EU AI Act GPAI Compliance Checklist: August 2026 Enforcement

Image: Pexels, used under the Pexels License.

Since August 2, 2026, the European Commission can fine GPAI providers and order measures such as recalls or market withdrawals. The GPAI obligations themselves have applied since August 2, 2025, so a model released after that date had to comply on release. If you haven't started, you are already late. This checklist covers the four core obligations and who they actually apply to.

Who This Applies To

The GPAI rules apply to providers of general-purpose AI models, companies that develop a model and place it on the EU market, whether through an API, open weights or a platform. The companies that signed the Commission's General-Purpose AI Code of Practice, among them OpenAI, Anthropic, Google, Microsoft, Mistral AI and Cohere, are all in this group. So is a startup that trains its own general-purpose base model.

This does NOT apply to:

• Companies using a GPAI API in their product (the AI Act calls you a downstream provider of an AI system, not a GPAI provider)
• Companies building AI applications on top of third-party foundation models
• Companies making minor changes to someone else's model: the Commission's GPAI guidelines say only those making significant modifications take on GPAI provider obligations

If your AI product is "we built a customer service assistant for banks on GPT-4", you are not a GPAI provider. Your obligations come from what your system does: provider obligations for a high-risk AI system if the use case is in Annex III, or the Article 50 disclosure rules if people talk to it directly.

Open-source exception (Article 53(2)): GPAI models released under a free and open-source licence, with model weights, architecture, and usage information publicly available, are partially exempt. Open-source GPAI providers must still comply with Step 2 (training content summary) and Step 3 (copyright policy), but are exempt from Step 1 (technical documentation) and Step 4 (information for downstream providers). The exemption does not apply to models with systemic risk.

Models already on market before August 2, 2025 (Article 111(3)): providers of these models must comply by August 2, 2027. Article 111(3) covers all the obligations of the regulation, so the date applies to Steps 1-7, not only to Article 53.

Are You a GPAI Provider? A Five-Question Self-Test

Answer in order. The first clear "no" usually settles it. The thresholds come from the Commission's guidelines on the scope of GPAI provider obligations (C(2025) 7719); they are indicative criteria, not lines written into the Act.

1. Did you train the model, or modify someone else's with a large share of its compute? If you only call another company's model through an API, you're a downstream provider of an AI system (Article 3(68)), not a GPAI provider. The guidelines count fine-tuning as a modification, and a modifier becomes the provider of the modified model only when the modification uses more than a third of the original model's training compute. If you can't know or estimate that figure, use a third of 10²³ FLOP instead, or a third of the systemic-risk threshold when the original model has systemic risk. A modifier who crosses the line owes documentation and training data duties only for the modification.
2. Is the model general-purpose? Article 3(63) asks whether it displays significant generality and can competently perform a wide range of distinct tasks. The Commission's indicative test: training compute above 10²³ FLOP and the model can generate language (text or audio), text-to-image or text-to-video. A narrow classifier usually fails it. Models used only for research, development or prototyping before release are outside the definition.
3. Have you placed it on the EU market? The guidelines' examples: an API, a software library, an upload to a public repository, a cloud service, a copy installed on a customer's infrastructure, a chatbot or mobile app offered in the EU, and use in internal processes that are essential to a product or service for third parties or that affect people's rights in the EU. Where you're established doesn't matter (Article 2(1)(a)); a provider outside the EU must appoint an authorised representative in the EU before placing the model on the market (Article 54).
4. Is it released under a free and open-source licence with the weights public? Then Steps 1 and 4 below drop away and Steps 2 and 3 stay (Article 53(2)), unless the next answer is yes.
5. Did training compute exceed 10²⁵ FLOP, or has the Commission designated the model? Then the model is presumed to have systemic risk (Article 51(2)), you notify the Commission within two weeks, and all seven steps apply, open weights or not.

Image: Pexels, used under the Pexels License.

The 7-Step GPAI Compliance Checklist

All seven have applied since August 2, 2025; for models placed on the market before that day, the deadline is August 2, 2027 (see the transition section below).

The Commission's power to fine (Article 101) and to request measures started on August 2, 2026, which is why that date gets the headlines.

