TL;DR: Since August 2, 2026, the European Commission can fine general-purpose AI (GPAI) model providers up to 3% of worldwide turnover or EUR 15 million. Providers that follow the GPAI Code of Practice can use it to show they comply. Meta is not on the Commission's list of signatories and said in July 2025 that it would not sign. xAI signed only the Safety and Security chapter. If your products run on Llama in EU markets, your vendor's compliance documentation is now part of your vendor risk.
What changed on August 2, 2026
The GPAI chapter of the EU AI Act has applied since August 2, 2025, but Article 101, the Commission's power to fine GPAI model providers, only applied from August 2, 2026. From that date the Commission can fine a provider up to 3% of its annual worldwide turnover or EUR 15 million, whichever is higher.
The fines sit on top of investigative powers. Under Article 91 the Commission can request the provider's technical documentation. Under Article 92 the AI Office can run evaluations of a model. Under Article 93 the Commission can request measures, up to asking a provider to "restrict the making available on the market, withdraw or recall the model."
The higher ceiling you may have seen, EUR 35 million or 7% of turnover, is a different rule. It covers prohibited AI practices under Article 99, and those penalties are set and enforced by Member States, not by the AI Office.
The same date brought the Article 50 transparency duties: people must be told when they are interacting with an AI system, at the latest at the first interaction, and synthetic content must be marked in a machine-readable format. The Digital Omnibus (Regulation (EU) 2026/1744) gave generative systems already on the market before August 2, 2026 until December 2, 2026 to meet the marking rule in Article 50(2).
All of this applies to providers wherever they are based. Article 2 covers providers placing GPAI models on the EU market "irrespective of whether those providers are established or located within the Union or in a third country."
The Code of Practice and what it does
The GPAI Code of Practice is a voluntary tool, published on July 10, 2025. It has three chapters:
- Transparency: a Model Documentation Form for the information the AI Act requires providers to keep and share.
- Copyright: practical steps for the required policy to comply with EU copyright law.
- Safety and Security: practices for managing systemic risk, relevant only to the small number of providers of the most advanced models.
Article 53(4) lets providers rely on a code of practice to demonstrate compliance until a harmonised standard is published. The Commission says signing "will reduce their administrative burden and give them more legal certainty and trust than if they proved compliance through other methods."
Not signing is not a breach. It means the provider has to take the longer route: under Article 53(4), providers that do not adhere to an approved code "shall demonstrate alternative adequate means of compliance for assessment by the Commission."
When we checked the Commission's page on October 22, 2026 (last updated October 7), it still listed 22 full signatories, including Amazon, Anthropic, Cohere, Google, IBM, Microsoft, Mistral AI and OpenAI.
Screenshot: The General-Purpose AI Code of Practice, signatory list, European Commission (taken October 10, 2026).
Meta did not sign
Meta is not on that list. In a LinkedIn post reported on July 18, 2025, Meta's chief global affairs officer Joel Kaplan wrote that "Meta won't be signing it. This Code introduces a number of legal uncertainties for model developers, as well as measures which go far beyond the scope of the AI Act."
The practical consequence: the Llama model family has no Code to point to. If the Commission asks how a Llama model meets the GPAI obligations, Meta has to show alternative adequate means.
Do not confuse this with a second, separate code. On July 28, 2026, Meta's VP of Public Policy for Europe, Markus Reinisch, announced that Meta is signing the Code of Practice on Transparency of AI-Generated Content, which covers marking and labelling AI-generated content under Article 50. About 190 organisations had signed that code by the end of July 2026, according to the Commission. It does not cover the GPAI obligations on documentation, copyright and systemic risk.
Image: Pexels, used under the Pexels License.
The Llama 4 EU clause
Meta's own terms already treat the EU differently. The Llama 4 Acceptable Use Policy says the rights to the multimodal Llama 4 models "are not being granted to you if you are an individual domiciled in, or a company with a principal place of business in, the European Union." The next sentence matters for most buyers: "This restriction does not apply to end users of a product or service that incorporates any such multimodal models."
So an EU company building directly on multimodal Llama 4 has a licensing problem before it has an AI Act problem. An EU company using a SaaS product that runs on it does not, according to the policy text.
Screenshot: Llama 4 Acceptable Use Policy, Meta (taken October 10, 2026).
xAI's partial signature creates a different gap
xAI signed only the Safety and Security chapter. The Commission states that xAI "will have to demonstrate compliance with the AI Act's obligations concerning transparency and copyright via alternative adequate means."
If you use Grok or an xAI-powered product in EU workflows and were counting on the Code to cover your vendor's copyright and documentation story, it does not. Ask xAI-based vendors the same questions you would ask a Llama-based vendor.
