EU AI Act: Enforcement Powers Against General-Purpose AI Providers Kick In August 2026

What changes on August 2, 2026

The EU AI Act is rolling out in phases. Obligations for providers of so-called general-purpose AI (GPAI) models have applied since August 2, 2025. Providers were granted a one-year transition period before the European Commission could actively use its supervisory and enforcement powers. That transition period ends on August 2, 2026.

From that date, the Commission can:

• Request documentation and information
• Conduct evaluations
• Demand measures, including risk mitigation, market restriction, recall, or withdrawal
• Impose fines

For GPAI models placed on the market before August 2, 2025, a longer deadline applies: those models must be compliant by August 2, 2027.

Who is affected

The direct addressees are providers of large foundation models from the US, China, and Europe. Through EU value chains the rules also reach downstream providers — companies embedding these models in their own products. Downstream providers gain a right to lodge complaints with the Commission if they believe an upstream provider is in breach.

National market surveillance authorities also play a role. They can request the Commission to exercise its powers. A scientific panel may alert the AI Office to specific or systemic risks.

Why this matters

The shift on August 2, 2026 turns regulation from recommendation into enforcement. Until now, providers signed codes of practice and prepared voluntarily. From the deadline on, real sanctions become possible, including fines tied to global turnover.

For European companies buying AI, the negotiation position changes. Contract clauses on documentation, training data disclosures, copyright, and risk assessment can now be requested with explicit reference to the AI Act. Companies that deploy AI in high-risk domains such as medicine, law, or HR should expect additional duties.

Practical example

A German insurer uses a US model to classify claims. Until now a standard contract with anti-discrimination assurances was enough. From summer 2026 on, the insurer can demand more detailed disclosures from the provider, including on training data and model evaluation. If the provider stalls, not only can the insurer terminate the contract — a German market surveillance authority can call in the European Commission.

What companies should do now

Three concrete steps. First, maintain an AI inventory listing every model in use and its purpose. Second, review contracts with AI vendors for AI Act readiness, especially around information rights and cooperation duties. Third, name internal owners who can coordinate authority requests when they arrive.