EU AI Office can now enforce general-purpose model rules

The EU's rules for general-purpose AI (GPAI) models are no longer a future-tense compliance project. In a 19 August 2026 briefing, Taylor Wessing lawyers Nils von Reith and Thomas Kahl wrote that the European Commission and the AI Office have been able to enforce those duties since 2 August 2026.

The briefing is legal analysis of Regulation (EU) 2024/1689 (the EU AI Act), not an Official Journal text. The dates and article numbers below are what that briefing states.

What is already in force

According to the briefing:

• Core GPAI provider obligations have applied since 2 August 2025.
• Providers of GPAI models placed on the market before that date have until 2 August 2027 to comply (Art. 111(3)).
• Commission and AI Office enforcement powers for GPAI have applied since 2 August 2026.
• Commission Implementing Regulation (EU) 2026/1755 of 20 July 2026, in force since 10 August 2026, sets procedure for opening proceedings, interim measures, and a five-year limitation period for fines.

GPAI is the model-level regime in Chapter V (Articles 51-56). Article 53 is the core provider duty list; Article 55 covers models with systemic risk; Article 54 requires an EU authorised representative for many third-country providers.

Who counts as a provider

The briefing says a provider is any entity that develops a GPAI model, or has one developed, and places it on the EU market under its own name or trademark — paid or free. Making available can include APIs and downloads in a commercial activity, and the rules can apply to companies established outside the EU.

A company can also become a provider by significantly modifying a third-party model. The briefing highlights a compute test: extra training compute of at least one third of the original can make the modifier responsible for the elements it controls.

Article 53(1) duties listed in the briefing include technical documentation (Annex XI), information for downstream providers (Annex XII), a copyright-compliance policy (including DSM Directive opt-outs), and a public training-content summary on the AI Office template. Free and open-source models with public parameters get a partial exemption from some Article 53(1) duties, except models with systemic risk.

Enforcement teeth

Since 2 August 2026, Articles 88-94 give a dedicated GPAI enforcement path, the briefing says. That includes requests for documents, API or source-code access for model evaluations (Art. 92), orders to comply with Articles 53 and 54, and — where an evaluation raises serious, substantiated systemic-risk concerns — risk-mitigation measures or a restriction, withdrawal, or recall of a model (Art. 93). The AI Office may open a structured dialogue first; commitments can be made binding.

Fines under Article 101(1) can reach 3% of worldwide annual turnover or 15 million euros, whichever is higher, for intentional or negligent breaches, ignored information requests, ignored Article 93 measures, or refused model access. Interim measures are possible on prima facie evidence.

Systemic-risk line

Commission GPAI guidelines cited in the briefing use an indicative training-compute threshold of 10^23 FLOP for GPAI. Models with systemic risk are presumed to have high-impact capabilities above 10^25 FLOP, or may be designated using Annex XIII criteria. Providers must notify the AI Office within two weeks of meeting, or expecting to meet, the threshold.

Narrow single-purpose models, pure scientific R&D, and military or national-security AI sit outside the GPAI regime as the briefing describes it.

This is a summary of a law-firm alert. It is not legal advice.

Source: GPAI obligations under the EU AI Act: Enforcement has started 2 August 2026, Taylor Wessing, 19 August 2026.