What this means if your stack runs Llama
Many companies do not think of themselves as "using Llama." They use a chatbot builder, an agent framework or a hosted API that runs Llama underneath. The AI Act's GPAI duties and the Article 101 fines fall on the model provider, not on you as a deployer.
Your exposure is operational. Article 93 lets the Commission ask a provider to restrict, withdraw or recall a model. If that ever happened to a model your product depends on, you would lose the model behind your application. That is vendor risk, the same category as a key supplier failing, with a regulator attached.
The checklist for teams using non-Code providers
1. Map your AI vendor stack by provider and model. List every AI tool your team uses and the model underneath. Flag anything that runs Llama or xAI models in EU-facing workflows.
2. Separate EU-facing from non-EU deployments. Note which tools serve EU customers, EU employees or EU data subjects.
3. Check the Llama 4 clause. If your company is EU-based and builds directly on multimodal Llama 4, read the Acceptable Use Policy with counsel. If you only use a product built on it, record that the end-user exception applies.
4. Ask your vendor how it documents GPAI compliance without the Code. A useful answer names documents: the model documentation, the copyright policy, and who holds them. "We comply with all applicable laws" is not an answer you can show anyone.
5. Add contract language covering model withdrawal. Ask for written notice if the underlying model is withdrawn or restricted in the EU, if the provider receives a Commission request or measure under Articles 91 to 93, or if the model changes. Standard SaaS terms rarely include this.
6. Identify a fallback model. Know which alternative on the signatory list you could move to, and roughly what the switch would take. Doing this now is cheaper than doing it under pressure.
7. Write down your rationale. A short memo on why you assessed the vendor as acceptable, what you asked and what they sent is your evidence if a customer or auditor asks how you vetted your AI supply chain.
What readers said
When Meta's decision was announced, an r/privacy thread discussed it. One commenter summed up the legal position: "The code of practice is voluntary, but it is supposed to help companies comply with AI Act's provisions which become applicable in August." Not signing, they added, means Meta "still may be fined on breaching AI Act obligations."
Our take
Based on the AI Act text and the Commission pages cited above, Meta's refusal is not a compliance failure in itself, and it does not make Llama illegal to use in the EU. What it removes is the easy answer. With a Code signatory, a buyer can point to the Code. With Meta, the buyer has to ask what Meta's alternative evidence is. The Llama 4 clause is the more concrete issue for EU companies building directly on the model, and it is a licence term, not a regulation.
What to watch for next
As of October 22, 2026, we found no public announcement of a Commission request, evaluation or measure against Meta or any Llama model. The AI Office has started asking questions elsewhere: on October 12 the Commission said it had "requested and received serious incident reports and sent requests for information on security practices" after recent loss-of-control incidents, and Computerworld reported on October 14 that the requests went to OpenAI and Anthropic, both Code signatories. Those requests are about incidents, so the question for Llama users is still open: the first request to a non-signatory will show what "alternative adequate means" has to look like in practice. Also watch the signatory page: the Commission says it updates the list "as signatures are confirmed."
How we checked this
On October 10, 2026 we checked this article against 7 sources: the AI Act and the Digital Omnibus on EUR-Lex, the Commission's GPAI Code page and its July 31, 2026 news item on the transparency code, the Llama 4 Acceptable Use Policy, Meta's July 28, 2026 newsroom post, and The Register's report of Kaplan's statement. We corrected the number of GPAI Code signatories (22 on the list; the earlier, larger figure matched the transparency code, which about 190 organisations signed), the Llama 4 restriction (it covers multimodal models and excludes end users), and the description of the EUR 35 million ceiling (a Member State penalty). We added Meta's July 2026 signature of the transparency code. We removed claims we could not source, including that Llama is the most widely deployed open-weight model.
On October 22, 2026 we re-read all seven sources, matched every quote again (the AI Act articles and the Digital Omnibus transitional rule on EUR-Lex, the signatory list, the Llama 4 policy, both Meta and Commission posts, the Reddit comment), and found nothing wrong. We added the Commission's October 12 note on requests for information after the loss-of-control incidents and Computerworld's October 14 report naming OpenAI and Anthropic. The Commission's note does not name the companies, and we have not seen the requests themselves.
Last reviewed: October 22, 2026.
Correction (October 20, 2026): The page description said Llama "gets no presumption of conformity" because Meta did not sign. Signing the Code gives no presumption of conformity either: Article 53(4) lets signatories rely on it to demonstrate compliance, and only harmonised standards grant the presumption. The description now says Meta must prove compliance another way.
