The obligations for general-purpose AI models have applied since 2 August 2025. What arrived on 2 August 2026 is the toolkit to enforce them. Since that day the Commission and the AI Office can request documentation, evaluate models, require risk measures and impose fines. For a year the duty existed without an enforcement apparatus. That year is over.
For most organisations the first question is not whether they are a model provider themselves, because most are not. The question is what this does to their suppliers, and what they can now expect to receive for their own file.
Which powers became active?
The AI Act gives the Commission four kinds of instrument for GPAI models. All four have been available since 2 August 2026.
| Power | Article | What it means |
|---|---|---|
| Request information | 91 | The Commission can require from a model provider the documentation and information needed to assess compliance |
| Model evaluations | 92 | The Commission can evaluate the model itself, among other things to investigate systemic risks |
| Require measures | 93 | The Commission can require the provider to take measures, comply with the obligations or mitigate risks |
| Restrict or withdraw | 93 | As a last resort the Commission can restrict the model on the market or withdraw it |
On top of that sits the fining power. For model providers the ceiling is 15 million euro or 3 percent of total worldwide annual turnover, whichever is higher. One detail matters: failing to supply requested information, or supplying it incompletely or late, is itself a finable act. Responding slowly to an information request is not a neutral strategy.
Who is a model provider, and who is not?
This distinction decides whether these powers can be aimed at you. A provider of a GPAI model develops the model or has it developed and places it on the market under its own name or trademark. Think of the parties behind the large language models.
An organisation that uses such a model inside its own product or process is usually not a model provider. It may well be the provider of an AI system, with the duties that come with that under Article 50 among others. Watch the tipping points: substantially modifying a model, or supplying it onward under your own name, can move you into the provider role after all.
The practical question for GPAI users
You are probably not a model provider, but you do depend on one. The relevant question is what documentation your supplier can give you, and whether it matches what your own file needs. Enforcement at the top of the chain makes that documentation more available than it was a year ago.
What does this mean for existing models?
Models already placed on the market before 2 August 2025 have until 2 August 2027 to meet the obligations. That is a transitional period for the substantive duties, not an exemption from oversight.
For models placed on the market after that date the obligations apply without a transitional period, and enforcement is now active. The GPAI code of practice published on 10 July 2025 remains the practical route: signatories can rely on it to make compliance plausible, which lightens the burden of proof in a conversation with the supervisor.
What goes into your own file?
Even if you are not a model provider, this touches your governance. Three things belong in your vendor file now.
Which GPAI models sit in your chain
Record per application which underlying model is used, through which supplier, and whether that model reached the market before or after 2 August 2025. The latter determines whether your supplier is still inside a transitional period.
What documentation the supplier provides
Ask for the information the AI Act requires model providers to make available downstream. If you do not receive it, record that you asked and what the answer was. A documented refusal is more useful than an empty field.
What happens when the model changes
Models get replaced and updated. Record who tracks that, and which assessment has to run again when your supplier switches model. Without that step your file ages silently.
The full explanation of the GPAI obligations is in our route for general-purpose AI models, and the wider timeline in the overview of AI Act deadlines. Organisations that want to put their supplier file in order, from model inventory to contract terms, can turn to Embed AI.
Frequently asked questions about GPAI enforcement
Sources
Newsletter
Every Tuesday, the AI Act week ahead in 5 minutes
A practical briefing on deadlines, new guidance and enforcement, so you know what matters this week. No spam and you can unsubscribe in one click.
Practical and short · No spam · One-click unsubscribe