GPAI enforcement since 2 August 2026: what Mittelstand deployers need to know now

As of October 2026

Key numbers at a glance

• Since 2 August 2026: the European Commission's powers over providers of general-purpose AI (GPAI) models apply. They include requests for information, access to a model for evaluations, orders for risk mitigation measures and fines of up to 3% of global annual turnover (Art. 101 AI Act; alternatively EUR 15 million, whichever is higher), as well as requiring a model to be restricted, withdrawn or recalled (Commission AI Act Service Desk, Art. 101). The addressee is the provider, not you as deployer.
• Legacy models: GPAI models placed on the market before 2 August 2025 have until 2 August 2027 to comply under Art. 111(3) AI Act (Art. 111).
• The obligations (Art. 53/55) have applied since 2 August 2025 to newly placed-on-market models. The Commission's enforcement power came one year later. According to the Commission, the AI Office held technical compliance dialogues with providers during that time, will continue them and uses formal powers where dialogues are not sufficient.
• GPAI Code of Practice (published 10 July 2025): the voluntary compliance pathway. According to the Commission, most relevant providers have signed and are implementing it. Signatories may rely on the Code as a way to demonstrate compliance until harmonised standards are available. A statutory presumption of conformity under Art. 53(4) flows from harmonised standards, not from signing the Code alone (code-of-practice.ai).
• You are not the GPAI provider (that is, for example, OpenAI, Anthropic, Google, Mistral). As a deployer you should still know whether your provider meets its obligations, because otherwise you lack information you need for your own obligations.

Why this post is still relevant

The AI Act covers more than the high-risk rules under Annex III. Since the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026), the Annex III rules apply from 2 December 2027 and the rules for AI embedded in regulated products (Annex I) from 2 August 2028 (Commission). The GPAI provider obligations (Art. 53/55) apply independently of that since 2 August 2025, and the Commission's enforcement powers since 2 August 2026 (a transitional period until 2 August 2027 applies to legacy models). According to the Commission, the Omnibus also extends the AI Office's oversight of certain systems built on GPAI models.

You are not the provider yourself. You use a GPAI model from a provider, for example via an API. If your use case is classified as a high-risk system under Art. 6(2) and Annex III (taking the Art. 6(3) exceptions into account), Art. 26(1) requires you from 2 December 2027 to use the system in accordance with the provider's instructions for use. Until then this is preparation. If you are also a downstream provider integrating a GPAI model into your own high-risk AI system, additional information duties under Art. 53(1)(b) bind the GPAI provider. If it does not deliver, you lack the basis for your own compliance.

So: you should know whether your LLM providers meet their obligations and which obligations apply to them at all.

The four GPAI provider obligations under Art. 53

1. Technical documentation (Art. 53(1)(a), Annex XI)

A GPAI provider must, subject to the open-source exception (see below) and the transitional period for legacy models, maintain detailed model documentation: technical properties, training details, energy consumption, intended use. This Annex XI documentation goes on request to the Commission and national supervisory authorities, not directly to you as deployer. The separate Annex XII information (see obligation 2) goes to downstream providers that integrate the model into their own AI system, not to every deployer.

What you can do as deployer (recommendation): ask your provider whether it maintains the Annex XI documentation and which documents it makes available to customers. That something is not publicly viewable does not mean the provider breaches its obligation.

2. Information for downstream providers (Art. 53(1)(b), Annex XII)

The GPAI provider must inform downstream providers that integrate the model into their own AI system about capabilities and limitations, so you can fulfil your own obligations (e.g. under Art. 16 for high-risk AI systems).

What you check (if you are a downstream provider): do you have a "GPAI Provider Information Pack" or comparable document? If the provider only says "Use our API responsibly", that is not Annex XII-conformant information. Ask for it in writing.

3. Copyright compliance policy (Art. 53(1)(c))

The provider must have a written policy describing how it complies with EU copyright law, particularly the text and data mining opt-out under Art. 4(3) of Directive (EU) 2019/790.

What you check: ask your provider whether it has implemented a copyright policy and how it applies it.

4. Training content summary (Art. 53(1)(d))

The provider must publish a publicly available summary of training content, based on a template provided by the AI Office.

What you check: on the provider's website or trust centre this summary should be findable. If only "We trained on a diverse dataset" is there, that is not Art. 53(1)(d) conformant.

