GPAI enforcement: a year of duties, and now the power to fine
In short: GPAI enforcement began on 2 August 2026. If you build a product on someone else’s AI model, the duties in Articles 53 to 55 of the EU AI Act apply to that supplier and not to you. They still matter, because they entitle you to information from your supplier, and because very substantial modification of a model can make them yours.
Most companies building AI products buy the model rather than build it. If your product calls a third party’s model through an interface, that supplier has been subject to European duties since August 2025, and from 2 August 2026 the European Commission may enforce them. The Commission announced on 31 July 2026 that its AI Office would begin enforcing the EU AI Act, Regulation (EU) 2024/1689, from that date. The duties did not change on 2 August; the Commission’s power to act on them began.
What your model supplier has had to do since August 2025
Whoever builds a general-purpose AI model is subject to the documentation, transparency and copyright duties in Articles 53 to 55, set out in Chapter V of the EU AI Act. They have applied since 2 August 2025 under Article 113. Under Article 53(1) the model provider must keep technical documentation, give the companies building on its model the information set out in Annex XII, operate a copyright policy that identifies and complies with rights reservations expressed under Article 4(3) of the Copyright in the Digital Single Market Directive, and publish a summary of the content used to train the model, following a template the AI Office provides.
A supplier established outside the EU must also appoint an authorised representative in the Union by written mandate under Article 54, before it puts the model on the market. Further duties apply to the largest models. Where cumulative training compute exceeds 1025 floating point operations, Article 51(2) presumes high impact capabilities, and Article 55 then requires model evaluation, systemic-risk mitigation, serious-incident reporting and cybersecurity measures. Until a harmonised standard exists, a supplier may rely on the General-Purpose AI Code of Practice to show it complies.
For the first year those duties were unenforceable, because GPAI enforcement did not yet exist. The co-legislators applied Chapter V from 2 August 2025 under Article 113 but expressly excepted Article 101, and never brought Chapter IX, which contains the enforcement powers in Articles 88 to 94, forward at all. The Commission stated the position in its guidelines of 19 November 2025: “In the first year from 2 August 2025 onwards, the Commission cannot take any enforcement actions because its enforcement powers only enter into application on 2 August 2026.” In the same paragraph it states that from 2 August 2026 it will fine suppliers who are not fully compliant on that date. A supplier that did not comply during the first year must therefore be compliant on the day enforcement began.
GPAI enforcement applies to model providers, not their customers
A company that calls a third party’s model through an interface and builds a product on it is a downstream provider under Article 3(68): the provider of an AI system, not of a model. The Articles 53 to 55 duties do not apply to it. Buying a model in rather than building one does not bring a business within Chapter V.
The same answer holds for a UK company on the geography question, though for a different reason. Under Article 2(1)(a) the EU AI Act applies to anyone placing a general-purpose AI model on the Union market, wherever they are established. Under Article 2(1)(c) it applies to third-country businesses whose output is used in the Union, but that limb covers AI systems only and says nothing about models. A UK business told that European users of its output bring its model within the Chapter V duties has been given the AI system test rather than the model test.
Enforcement against your supplier also runs through a channel you do not sit in. Under Article 88(1) the European Commission holds exclusive supervisory and enforcement powers over general-purpose AI models and must entrust them to the AI Office, so no national regulator takes the lead. The AI Office may require documentation under Article 91, evaluate a model under Article 92 including through interface or source-code access, and require compliance measures, restriction, withdrawal or recall under Article 93. Under Article 101 the Commission may fine a supplier up to 3% of worldwide annual turnover or 15 million euros, whichever is higher, where it finds the supplier acted intentionally or negligently.
Where the line runs, and how you could cross it
Ordinary fine-tuning does not change that position. A company that adapts a model becomes the provider of the modified model, and then only in relation to the modification, where the training compute used for the modification exceeds a third of the compute used to train the original. That threshold appears nowhere in the Regulation itself; the Commission set it in its guidelines. No retrieval pipeline, prompt layer or light adaptation comes close to it, and a company that crossed it would know from its compute costs.
Two other routes matter more in practice. The first is building your own model, even a modest one, and shipping a product on top of it: at that point the Chapter V duties are yours, and the product itself becomes subject to AI Office enforcement rather than national supervision. The second is the value chain. The Digital Omnibus on AI added duties at Article 25(2) requiring the original provider to hand a new provider technical documentation sufficient to assess compliance, information on known limitations and failure modes, and targeted technical access for testing and validation, and made breach of them directly fineable. Those duties are disapplied where the original provider has clearly specified that its system is not to be turned into a high-risk system, which is a contractual point worth reading before you sign.