Screenshot: "Guidelines for providers of general-purpose AI models", European Commission, Shaping Europe's digital future (taken October 19, 2026).

Step 1: Technical Documentation (Annex XI)

Article 53(1)(a) requires documentation of the model, "including its training and testing process and the results of its evaluation", containing at minimum the Annex XI items:

• What the model is meant to do, the kinds of AI systems it can be built into, and the acceptable use policies
• Release date and distribution methods, architecture and number of parameters, input and output modalities, licence
• Design specifications and training methodology, including key design choices and what the model optimises for
• Training, testing and validation data: type, provenance, curation methods (cleaning, filtering), number of data points, how data was obtained and checks for unsuitable sources and biases
• Compute used for training (for example floating point operations) and training time
• Known or estimated energy consumption

Systemic-risk models add evaluation strategies and results, adversarial testing measures and the system architecture (Annex XI, Section 2).

Format: the law sets no format. The documentation is kept up to date and handed to the AI Office or national authorities on request.

Step 2: Training Data Summary

Publish a sufficiently detailed summary of the content used to train the model. Article 53(1)(d) says it follows "a template provided by the AI Office", which the Commission published on July 24, 2025.

The template has three sections: general information (provider, model, modalities and the size of each modality within broad ranges), a list of data sources (main datasets, a narrative description of data scraped online with the most relevant domain names, and other sources such as user or synthetic data), and data processing aspects relevant to copyright and illegal content removal. For scraped data it asks for the domain names in the top 10% by content size; SMEs may list the top 5% or the top 1,000 domains, whichever is lower.

Step 3: Copyright Opt-Out Policy

Article 53(1)(c) requires a policy to comply with EU copyright law, in particular to identify and respect a reservation of rights (the text and data mining opt-out in Article 4(3) of Directive (EU) 2019/790), "including through state-of-the-art technologies". The Copyright chapter of the GPAI Code of Practice spells out what signatories commit to:

• Use web crawlers that read and follow robots.txt (IETF RFC 9309) and other appropriate machine-readable opt-out protocols
• Designate a point of contact for rightsholders
• Run a mechanism for rightsholders to file complaints electronically, and act on them within a reasonable time

If you don't sign the Code, you still need a written policy that does the same job.

Step 4: Information for Downstream Providers (Annex XII)

Article 53(1)(b) requires you to give providers who build your model into their AI systems enough information to understand its capabilities and limitations and to meet their own obligations. Annex XII sets the minimum:

• The tasks the model is meant to perform and the kinds of AI systems it can be built into
• Acceptable use policies, release date and distribution methods
• How the model interacts with hardware or software outside it, and the relevant software versions
• Architecture, number of parameters, licence
• Input and output modalities and formats, with maximum size (for example context window length)
• The technical means for integration (instructions for use, infrastructure, tools)
• Training, testing and validation data: type, provenance and curation methods

Model cards, API documentation and system cards are the usual place for this.

Step 5: Model Evaluation and Risk Mitigation (Systemic Risk Models Only)

Article 51(2) presumes systemic risk once training compute exceeds 10²⁵ FLOPs, and the Commission can also designate a model. Article 55(1)(a) and (b) then require you to:

• Evaluate the model with standardised protocols and tools reflecting the state of the art, including conducting and documenting adversarial testing
• Assess and mitigate possible systemic risks at Union level, including their sources

Step 6: Serious Incident Reporting (Systemic Risk Models Only)

Article 55(1)(c) requires you to keep track of, document and report serious incidents and possible corrective measures to the AI Office "without undue delay". The law sets no hours. The Safety and Security chapter of the GPAI Code of Practice does, for signatories: an initial report within two days for a serious, irreversible disruption of critical infrastructure, five days for a serious cybersecurity breach, 10 days for a death and 15 days for other serious harm, then updates at least every four weeks and a final report within 60 days of resolution. Reports go to the AI Office through the EU SEND platform.

Screenshot: General-Purpose AI Code of Practice, Safety and Security chapter, Measure 9.3, European Commission (July 2025).

