What happens on August 2, 2026 under the EU AI Act?

Chapter V of the EU AI Act enters full force, giving the European Commission direct enforcement powers over providers of general-purpose AI models — including the ability to request documentation, conduct audits, impose binding obligations, and levy fines of up to €15M or 3% of global annual revenue for non-compliance.

Which AI providers are in scope for the August 2 GPAI enforcement deadline?

Any provider that placed a general-purpose AI model on the EU market is subject to Chapter V obligations. Providers whose models meet the systemic-risk threshold (trained on compute above 10²⁵ FLOPs, or designated by the Commission regardless of compute) face additional obligations including mandatory cybersecurity frameworks, adversarial testing, incident reporting, and model evaluations.

What are the cybersecurity-specific obligations for systemic-risk GPAI models?

Article 55 of the EU AI Act requires systemic-risk GPAI providers to implement and maintain a state-of-the-art cybersecurity framework appropriate to the risks, conduct adversarial testing and red-team evaluations before and during deployment, report incidents involving the model to the Commission within specified timeframes, and put in place ongoing risk mitigation measures.

Do legacy GPAI models — those already deployed — have to comply immediately?

GPAI models placed on the EU market before August 2, 2025 have a one-year grace period: they must achieve full Chapter V compliance by August 2, 2027. Models deployed after August 2, 2025 are in scope now.

18 Days: EU AI Act GPAI Enforcement Begins August 2

Eighteen days from today, the European Commission’s enforcement powers over general-purpose AI model providers become fully operational. August 2, 2026 is not a new announcement — it has been on the EU AI Act implementation timeline since the regulation entered force. But it is the date when enforcement shifts from self-reported compliance to Commission-initiated action, and it arrives while most GPAI providers are still working out what their compliance frameworks actually look like in practice.

What Changes on August 2

Chapter V of the EU AI Act established obligations for GPAI model providers — the organisations that train and distribute large foundation models, whether through commercial APIs, open weights, or enterprise licensing. Those obligations have been on the books since August 2, 2025. What activates on August 2, 2026 is the Commission’s enforcement mechanism: the power to request documentation without waiting for a complaint, conduct audits, and impose fines without a member state intermediary.

The European AI Office, established to oversee GPAI providers, has been in preparatory mode. After August 2, it has formal powers to act.

For the vast majority of GPAI providers — those operating models below the systemic-risk threshold — the August 2 obligations are tractable: maintain transparency documentation, publish training data summaries, comply with copyright obligations, and make a summary of training data available to the public. Non-compliance is a regulatory risk, not an immediate existential one.

The more demanding obligations apply to systemic-risk GPAI models.

The Systemic-Risk Tier

The EU AI Act designates models trained on compute above 10²⁵ FLOPs as presumptively systemic-risk. The Commission can also designate models that fall below this threshold based on their market reach, capabilities, or assessed impact on the European AI ecosystem. Currently, a small number of frontier models from major providers fall into this category.

Systemic-risk designation triggers Article 55, which is where the cybersecurity requirements concentrate.

Article 55 obligations for systemic-risk GPAI providers:

Implement a state-of-the-art cybersecurity framework appropriate to the risks of the model — the regulation does not prescribe a specific framework, but the AI Office’s published guidance references ISO/IEC 27001, NIST CSF, and the ENISA AI security guidelines as relevant benchmarks.
Conduct adversarial testing, including red-team evaluations, before placing a model on the market and on an ongoing basis thereafter. For models already deployed, this means establishing a continuous testing programme, not a one-time pre-deployment exercise.
Report incidents to the Commission where those incidents relate to the model’s cybersecurity — the timeline mirrors the GDPR breach notification period in urgency, though the specific reporting window is defined in supplementary Commission guidance.
Put in place risk mitigation measures for identified systemic risks, documented in a way the AI Office can audit.

This is a direct regulatory mandate for AI red teaming and adversarial robustness testing, something most providers have treated as a voluntary or reputationally-motivated practice. After August 2, for systemic-risk providers, it is neither voluntary nor reputational — it is a compliance requirement backed by enforcement powers.

The Fine Regime

Non-compliance with GPAI obligations carries fines of up to €15M or 3% of total global annual revenue, whichever is higher. For a provider with significant global revenues, 3% can represent a materially larger number than €15M. The fine regime applies to both document-request non-compliance and substantive violations of Article 55 obligations.

The Commission can also impose periodic penalty payments to compel ongoing compliance where a provider fails to respond to requests or correct deficiencies after an initial decision.

Legacy Models: The 2027 Grace Period

GPAI models that were placed on the EU market before August 2, 2025 have a one-year grace period under the regulation’s transitional provisions. Those models must achieve full Chapter V compliance by August 2, 2027. This is relevant for providers operating models that predate the EU AI Act’s entry into force — but it does not mean no obligations apply in the interim. The AI Office expects providers of legacy models to be actively working toward compliance and to respond to documentation requests during the transition period.

Models first placed on the market after August 2, 2025 are in full scope from day one. There is no grace period for newer deployments.

What Security Teams Should Be Tracking

For organisations that develop, deploy, or procure AI from GPAI providers, August 2 has practical implications at three levels.

If you are a GPAI provider: the immediate priorities are confirming whether your models fall into the systemic-risk tier, establishing a defensible cybersecurity framework (documented to Article 55 standards), and standing up an adversarial testing programme that can generate evidence for the AI Office if requested. If you have not yet produced the required technical documentation, the Commission can now request it.

If you deploy GPAI models in your product or service: providers falling within systemic-risk GPAI scope now face ongoing compliance obligations that affect their roadmaps, release timelines, and the incident reporting they owe to the Commission. Contracts with GPAI model providers that don’t address their regulatory obligations leave deployers exposed if a model-related incident triggers disclosure requirements.

If you are a buyer of AI services in the EU: the August 2 enforcement date makes GPAI provider compliance status a procurement question. Providers subject to Article 55 obligations who cannot demonstrate compliance are carrying regulatory risk that may affect service continuity.

The regulation is structured to give the AI Office investigative flexibility — it can ask for documentation, conduct audits, and build cases over time rather than requiring a single triggering incident. That is a different posture from GDPR enforcement, which typically begins with a reported breach. Proactive regulatory engagement is more likely under the GPAI enforcement model.