AI Regulation Tracker / Enforcement

The EU AI Office Gets Real Enforcement Power Over Foundation Models on 2 August 2026

Regulatory summary: On 2 August 2026 the European Commission's enforcement powers over providers of general-purpose AI (GPAI) models enter into application under the EU AI Act. From that date the Commission, operating through the AI Office, can request documentation and information, conduct evaluations of GPAI models, require providers to take mitigation measures.

From 2 August 2026 the European Commission, acting through its AI Office, can compel documentation from general-purpose AI providers, run its own model evaluations, order mitigation or withdrawal, and fine providers up to 15 million euro or 3 percent of worldwide turnover. Models trained above 10 to the 25th power in floating point operations carry extra duties and are the likely first targets.

Primary source

By Anthony Guerriero, Founder, The Leveraged Years · Reviewed by The Leveraged Years Editorial Desk · Published July 9, 2026 · Last updated July 9, 2026

The EU AI Office Gets Real Enforcement Power Over Foundation Models on 2 August 2026 regulation briefing

The Leveraged Years AI Regulation Tracker

Key takeaways

The obligations for GPAI providers have existed since 2 August 2025. From 2 August 2026 the Commission gains the operative power to enforce them. It can compel documentation and information, evaluate models directly, order mitigation measures, restrict or withdraw a model, and levy fines under Article 101. This converts a set of duties into a supervised, penalty-backed regime with the AI Office as the central enforcer.
Foundation-model providers selling into or reaching the EU; enterprises embedding GPAI in products; and, downstream, professional-service teams in contract, compliance, procurement, and audit who now have to verify that the GPAI models inside their tools carry the required provider documentation.
Status: Obligations in force since 2 August 2025.
List every GPAI model your organization builds, embeds, or resells; for each, obtain or request the Article 53 documentation and confirm systemic-risk status; and write provider-compliance representations into procurement and vendor contracts before 2 August 2026.

Regulatory Briefing

Bindingness: Binding EU regulation, enforcement powers in application from 2 August 2026. The AI Act (Regulation (EU) 2024/1689) is directly applicable law across all member states. The substantive GPAI obligations applied from 2 August 2025; what changes on 2 August 2026 is that the Commission's powers to enforce those obligations, including fines, enter into application.
Scope: Providers that place general-purpose AI models on the EU market, wherever they are established, including providers outside the EU whose models reach EU users. A separate, heavier tier applies to providers of GPAI models classified as carrying systemic risk. Downstream deployers that integrate GPAI models are governed by other parts of the Act, but they inherit the practical need to verify provider compliance.
What Changed: The obligations for GPAI providers have existed since 2 August 2025. From 2 August 2026 the Commission gains the operative power to enforce them. It can compel documentation and information, evaluate models directly, order mitigation measures, restrict or withdraw a model, and levy fines under Article 101. This converts a set of duties into a supervised, penalty-backed regime with the AI Office as the central enforcer.
Who This Affects: Foundation-model providers selling into or reaching the EU; enterprises embedding GPAI in products; and, downstream, professional-service teams in contract, compliance, procurement, and audit who now have to verify that the GPAI models inside their tools carry the required provider documentation.
Current Status: Obligations in force since 2 August 2025. Commission enforcement powers, including fines, enter into application on 2 August 2026 per the official guidelines page. A voluntary GPAI Code of Practice supports compliance in the interim.
Effective Date: 2 August 2026 for the Commission's enforcement powers over GPAI providers.
Primary Source: https://digital-strategy.ec.europa.eu/en/policies/guidelines-gpai-providers
Secondary Analysis: Latham and Watkins analysis of EU AI Act GPAI obligations; the consolidated text of Regulation (EU) 2024/1689, Articles 51, 53, 55, and 101.
Workflow Impact: Any team relying on a foundation model now needs to hold, or be able to obtain, the provider's technical documentation, training-data summary, and copyright policy, and to confirm whether the model is classified as systemic-risk. Vendor due diligence, procurement clauses, and audit files must account for the model layer, not just the application layer.
Operational Next Step: List every GPAI model your organization builds, embeds, or resells; for each, obtain or request the Article 53 documentation and confirm systemic-risk status; and write provider-compliance representations into procurement and vendor contracts before 2 August 2026.
Last Verified: July 10, 2026

Date	Jurisdiction	Rule	Affected professionals	Status or effective date
2026-07-09	European Union	The obligations for GPAI providers have existed since 2 August 2025. From 2 August 2026 the Commission gains the operative power to enforce them. It can compel documentation and information, evaluate models directly, order mitigation measures, restrict or withdraw a model, and levy fines under Article 101. This converts a set of duties into a supervised, penalty-backed regime with the AI Office as the central enforcer.	Foundation-model providers selling into or reaching the EU; enterprises embedding GPAI in products; and, downstream, professional-service teams in contract, compliance, procurement, and audit who now have to verify that the GPAI models inside their tools carry the required provider documentation.	Obligations in force since 2 August 2025. Commission enforcement powers, including fines, enter into application on 2 August 2026 per the official guidelines page. A voluntary GPAI Code of Practice supports compliance in the interim.

Source File

Instrument: Regulation (EU) 2024/1689 (EU AI Act), GPAI provisions, Articles 51, 53, 55, and 101; Commission Guidelines for providers of general-purpose AI models
Authority: European Commission, acting through the AI Office
Date: Obligations in force 2 August 2025; Commission enforcement powers in application from 2 August 2026
Citation: Commission page, Guidelines for providers of general-purpose AI models; Regulation (EU) 2024/1689, Articles 51 and 101
Primary Source: https://digital-strategy.ec.europa.eu/en/policies/guidelines-gpai-providers
Corroboration: Regulation (EU) 2024/1689 consolidated text, Article 101 (fines up to 3 percent worldwide turnover or 15 million euro) and Article 51 (10 to the 25th power FLOP systemic-risk presumption); Latham and Watkins analysis of EU AI Act GPAI obligations.

Frequently Asked Questions

Are GPAI obligations new on 2 August 2026?

No. The substantive obligations for GPAI providers applied from 2 August 2025. What enters into application on 2 August 2026 is the Commission's power to enforce them, including through fines, as confirmed on the Commission's GPAI guidelines page.

How much can a GPAI provider be fined?

Under Article 101, the Commission may fine a GPAI provider up to 3 percent of its total worldwide annual turnover in the preceding financial year or 15 million euro, whichever is higher.

What makes a model a systemic-risk model?

Under Article 51, a model is presumed to carry systemic risk when its cumulative training compute exceeds 10 to the 25th power floating point operations, or when the Commission designates it based on the Annex XIII criteria. Such models face extra testing, risk-assessment, and incident-reporting duties.

Who enforces the GPAI rules?

The European Commission, acting through the AI Office, enforces the GPAI model layer centrally at EU level. It can request documentation, evaluate models, order mitigation or withdrawal, and impose fines.

We only use a foundation model, we do not build one. Does this affect us?

You are not the fined party under Article 101, but you depend on a regulated component. Obtain the provider's technical documentation and training-data summary, confirm systemic-risk status, and add provider-compliance clauses to your contracts before 2 August 2026.