AI Policy

August 2 Is When the EU AI Fines Become Real

From 2 August 2026 the EU can fine GPAI model providers up to 3 percent of global turnover. If you build on their models, their documentation becomes your compliance file. What to do first.

AI PolicyBy Servola Tech Desk2026-07-093 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

August 2 Is When the EU AI Fines Become Real

Key takeaways

From 2 August 2026 the EU can fine the provider of any general-purpose AI model up to 15 million euros or 3 percent of global annual turnover, whichever is higher, and if you build on that model your own compliance file now depends on documentation the vendor is obliged to keep but may not hand you on your timeline.
The obligations, technical documentation, a training-data summary, an EU copyright policy, and information for downstream builders, have applied since August 2025, but only from 2 August 2026 does the AI Office get the power to demand documents, run evaluations, order recalls, and impose the fines.
Signing the General-Purpose AI Code of Practice buys good-faith treatment: the AI Office says it will focus on monitoring adherence and treat signature as a mitigating factor on fines, so a vendor signatory status is now a real procurement criterion, not a badge.
The operator move is to add two lines to every AI vendor contract before August: proof the model provider keeps the technical documentation and training-data summary current, and a commitment to pass you the downstream-provider information, because from August their paperwork is your defence.

What actually changes on 2 August

The substantive obligations for general-purpose AI models under the EU AI Act have been in force since 2 August 2025, but until now the AI Office had no teeth. From 2 August 2026 the Commission enforcement powers enter into application. The AI Office can request documentation and information, conduct model evaluations, request compliance and risk-mitigation measures including recall and market withdrawal, and impose fines under Article 101 of up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher.

The obligations themselves are documentation, not product bans. A provider of a general-purpose model must keep current technical documentation, write and maintain the information it passes to downstream providers who build on the model, adopt a policy to comply with EU copyright law, and publish a summary of the content used for training. Models placed on the market before 2 August 2025 have until 2 August 2027 to comply, while anything newer is expected to comply now.

Signatories get a softer landing

The AI Office has made clear that signing the General-Purpose AI Code of Practice changes how it enforces. For signatories it says it will focus its activity on monitoring adherence to the Code, will treat commitment to the Code as a mitigating factor when setting fines, and will not automatically treat a signatory as in breach if it has not yet implemented everything, assuming good faith. Google, Meta, Microsoft, OpenAI, Mistral and Anthropic are among the signatories.

That turns a vendor signatory status into a procurement fact. A model from a signatory arrives with a lighter regulatory shadow and a provider that has already committed to producing the documentation you will need. A model from a non-signatory does not, which does not make it non-compliant, but it does mean the paperwork you depend on is less certain to exist and be current when the AI Office, or your own auditor, asks for it.

What a European operator should do before August

If you deploy or build on a general-purpose model, the enforcement clock is not only your vendor problem. When you put an AI system into your product or operations you are a downstream provider, and your ability to show compliance rests on the model provider documentation flowing to you. That is a contractual dependency, so treat it like one.

Two lines belong in every AI vendor contract before 2 August: a warranty that the provider maintains the required technical documentation and training-data summary and keeps them current, and a commitment to supply the downstream-provider information the Act requires. Check whether your provider signed the Code of Practice, and if a cheaper non-signatory model is on your shortlist, price in the cost of building the compliance file yourself. The fine lands on the model provider, but the disruption of a model you cannot document lands on you.

Frequently asked questions

Who gets fined under the GPAI rules from August 2026?

The fines fall on the provider of the general-purpose AI model, not on every business that uses it. From 2 August 2026 the AI Office can fine a model provider up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher, under Article 101 of the EU AI Act. Businesses that build on a model are downstream providers with their own, lighter obligations, and they depend on the model provider documentation to meet them.

What does signing the Code of Practice do?

The General-Purpose AI Code of Practice is voluntary. The AI Office says it will focus enforcement on monitoring signatories adherence to the Code and will treat that commitment as a mitigating factor when setting fines, while still fully enforcing the underlying obligations from 2 August 2026. Google, Meta, Microsoft, OpenAI, Mistral and Anthropic are among the signatories.

What should a company do before 2 August 2026?

Confirm whether the general-purpose models you rely on come from Code of Practice signatories, and add contract terms requiring the provider to maintain the technical documentation and training-data summary and to pass you the downstream-provider information the Act requires. If you are considering a cheaper non-signatory model, budget for producing that compliance evidence yourself.

The headline number, 3 percent of global turnover, is the model provider risk, and it is easy to read it as someone else problem. It is not. From 2 August the documentation behind the model you build on stops being a courtesy and becomes the thing that keeps your own AI system defensible. Put the requirement in the contract now, while you still have the leverage of a signature you have not yet given.

EU AI ActGPAIAI OfficeCode of PracticeAI compliance

The Fine on Paper Is Not the Final Fine

A Berlin court cut a record 14.5 million euro GDPR fine to 900,000. What that says about how penalties are set, and about the first EU AI Act fines.

3 min read

Law & Regulation

Germany Now Has a Named AI Regulator

Germany has named the Bundesnetzagentur as its central AI market surveillance authority under the new KI-MIG law. Here is who enforces and what owners prepare.

3 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.

3 min read

← All articles

August 2 Is When the EU AI Fines Become Real

What actually changes on 2 August

Signatories get a softer landing

What a European operator should do before August

Frequently asked questions

The Fine on Paper Is Not the Final Fine

Germany Now Has a Named AI Regulator

The EA Buyout Now Hinges on Brussels

The Operator Brief