Contents7
On 2 August 2026, one year after the rules on general-purpose AI models started to apply, the European Commission gained the power to enforce them. Its AI Office can now request documents from the providers of these models, evaluate them, require corrections and, as a last resort, impose a fine. This power is exercised at European level, without waiting for national authorities.
This article in our Business AI section reviews these powers from the consolidated text of the regulation. It is not legal advice: for a specific project, your DPO or a lawyer has the final say. The obligations of a business that uses AI are in our AI Act and GDPR guide for small businesses, and the overall approach in our guide to integrating AI in a business.
In short
Providers of general-purpose models have had obligations since 2 August 2025; the Commission has been able to fine them since 2 August 2026.
The fine can reach €15 million or 3% of worldwide turnover, whichever is higher.
Models placed on the market before 2 August 2025 have until 2 August 2027 to comply.
A business that uses a model through an API does not become its provider; it can, however, demand the documentation the provider owes it.
What is a “general-purpose” AI model?
The regulation speaks of a “general-purpose AI model”: a model able to perform a wide range of tasks, which others integrate into their own tools. The large language models behind conversational assistants are the typical example. According to the guidelines published by the Commission on 18 July 2025, a model trained with more than 10²³ floating-point operations and able to generate text, audio, images or video is, as an indicative criterion, considered general-purpose. We take this figure, like the 10²⁵ threshold cited below, from secondary sources, the analysis by law firm WilmerHale and a note by the Cloud Security Alliance, which summarise the text: the 10²⁵ threshold is in Article 51 of the AI Act, the 10²³ one in the Commission’s guidelines, and that is where to check them before classifying a model.
The provider is the one who develops the model and places it on the market. A business that calls it through an API to build an assistant does not become its provider. It only does so by modifying it heavily: the Commission’s indicative criterion is modification compute above one third of the original training compute, according to the analysis by the law firm WilmerHale.
What model providers owe
Article 53 sets four obligations for every provider of a general-purpose model:
- Technical documentation of the model, its training and its evaluations, to be provided to the AI Office on request.
- Documentation for integrators, so they understand the model’s capabilities and limits and can meet their own obligations.
- A copyright compliance policy that identifies and respects opt-outs expressed by rights holders.
- A public summary of the training content, following a template provided by the AI Office.
Models released under a free and open licence, weights included, are exempt from the first two. Models “with systemic risk”, presumed as such above 10²⁵ floating-point operations of training compute according to the Cloud Security Alliance note of 29 August 2026, must also, under Article 55, evaluate the model through adversarial testing, mitigate its risks, report serious incidents and protect its cybersecurity.
What the AI Office can do since 2 August 2026
The obligations have applied since 2 August 2025, but Article 113 postponed Article 101, the one on fines, by a year. The regulation sets out a gradual escalation, where each step can be preceded by a dialogue with the provider:
The AI Office’s powers, from dialogue to fine
- Dialogue
The AI Office can first hold a structured dialogue with the provider.
- Documents
The Commission can demand the technical documentation and any useful information (Article 91).
- Evaluation
It can evaluate the model itself, with access through an API or to the source code (Article 92).
- Measures
It can require compliance, risk mitigation, or even withdrawal from the market (Article 93).
- Fine
Up to €15M or 3% of worldwide turnover (Article 101).
The fine under Article 101 targets a breach committed intentionally or negligently: an obligation not met, information refused, incorrect or misleading, a measure ignored, access to the model refused. Since the July 2026 revision, the AI Office also supervises AI systems built by a provider on its own general-purpose model, with the powers of a market surveillance authority (Article 75a). No fine has been made public, to our knowledge as of 20 October 2026: we found no sanction decision announced by the Commission by that date, which does not prove that no proceedings are under way.
The timeline, from 2025 to 2027
- 10 July 2025
The Commission publishes the code of practice for general-purpose models.
- 2 August 2025
The obligations of general-purpose model providers apply.
- 2 August 2026
The Commission can impose fines; most other AI Act rules apply.
- 2 August 2027
Deadline for models placed on the market before 2 August 2025.
The last date comes from Article 111. The other AI Act deadlines, up to 2028, are in our AI regulation calendar.
The code of practice: who signed it?
The code of practice for general-purpose models, published on 10 July 2025, has three chapters: transparency, copyright, and safety and security. The last one only concerns models with systemic risk. Signing it is a way to demonstrate compliance; a provider that does not sign must show it has “other adequate means”, under Article 53.
The list of signatories is public on the Commission’s page, updated on 7 October 2026. It includes, among others, Aleph Alpha, Amazon, Anthropic, Cohere, Google, IBM, Microsoft, Mistral AI and OpenAI; xAI signed only the safety and security chapter. Signing is a sign of method, not a ranking of models against each other.