What GPAI enforcement lets you ask your supplier for
Several of the documents your supplier must produce are intended for you. Under Article 53(1)(b) and Annex XII the model provider must give downstream builders the information they need to understand the model’s capabilities and limitations and to comply with their own obligations. The training-content summary under Article 53(1)(d) is public. The copyright policy under Article 53(1)(c) bears on a question your own customers may put to you about the provenance of what your product generates, and on the lawful-basis questions for training data covered in web scraping for AI training. A supplier that cannot produce these documents a year after they became due has revealed its compliance position to you, and now that GPAI enforcement has begun, to the AI Office.
Your own product may separately be subject to the Article 50 transparency duties from the same date, with the transparency code of practice as the route to demonstrating compliance; those duties apply to you as the system’s provider or deployer, whoever built the model. Two supplier-side facts are worth checking in procurement. A non-EU supplier without an authorised representative in the Union has not done something Article 54 required before it put the model on the market. And a supplier relying on the free and open-source exemptions in Article 53(2) and Article 54(6) loses them where the model presents systemic risk, and the Commission reads the licence condition strictly where a provider monetises access. Neither point makes the duty yours. Both bear on whether the model under your product is going to stay available on the terms you planned for.
| What you do with AI | What you are under the EU AI Act | Do the Articles 53 to 55 model duties apply? |
|---|---|---|
| Call a third party’s model through an interface and build a product on it | Downstream provider of an AI system (Article 3(68)) | No |
| Fine-tune or adapt a third party’s model within ordinary limits | Still the provider of an AI system | No |
| Modify a model using more than a third of the original training compute | Provider of the modified model, for the modification only | Yes, for the modification |
| Train your own general-purpose model and put it on the Union market | Provider of a general-purpose AI model | Yes, in full |
| Deploy an AI system in your own business without supplying it onward | Deployer (Article 3(4)) | No, but the Article 26 deployer duties apply |
Viewpoint
I read the twelve months between duty and enforceability as the thing that will shape the first year of this regime. A supplier serving an EU-accessible interface since late 2025 has accumulated a year of documentation, copyright-policy and training-summary obligations, and the guidelines explaining them have been public since November 2025.
In our experience advising on regulated supply chains, the risk a buyer misjudges is not its own compliance but its supplier’s. If the AI Office requires your model provider to restrict, withdraw or recall a model under Article 93, your product is disrupted with it, and your contract determines what protection you have when that happens.
The Commission’s own guidelines leave open what counts as a sufficiently detailed training-content summary. Will the first Article 91 information request settle that, or will the AI Office wait for a harmonised standard?
Frequently asked questions
We build on OpenAI or a similar model. Do these duties apply to us?
No. A company that integrates a third party’s model is a downstream provider under Article 3(68), and so the provider of an AI system rather than of a general-purpose AI model. The Articles 53 to 55 duties, and the authorised representative requirement in Article 54, apply to the model provider.
Could fine-tuning make us the model provider?
Only at scale. On the Commission’s guidelines a modifier becomes the provider of the modified model, and then only in relation to the modification, where the training compute used exceeds a third of the compute used to train the original model. That threshold is a Commission criterion and appears nowhere in the Regulation.
What can we require our model supplier to give us?
Article 53(1)(b) and Annex XII require a model provider to give downstream builders the information needed to understand the model and meet their own obligations. The training-content summary under Article 53(1)(d) is public. The Digital Omnibus added handover duties at Article 25(2), including technical documentation, known limitations and failure modes, and technical access for testing.
Can the Commission fine our supplier for the year before 2 August 2026?
The duties applied from 2 August 2025, and the Commission’s guidelines say it will fine providers who are not fully compliant on 2 August 2026. Under Article 101 it must find intention or negligence. Whether it can also penalise the year in which the duties applied but Article 101 did not is not addressed, and commentary asserting that fines reach back to August 2025 goes further than the published material supports. Models on the Union market before 2 August 2025 have until 2 August 2027 under Article 111(3).
Our EU AI Act guide sets out the wider framework, including the risk tiers, the timetable and how the UK position differs. For advice on where your product falls in the AI Act’s supply chain, on what to require from a model supplier, or on the interaction between the Act and UK data protection duties, contact Rob Bratby at Bratby Law.
