A Cloud Security Alliance research note states that obligations on providers of general-purpose AI (GPAI) models became binding on 2 August 2025, and the Commission's enforcement powers began on 2 August 2026. This note is a secondary source; check the Commission's AI Office pages for the authoritative position.
Points from the note
- Fines can reach up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher.
- The AI Office can request documentation, commission independent evaluations, order corrective measures up to market withdrawal, and impose fines.
- Enforcement of these provisions sits with the Commission rather than national authorities.
- The GPAI Code of Practice was published on 10 July 2025; the note lists several large providers as signatories and says Meta declined.
What a downstream business should do
- Ask your model providers for their GPAI compliance evidence and any model documentation they publish.
- Record which models each of your systems depends on.
- Keep this separate from your own obligations as a deployer, which follow different timelines.
The separate delay of high-risk obligations to December 2027 is covered in our earlier article; this one concerns model providers.