Step 7: Cybersecurity Measures (Systemic Risk Models Only)

Article 55(1)(d) requires systemic risk GPAI providers to "ensure an adequate level of cybersecurity protection for the general-purpose AI model with systemic risk and the physical infrastructure of the model". The Safety and Security chapter of the GPAI Code of Practice turns that into commitments for signatories:

• Define a security goal naming the threat actors you protect against, including insider threats
• Keep a registry of every device and location where unreleased model weights are stored, and alert on copies to unmanaged devices
• Encrypt weights in transit and at rest, and decrypt them only into non-persistent memory for legitimate use
• Apply general controls: multi-factor authentication, phishing filtering, patch management

The open-source exemption in Article 53(2) does not apply to models with systemic risk, so open-weight systemic-risk models carry these duties too.

Models Placed on the Market Before August 2, 2025 (Article 111(3))

Article 111(3) says these providers "shall take the necessary steps in order to comply with the obligations laid down in this Regulation by 2 August 2027", so the extra time covers the systemic-risk duties too. The training content template lets these providers state and justify gaps where the information is no longer available.

Where to Start If You're Late

If you provide a GPAI model and haven't done the steps above, this is the order we'd take them in:

1. Confirm you are a GPAI provider, not a downstream provider building on someone else's model (self-test above).
2. If your model is over the compute threshold, notify the Commission: Article 52(1) gives two weeks from meeting it.
3. Publish the training content summary on the AI Office template: it is public, so a missing one is easy to spot.
4. Put the copyright policy in writing and check your crawlers follow robots.txt.
5. Write the Annex XI documentation and the Annex XII package for downstream providers.

What If You Use (Not Provide) a GPAI Model

If your product uses OpenAI, Anthropic, Google, or any other GPAI API, Steps 1-7 above are the model provider's responsibility, not yours. Your obligations under the EU AI Act depend on what your system does:

• Internal productivity use: usually no AI Act duties beyond AI literacy (Article 4).
• Customer-facing chatbot: Article 50(1) requires that people are told they are interacting with an AI system, from August 2, 2026.
• Hiring, credit, education, or other Annex III uses: high-risk AI system; the obligations apply from December 2, 2027. If you put the system on the market under your name, you have provider obligations; if you only use it, deployer obligations.

For help assessing your risk tier as a deployer, see the EU AI Act compliance guide for small teams. For background on the GPAI category and how it interacts with the high-risk rules, see the EU AI Act plain English guide.

Correction (October 19, 2026): The FAQ said the Omnibus "provisional agreement (May 7, 2026)" extended the high-risk deadline and that August 2, 2026 is the GPAI compliance date. The extension comes from Regulation (EU) 2026/1744, in force since July 27, 2026; GPAI obligations have applied since August 2, 2025, and August 2, 2026 is when Commission enforcement started.

Correction (October 19, 2026, second update): The checklist table, the transition section and the "Timeline" section gave August 2, 2026 as the compliance date for Steps 1-7 and said the 2027 transition covered only Article 53. GPAI obligations have applied since August 2, 2025 (Article 113(b)); August 2, 2026 is when Commission fines and measures started (Article 101); and the Article 111(3) date of August 2, 2027 covers all obligations for models placed on the market before August 2, 2025. We also removed an unsourced "72-hour" incident reporting estimate, matched the Step 1 and Step 4 lists to Annexes XI and XII and the Step 7 list to the Code of Practice security commitments, and corrected "deployer" to "downstream provider" for companies building on a GPAI API. Later the same day we added that the SME option for the domain list is the top 5% or 1,000 domains, whichever is lower, and removed an unsourced line about startup models and the compute threshold.

Related Reading

• EU AI Act GPAI codes of conduct
• EU AI Act compliance guide for small teams
• EU AI Act August 2026 compliance checklist (Annex III)
• EU Digital Omnibus, AI Act deadline extension explained
• Privacy-first AI APIs, GDPR-safe selection guide
• EU AI Act Article 5 prohibited practices, the prohibitions that apply regardless of GPAI or high-risk classification
• EU AI Act August 2026: What's Delayed and What Still Applies
• Meta Skipped the EU AI Code: What Llama Deployers Must Do Now