ZetrixwebWhat changed on 2 August 2026
The obligations on providers of general-purpose AI models began to apply on 2 August 2025. A one-year gap applied to enforcement, not to the duties themselves. From 2 August 2026 the Commission, acting through the AI Office, has exclusive supervisory and enforcement powers over those providers, including the ability to request information, conduct evaluations, order measures, and impose fines of up to 3 percent of global annual turnover or 15 million euros, whichever is higher.
Models already on the EU market before 2 August 2025 are generally reported to have until 2 August 2027 to meet the relevant obligations. The voluntary General-Purpose AI Code of Practice remains a recognized route to show compliance, and not signing it removes a mitigating factor rather than exempting a provider from enforcement.
What builders should ask their providers
Treat this as ordinary supplier due diligence. Ask whether the provider has signed the Code of Practice or how else it demonstrates compliance, what documentation it provides to downstream developers, and how it handles copyright and training-data transparency questions.
Ask also about incident handling and about how changes to models are communicated, because a sudden model change or restriction can affect your product. Keep the answers on file; they are useful in your own documentation and in customer security reviews.
| Question | Why it matters | Where to record it |
|---|---|---|
| How is compliance demonstrated? | Signals the provider's posture and mitigating factors | Vendor file |
| What documentation is shared downstream? | Feeds your own technical documentation | Technical file |
| How are model changes announced? | Avoids surprise behavior changes in production | Runbook |
| What happens on a regulatory restriction? | Defines your continuity and exit options | Contract and risk register |
Contracts and architecture
Add clauses covering notice of regulatory action, access to the documentation you need, and reasonable exit or substitution rights. Architecturally, keep the model behind a thin adapter so substituting providers is a configuration and testing exercise, not a rewrite.
That design also helps with the broader pace of model change, which our article on building for more capable AI covers.
Building on foundation models for EU customers? Talk to us about vendor diligence and a provider-agnostic design.
Key takeaways
- From 2 August 2026 the Commission, via the AI Office, can investigate and fine general-purpose AI providers, with fines up to 3 percent of global turnover or 15 million euros.
- The duties applied from August 2025; only enforcement waited a year. Older models are reported to have until August 2027.
- Builders are not the target but depend on supplier compliance; ask for evidence and keep it on file.
- Add notice and exit clauses and keep the model behind a thin adapter.