EU AI Act August 2026: GPAI Model Enforcement and the Code of Practice Come of Age

Why 2 August 2026 Is the Real GPAI Deadline

The EU AI Act has been phased in since it entered into force in 2024. Governance rules and GPAI model obligations became applicable on 2 August 2025, but the European Commission publicly committed to a grace period: its enforcement actions — requests for information, model evaluations, recalls — only begin on 2 August 2026. From that date, the AI Office can impose fines up to €15 million or 3% of global annual turnover under Article 101.

This grace year was a deliberate design choice. Regulators acknowledged that GPAI providers needed time to build compliance structures against an evolving standard. The Code of Practice, published in July 2025, was meant to give them a concrete playbook.

What the GPAI Code of Practice Actually Contains

The GPAI Code of Practice, prepared by independent experts through a multi-stakeholder process, is a voluntary tool designed to help providers demonstrate compliance with Article 53 of the AI Act. It organises obligations under three chapters:

• Transparency — documentation that providers must produce about model training, architecture, capabilities, limitations, and intended use. This chapter gives GPAI providers a concrete way to demonstrate compliance with their Article 53 obligations.
• Copyright — policies and processes providers must put in place to respect EU copyright rules, including the handling of opt-outs from text and data mining.
• Systemic risks — a deeper set of commitments specifically for providers of GPAI models with systemic risk (a designation tied to training compute and capability thresholds). This covers model evaluation, risk assessment, reporting, serious incident reporting, and physical and cybersecurity of model weights.

Signatories to the Code benefit from a predictable compliance path. Non-signatories still have to meet Article 53 obligations, but without the Code’s built-in presumption of compliance.

The Good-Faith Grace Period Is Ending

Between 2 August 2025 and 2 August 2026, the AI Office has operated in a collaborative mode. Code signatories that had not fully implemented all commitments on day one were not treated as in breach. The posture was “partner to get everyone compliant” rather than “enforce from day one.”

That posture flips on 2 August 2026. From that date, the Commission will enforce all obligations for providers and may impose fines. For any AI lab whose models are placed on the EU market — through APIs, open-weight downloads, or enterprise licensing — the timer is running.

Who Is Caught in Scope

The GPAI definition is broader than many organisations initially assumed. It covers providers of general-purpose AI models — models that can perform a wide range of tasks and serve as building blocks for downstream systems. This sweeps in:

• Frontier model providers (OpenAI, Anthropic, Google DeepMind, Meta’s Llama team, Mistral)
• Enterprise model fine-tuners when their outputs themselves become GPAI models
• Open-weight publishers whose models are available in the EU, regardless of where they are hosted
• Providers of multimodal models (text + image + audio), where the breadth of tasks meets the GPAI threshold

Systemic-risk designation adds another layer: models above certain training-compute and capability thresholds face additional obligations including mandatory evaluations, red-teaming, and incident reporting.

The 2026 Compliance Checklist for GPAI Providers

Practical actions model providers need in place before 2 August 2026:

1. Article 53 documentation package. A complete technical file covering architecture, training data summary, capabilities and limitations, and intended use — ready for AI Office requests for information.
2. Copyright policy. A public, actionable policy on text and data mining opt-outs, with technical mechanisms to respect machine-readable reservations under the EU copyright framework.
3. Downstream transparency. Information packages tailored to downstream providers building on top of the GPAI model, enabling them to meet their own AI Act obligations.
4. Systemic-risk program (if applicable). Formal risk assessments, model evaluations, adversarial testing, incident reporting procedures, and physical and cyber security measures for model weights.
5. Code of Practice alignment decision. Whether to sign the Code and benefit from its presumption of compliance, or demonstrate compliance through another route.

What It Means for Enterprise AI Buyers

For enterprise customers in the EU — and for international customers whose AI vendors’ EU compliance posture matters — GPAI enforcement changes procurement and vendor management:

• Vendor due diligence should now systematically check GPAI compliance status, Code of Practice signatory status, and documentation availability.
• Contract terms should include warranties around AI Act compliance and indemnities for regulatory findings that disrupt service.
• Model switching plans matter more, because a vendor facing a GPAI enforcement action may see capabilities throttled or the model withdrawn from the EU market.

The bigger picture: 2 August 2026 marks the moment the AI Act stops being a future-tense conversation and becomes a live regulatory regime — with enforcement, fines, and real operational consequences for the entire AI supply chain.

Sources & Further Reading

• AI Act Implementation Timeline — Future of Life Institute
• The General-Purpose AI Code of Practice — European Commission
• EU AI Act: GPAI Model Obligations in Force and Final GPAI Code of Practice in Place — Latham & Watkins
• EU AI Act: European Commission Publishes General-Purpose AI Code of Practice — Jones Day
• EU AI Obligations for GPAI Providers: Compliance, Enforcement & Deadlines — MediaLaws