AI Policy

Brussels Can Now Pull the Model You Build On

From 2 August 2026 the European Commission can demand model access, order risk mitigation and withdraw a general-purpose AI model from the EU market. Fines reach 3 percent of worldwide turnover or 15 million euros.

AI PolicyBy Servola Tech Desk2026-08-045 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Brussels Can Now Pull the Model You Build On

Key takeaways

From 2 August 2026 the European Commission can order a general-purpose AI model restricted, withdrawn or recalled from the EU market, which turns your vendor's compliance problem into your product's availability problem.
The fine ceiling is 3 percent of worldwide annual turnover or 15 million euros, whichever is higher, under Article 101. That number lands on the model provider and not on you, which is precisely why it is the wrong number to plan around.
Article 92 lets the Commission evaluate a model directly, and refusing to grant access for that evaluation is itself a finable act. Commercial confidentiality is not an answer to the request.
Models placed on the EU market before 2 August 2025 have until 2 August 2027. If your stack runs on an older model version, your real exposure date is next year, not this month.
Read your AI vendor contract this week and look for a continuity clause that names regulatory withdrawal. Terms written before this month almost always treat availability as a service-level question rather than a regulatory one.

What actually changed on 2 August

The obligations on general-purpose AI model providers have been law since 2 August 2025. What arrived on 2 August 2026 is the enforcement machinery: the European Commission, acting through its AI Office, may now exercise supervision and enforcement powers against those providers. The one-year gap was deliberate, an adjustment period written into the regulation rather than a delay. It has now expired.

The powers are set out plainly. Article 91 lets the Commission request technical documentation and any other necessary information, and providers are on the hook for supplying anything incorrect, incomplete or misleading. Article 92 lets the Commission carry out evaluations of a model, including through independent experts and members of the scientific panel. Article 93 lets the Commission require a provider to take compliance steps, to implement risk mitigation where systemic risk is identified, and to restrict the making available on the market, withdraw or recall the model. Article 101 sets the fines.

The amendments known as the AI omnibus entered into force on 27 July, days before the enforcement date. The sequence matters for anyone reading the text: the rules being enforced from this month are the amended rules, not the 2024 version many internal compliance memos were written against.

The fine is the headline, the withdrawal is the risk

Why it matters: almost every summary of this date leads with the money, 3 percent of worldwide annual turnover or 15 million euros, whichever is higher. That is a real number and it is genuinely large for a frontier lab. It is also the power least likely to change anything in your operation, because it is levied on the provider's balance sheet. You do not pay it, and it does not interrupt you.

Article 93 is the one that reaches into your stack. The Commission can require that a model be restricted on the market, withdrawn or recalled. There is no carve-out for the fact that a European company has already built a product on top of it. If the model your document pipeline, your support triage or your code assistant depends on is withdrawn from the EU market, the enforcement action is against your supplier and the outage is yours.

The asymmetry: the provider has lawyers, notice, a hearing and the option to negotiate remediation. You have a service that stops. Nothing in the regulation obliges the provider to give you warning, and nothing in a standard enterprise agreement obliges them to make you whole for a regulatory withdrawal, because that category of event did not exist when most of those agreements were signed.

The access power that has no confidentiality defence

Article 92 deserves separate attention because it breaks an assumption that has held for years. The Commission may evaluate a general-purpose AI model, and it may use independent experts to do so. Under Article 101 the grounds for a fine include refusing to provide access to a model for evaluation. A provider that declines on trade-secret grounds is not protected by that refusal, it is exposed by it.

Read that from the buyer's side. It means the models sold into the European market are now models that a regulator can compel access to, and it means a provider's willingness to operate in Europe is a statement about its willingness to be evaluated. Some providers will accept that trade, and the ones that do will be measurably more durable suppliers. Some will conclude that the European market is not worth the exposure, and that decision will not be announced as a compliance decision. It will look like a region being quietly dropped from a product page.

The transitional rule is the detail most operators miss. Providers of models placed on the market before 2 August 2025 have until 2 August 2027 to comply. A great many production systems in Europe are pinned to an older model version for reproducibility, and those versions sit in the transitional class. The pinning that protects your outputs also sets your compliance clock a year later than you think.

What to do with the next twelve months

Treat model availability as a supply question rather than a service-level one. The practical test is simple: if your primary model became unavailable in the EU on thirty days notice, what breaks, how long does the switch take, and who signs off on the output difference? Most teams can answer the first part and almost none can answer the third, because the validation work that made the current model acceptable was never designed to be repeated in a hurry.

The concrete step: open the AI clauses in your two largest vendor agreements and search for the word withdrawal. If it appears only in the context of you terminating, the contract does not cover this. What you want is a continuity obligation that names regulatory action as a trigger, plus a commitment to maintain an equivalent model available to EU customers. That is a negotiable term right now, in the window where providers want European enterprise logos, and it will be much harder to obtain after the first enforcement action makes the risk legible to everyone.

Then diary 2 August 2027. If any part of your production stack depends on a model version placed on the market before August 2025, that is the date its transitional protection ends, and it is the date to have a validated alternative already tested rather than merely identified. A year is enough time to do this calmly. It is not enough time to do it twice.

Frequently asked questions

Does this apply to us if we only use a model rather than build one?

The enforcement powers described here apply to providers of general-purpose AI models, not to you as a deployer. The exposure is indirect but real: the Commission's remedies act on the model you depend on. Separate obligations do apply to deployers under other parts of the AI Act, and those depend on what your system does and the risk class it falls into, which is a different assessment from this one.

Which models are affected right now?

General-purpose AI models placed on the EU market from 2 August 2025 onward are in scope for enforcement from this month. Models placed on the market before that date have until 2 August 2027. In practice this means the current flagship models from the major providers are inside the enforcement perimeter today, while older pinned versions are not yet.

Can the Commission really compel a provider to hand over a model?

It can require access for the purpose of evaluation under Article 92, and refusal to provide that access is listed among the grounds for a fine under Article 101. This does not mean weights are published or shared with competitors. It means a provider cannot use confidentiality as a reason to decline an evaluation by the Commission or the independent experts acting on its behalf.

The European market has spent two years being told that the AI Act was a documentation exercise. From this month it is a market-access power, and the difference shows up in the one place operators feel it, which is whether the thing they built on is still there next quarter. Firms that treat their model provider as a supplier, with continuity terms and a tested alternative, will absorb the first enforcement action as an inconvenience. Firms that treat it as a utility will discover that utilities are regulated too.

EU AI ActAI OfficeEuropean CommissionGPAIArticle 93vendor riskmodel availabilitycompliance

Your AI Vendors Face EU Fines From August 2

The 2026 AI Act delay pushed the high-risk deadlines to 2027 and 2028, but it left the enforcement clock on general-purpose AI providers untouched. From 2 August 2026 the European Commission can fine any GPAI model maker up to 3 percent of global turnover. Here is what that reaches on your desk.

3 min read

AI Policy

The Only Binding AI Check Left Is European

OpenAI has staffed recursive self-improvement research and publishes dedicated roles for it. The US office its own blueprint nominated to monitor that risk has had no permanent director since 20 July. From 2 August the EU AI Office is the oversight that can actually reach your vendor.

5 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.