Plus: Art. 55 for GPAI models with systemic risk

If your provider supplies a GPAI model with systemic risk (classified by high-impact capabilities, or by a Commission decision for equivalent impact, Art. 51), four additional obligations apply:

• Model evaluation under standardised protocols, including adversarial testing
• Risk assessment and mitigation at EU level
• Incident reporting to the AI Office for "serious incidents" without undue delay
• Cybersecurity for the model and its infrastructure

Practical impact: ask your provider whether its model is classified as a GPAI model with systemic risk. If yes, ask for information on evaluations and incident-response procedures, or for a statement that it fulfils Art. 55. That the Commission can fine providers here since 2 August 2026 concerns the provider, not you.

The GPAI Code of Practice

On 10 July 2025 the final GPAI Code of Practice was published. It is voluntary. Signatories may rely on the Code as a way to demonstrate compliance until harmonised standards under Art. 40 are available. A presumption of conformity in the strict sense of Art. 53(4) flows from those harmonised standards, not from signing the Code alone. The Commission names the Code as the means by which most relevant providers implement their obligations, and a taskforce of signatories meets regularly (Commission).

What you check: is your provider on the signatory list (code-of-practice.ai)? If yes, you have an indication that it follows a recognised pathway. If not, check the Art. 53 obligations individually. That is more effort but doable.

The five deployer steps

What you should concretely do now:

1. Inventory of your GPAI usage: which models, from which providers, in which use cases. Output: table with provider, model, use case, falls-in-Annex-III (yes/no).

2. Provider compliance check per supplier: Code of Practice signatory? If no, Art. 53 compliance statement available? As a recommendation to the provider, ask whether it maintains the Annex XI documentation (which goes to authorities on request), whether you as a downstream provider receive the Annex XII information, how its copyright policy is implemented and where the training summary is published.

3. Gap list sent to the provider: what is missing, what you need. Polite, but in writing.

4. Implement your own deployer obligations under Art. 26 for Annex III use cases (Annex III rules apply from 2 December 2027), see our AI Act 90-day plan. In Germany the Bundesnetzagentur is, as a rule, the competent market surveillance authority for your own obligations, see KI-MIG and the Bundesnetzagentur.

5. Backup plan in case a provider does not meet its obligations: which alternative supplier? This switch is non-trivial in a high-risk setup, so have a concept ready.

Two common disputes

"We just use the OpenAI API. Do we really need all this?"

If your system is classified as high-risk under Art. 6, yes. Annex III use cases (HR/employment, education, critical infrastructure, law enforcement etc.) are high-risk unless an Art. 6(3) exception applies (profiling always remains high-risk). You are then deployer of a high-risk AI system, and Art. 26(1) requires you to use the system in accordance with the provider's instructions (the Annex III duties apply from 2 December 2027, until then this is preparation). If you are also a downstream provider (integrating the GPAI model into your own AI system), Art. 53(1)(b) Annex XII information from the GPAI provider applies on top. If either is missing at the provider, you lack the basis for your own compliance.

"What about open-source models like Llama?"

Art. 53(2) contains an open-source exception for models without systemic risk that are released under a free and open-source licence (access, usage, modification and distribution permitted) and whose parameters, including the weights, model architecture information and usage information, are made publicly available: then obligations (1)(a) technical documentation and (1)(b) downstream information fall away. Whether a specific model meets these conditions has to be checked case by case (Commission, GPAI FAQ). But the copyright policy (1)(c) and the training summary (1)(d) remain. And open models can be classified as systemic risk under Art. 51, for example by high-impact capabilities or by a Commission decision. At that point the open-source exception does not apply and the additional Art. 55 obligations kick in.

Bottom line

2 August 2026 was not "the AI Act enters into force", the Act has been in force since 2024, and the GPAI obligations have applied since 2 August 2025. It was the day from which the Commission can enforce against GPAI providers. For you as a Mittelstand deployer the task remains to ask your providers whether they delivered.

Which of your GPAI providers has signed the Code of Practice, and which one do you still need to follow up with?

Sources

• European Commission AI Act Service Desk: enforcement powers over providers of the most advanced models
• European Commission, 27 July 2026: AI Omnibus enters into force
• European Commission: Signatory Taskforce of the GPAI Code of Practice
• AI Act, Art. 101 (fines for GPAI providers) and Art. 111 (transitional provisions)
• European Commission AI Act Service Desk: Art. 6 (classification as high-risk system)
• GPAI Code of Practice
• European Commission: General-purpose AI models in the AI Act, questions and answers