, the practical implication of the August deadline is contractual. The training-data summary, copyright policy, and evaluation documentation required by Articles 53 and 55 should become standard procurement requirements. Adding a five-item AI Act attestation clause to new software contracts — training-data summary available, copyright policy published, systemic-risk evaluation completed, incident-reporting channel operational, downstream-provider information package provided — converts the vendor’s compliance obligation into a contractual deliverable. Even without domestic enforcement, requesting this documentation signals that your organization has assessed the governance quality of the AI products it depends on.
The Regulatory Question
The four actions this article prescribes — producing the training-data summary now, building the downstream-provider information package as a living document, standing up red-teaming before the deadline, and updating enterprise procurement checklists — address the compliance surface. The deeper regulatory question the EU AI Act poses is about market structure: whether frontier AI models can be governed by the same institutions that govern pharmaceutical approvals, financial instruments, and aviation safety, or whether AI’s rate of change defeats every governance architecture designed for slower-moving technologies.
The 10²⁵ FLOP threshold is already an approximation. Several frontier models from 2025 onward are plausibly at or above it, and training compute continues to scale. The AI Office’s ability to request documentation and impose fines under Article 101 is real from August 2, 2026, but the enforcement machinery — which assumes stable model characteristics, auditable training data, and human-reviewable incident reports — will be tested against AI systems that update and evolve in ways that make traditional regulatory review cycles look slow.
For enterprises buying GPAI-based products, the practical implication is not to wait for that governance tension to resolve. The procurement attestation checklist this article recommends — training-data summary available, copyright policy published, systemic-risk evaluation completed, incident-reporting channel operational — converts vendor compliance from a regulatory abstraction into a contractual deliverable. Organizations that normalize this standard before August 2, 2026, will have cleaner vendor relationships and better evidence of governance intent regardless of how the AI Office’s enforcement priorities evolve.
Frequently Asked Questions
What exactly changes on 2 August 2026 under the EU AI Act?
2 August 2026 is the date on which the AI Act becomes fully applicable for most obligations, including the Commission’s supervision and enforcement powers over GPAI model providers. The AI Office can request documentation, run evaluations, require corrective measures, and impose fines up to 3% of global turnover or €15 million under Article 101.
What is the 10²⁵ FLOP threshold and does my model cross it?
A GPAI model is presumed to have high-impact capabilities — and therefore systemic risk — when the cumulative compute used for its training is greater than 10²⁵ FLOPs. Providers must notify the European Commission within two weeks of reasonably foreseeing or reaching that threshold. Most frontier large models from 2024 onward are at or above this level.
What is the difference between Article 53 and Article 55 obligations?
Article 53 applies to every GPAI provider and covers technical documentation, downstream provider information, a copyright policy, and a training-data summary. Article 55 adds obligations for systemic-risk GPAI only — systematic model evaluation including adversarial testing, risk mitigation, serious-incident reporting, and strong cybersecurity for the model and its infrastructure.
Sources & Further Reading
- European Commission — AI Act Regulatory Framework
- European Commission — Guidelines for Providers of General-Purpose AI Models
- EU AI Act — Article 55: Obligations for Providers of GPAI Models with Systemic Risk
- Orrick — The EU AI Act: 6 Steps to Take Before 2 August 2026
- Latham & Watkins — EU AI Act: GPAI Model Obligations in Force