What a business can ask its AI provider
This is the concrete benefit of these rules for a team of 20 to 500 people: the documentation the provider owes integrators becomes a right, not a favour. Before choosing a model, or at the next contract review, four questions are enough:
- Where is the documentation for integrators (capabilities, limits, discouraged uses)?
- Where is the summary of the training data of the model you use published?
- Has the provider signed the code of practice, and which chapters?
- Was the model released before 2 August 2025? If so, what is its compliance plan for 2 August 2027?
The answers do not tell you which model is best for your task: only a test on your own examples does, as explained in our method for evaluating a model before production. Each vendor’s release history is in our AI model comparison, and the choice between API, private cloud and on-premise server in the four levels of private AI.
From the field
Depending on no single provider remains the best insurance, regulatory as well as economic. On the translation pipeline we run for Palmora Property, a property portal in six languages, switching provider divided the cost by 60 (internal measurement, on our own translation pipeline for this client, taken in August 2026; another volume or another pair of models would give another ratio): this is possible because the model is never hard-coded, but picked from a routing table that we review. The same mechanism would let us replace a model whose provider was fined or withdrawn from the market.
At national level, France has not yet designated its own enforcement authorities: where the law stands, and who would supervise what, is explained in who enforces the AI Act in France.
Date to remember: 2 August 2027, the end of the grace period for models released before 2 August 2025. To sort through your AI subscriptions and uses, and decide which ones should change provider, see our AI at the right cost offer.
Frequently asked questions
Since when can Europe fine OpenAI, Google or Mistral under the AI Act?
Since 2 August 2026. The obligations of general-purpose model providers have applied since 2 August 2025, but Article 101, which allows the Commission to impose fines, has only applied since 2 August 2026. Models placed on the market before 2 August 2025 have until 2 August 2027.
What is the maximum fine for an AI model provider?
Up to 3% of total worldwide annual turnover in the preceding financial year or €15 million, whichever is higher. The fine sanctions an intentional or negligent breach, including refusing to provide information or access to the model requested by the Commission.
Does my business become a model provider if it uses an AI API?
No. A business that uses a model through an API, even to build its own assistant, does not become its provider. It can become one by heavily modifying the model: the Commission’s indicative criterion is modification compute above one third of the original training compute.
What can you demand from an AI model provider?
The documentation intended for integrators, which describes the model’s capabilities and limits, and the public summary of its training data. You can also ask whether it has signed the code of practice and, for a model released before August 2025, what its compliance plan is for August 2027.
Sources
- The guidelines published by the Commission on 18 July 2025 (new tab)digital-strategy.ec.europa.eu
- Article 51 of the AI Act (new tab)ai-act-service-desk.ec.europa.eu
- The analysis by the law firm WilmerHale (new tab)wilmerhale.com
- Article 53 (new tab)ai-act-service-desk.ec.europa.eu
- The Cloud Security Alliance note of 29 August 2026 (new tab)labs.cloudsecurityalliance.org
- Article 55 (new tab)ai-act-service-desk.ec.europa.eu
- Article 113 (new tab)ai-act-service-desk.ec.europa.eu
- Article 101 (new tab)ai-act-service-desk.ec.europa.eu
- Article 75a (new tab)ai-act-service-desk.ec.europa.eu
- Article 111 (new tab)ai-act-service-desk.ec.europa.eu
- Code of practice for general-purpose models (new tab)digital-strategy.ec.europa.eu
The guidelines published by the Commission on 18 July 2025
Read on digital-strategy.ec.europa.eu(new tab)The Cloud Security Alliance note of 29 August 2026
Read on labs.cloudsecurityalliance.org(new tab)Jim · founder of Brain Plus AI
Also in business ai
Practical guide10 min
AI Act and GDPR: what an SME using AI must do
An SME that uses ChatGPT or a CRM with built-in AI already has obligations. This guide takes stock in October 2026: your role under the AI Act, the timetable revised in July 2026, what the GDPR requires and the steps to get compliant.
Understand9 min
AI Act and digital rules calendar: deadlines 2026 to 2028
AI Act, Data Act, Cyber Resilience Act, NIS2, e-invoicing in France and the first US state laws: every date that matters for a business, from autumn 2026 to August 2028, on one page kept up to date. For each deadline, who is covered and what to prepare.
Understand44 min
AI comparison: models, releases and scores since 2022
The major AI models released since ChatGPT, publisher by publisher: what each release changed, the score the publisher published that day, and how to read these figures without getting it wrong. A comparison kept up to date.