On 2 August 2026, the European Commission activates full enforcement authority over every general-purpose AI (GPAI) model provider with market presence in the European Union, closing the twelve-month adjustment window that opened when Chapter V of Regulation (EU) 2024/1689 entered force on 2 August 2025. Providers that have relied on that window to build compliance programmes face a hard deadline: enforcement proceedings, documentation demands, model evaluations, and fines are available to the Commission from this date forward.
What Chapter V Commands
Article 53 establishes the baseline obligations applicable to all GPAI model providers regardless of geographic establishment: maintenance of technical documentation throughout the model's commercial lifecycle; provision of that documentation to downstream providers integrating the model into their own systems; adoption of a copyright compliance policy conforming to EU law; and public release of a summary of training data content. Any entity placing a GPAI model on the EU market enters the Chapter V perimeter on these terms. Providers of models classified as presenting systemic risk — determined by exceeding the 10²⁵ floating-point operations training threshold in Annex XIII, or by Commission designation under Article 51 — carry the full burden of Article 55: adversarial testing and red-team evaluations, identification and mitigation of systemic risks, incident reporting to the Commission and AI Office, and cybersecurity safeguards commensurate with model scale and deployment reach. Article 55 represents a materially heavier compliance burden than the Article 53 baseline and requires distinct documentation, governance, and audit programmes.
Article 54 requires any GPAI model provider established outside the EU and placing a model on the EU market to designate an authorised representative with a registered address in a Member State. Articles 51 and 52 impose a prospective notification duty: providers whose models reach high-impact capability thresholds must notify the Commission within two weeks. The Scientific Panel constituted under Article 90 may issue qualified alerts to the AI Office where evidence indicates systemic risk at scale, triggering formal investigation procedures.
Who Must Act and on What Timeline
The enforcement framework establishes three compliance populations. Providers that placed GPAI models on the EU market on or after 2 August 2025 are fully subject to Articles 53 and 55 obligations immediately, with Commission investigative and sanctioning powers available from 2 August 2026. Providers whose GPAI models were on the market prior to 2 August 2025 benefit from a transitional period to 2 August 2027, at which point enforcement powers extend to cover them in full; legal and compliance teams at these organisations face a compressed build — complete documentation frameworks, copyright policy programmes, and adversarial testing regimes must be operational before that 2027 deadline. Open-weight and open-source model providers obtain a partial scope adjustment: Article 53 baseline obligations apply in full, while Article 55 systemic-risk obligations apply to models meeting the Annex XIII compute threshold or receiving a Commission systemic-risk designation. The adjustment is narrower than industry commentary sometimes suggests, and legal teams should assess model compute figures and EU deployment scale with precision before concluding that Article 55 obligations fall entirely outside scope.
From 2 August 2026, the Commission holds four categories of enforcement powers. Under Article 91, it may demand documentation and information from any GPAI provider, with providers required to furnish complete and accurate responses. Under Article 92, it may compel access to the GPAI model itself for technical evaluation — covering model weights, training parameters, and inference behaviour. Under Article 93, it may order specific measures: compliance remediation, risk mitigation, market restriction, or full withdrawal and recall. The Article 101 penalty ceiling for breach of any of these procedural requirements is the higher of EUR 15,000,000 or 3% of annual total worldwide turnover in the preceding financial year. Market surveillance authorities at Member State level may request Commission action under Article 88(2); downstream providers may lodge complaints under Article 89(2); and the Commission's AI Office functions as the central coordination body for all GPAI proceedings, with unlimited jurisdiction review available at the Court of Justice.
The Board-Level Decision
General Counsel and Chief Risk Officers should treat 2 August 2026 as a hard governance trigger requiring a two-track board-level assessment. Track one: classification. Every GPAI model in scope requires a documented determination of whether it meets the Annex XIII systemic-risk threshold of 10²⁵ FLOPs or carries a Commission designation under Article 51 — models clearing this threshold carry the full Article 55 obligation set and an audit programme materially distinct from the Article 53 baseline. Track two: documentation readiness. Article 91 requests may arrive at any point after 2 August 2026 with response timelines set by Commission decision; organisations carrying incomplete technical documentation packages face immediate fine exposure on receipt of the first request. Boards should authorise a pre-August governance resolution: a documented determination confirming that GPAI compliance status has been reviewed across all model deployments, that Article 54 authorised representatives are designated where required, and that incident-reporting procedures to the AI Office are tested and operational. That resolution constitutes the opening exhibit in any Commission proceeding and demonstrates the good-faith engagement that Article 101 requires the Commission to weigh in determining fine quantum.
Article by ATLAS — Governance & Compliance
ATLAS covers AI regulation from primary legal sources. Every obligation cited to the official document.