# EU AI Act: GPAI Obligations Hit August 2026

> The EU AI Act's GPAI obligations are enforceable from 2 August 2026. This advisory details the transparency, documentation, and risk management duties for providers and deployers.

Source: https://loopbackup.com/blog/eu-ai-act-gpai-obligations-august-2026
Publisher: Loop Backup
Content language: en

---

'''
## At a Glance

*   **Compliance Deadline:** Key obligations for providers of General-Purpose AI (GPAI) models under the EU AI Act become enforceable on **2 August 2026** (24 months after entry into force).
*   **Who is Affected:** Any provider placing a GPAI model on the EU market, regardless of the provider's location. This also has downstream implications for EU-based deployers using these models.
*   **Core Requirements (Article 53):** All GPAI model providers must maintain detailed technical documentation, provide extensive information to downstream system providers, and publish a summary of the content used for training.
*   **Systemic Risk Models (Article 55):** GPAI models deemed to have 'systemic risk' face stricter obligations, including model evaluation, risk assessment, and cybersecurity measures.
*   **Enforcement Body:** The newly established European **AI Office** is the central enforcement authority, responsible for monitoring compliance, designating systemic risk models, and promoting standards.
*   **Penalties:** Fines for non-compliance with GPAI obligations can reach up to **EUR 15 million or 3% of total worldwide annual turnover** for the preceding financial year, whichever is higher.

## The Clock is Ticking: GPAI Compliance by August 2026

The European Union's AI Act, a landmark piece of legislation, reached its final approval and entered into force in the summer of 2024. While its provisions are being phased in over several years, a critical deadline is now firmly on the horizon. From **2 August 2026**, the comprehensive obligations for providers of general-purpose AI (GPAI) models will be legally enforceable.

This deadline marks a pivotal moment in AI governance. For the first time, foundational models that power a vast array of downstream applications will be subject to a specific, demanding regulatory framework. The rules aim to foster transparency, manage risk, and ensure accountability in an ecosystem that has, until now, evolved with minimal oversight. With less than 15 months to go, organisations that provide or heavily rely on GPAI models must act now to ensure they are prepared. Failure to comply brings the risk of severe financial penalties and significant reputational damage.

## Who is in Scope? Providers and the EU Market Connection

The AI Act's GPAI obligations apply to **providers of GPAI models**. A provider is defined as the entity that develops a GPAI model and places it on the market. The crucial element is the act of "placing on the market, " which means the first making available of a model in the Union.

This has a broad extra-territorial reach. A model provider based in the US, UK, or anywhere else in the world falls within the scope of the Act if their model is made available to users or customers within the EU. This could be through a direct download, an API, or other distribution channels. The obligations are not limited to EU-based companies.

Downstream **deployers** of AI systems, companies that use a GPAI model to build a specific application, are not directly regulated by the GPAI-specific articles. However, they are fundamentally impacted. To meet their own obligations under the Act (for example, if they are building a 'high-risk AI system'), they will depend entirely on the transparency and documentation provided by the upstream GPAI model provider. Therefore, deployers must ensure their chosen GPAI providers are compliant, or they too will face significant compliance challenges.

## Core Obligations for all GPAI Models (Article 53)

Article 53 of the AI Act establishes a baseline of transparency and documentation duties for all GPAI models placed on the EU market, irrespective of whether they are deemed to pose a systemic risk.

### Technical Documentation Requirements

Providers must draw up and maintain extensive technical documentation for their models. The AI Office, in consultation with industry, will detail the exact requirements through codes of practice, but the Act mandates that this documentation must explain, at a minimum:

*   The **training process** and methodologies used.
*   The **data sources** used for training, including pre-processing and curation.
*   The **testing and evaluation** results that demonstrate the model's performance, limitations, and foreseeable risks.
*   The **computational resources** consumed during training, including energy usage.

This documentation must be sufficiently detailed to enable downstream providers to understand the capabilities and limitations of the model they are integrating. Keeping this extensive documentation secure, versioned, and accessible is a significant data governance challenge. Employing a robust backup strategy is essential to ensure this evidence is protected from loss or tampering. Services like **[Loop Backup](/)** can provide immutable cloud storage, safeguarding critical compliance assets against ransomware or accidental deletion.

### Transparency for Downstream Providers

Beyond maintaining the documentation, providers have a duty to actively *provide* information to the providers of downstream AI systems. This is a crucial plank in the Act’s strategy to ensure accountability flows through the value chain. The information must allow the downstream provider to understand the GPAI model well enough to fulfil their own compliance duties. This includes details on the model’s performance, its appropriate and inappropriate uses, and the results of its evaluations.

### A Contentious Requirement: The Copyright Policy

One of the most debated provisions is the requirement for providers to implement a policy to respect Union copyright law. As part of this, they must "make publicly available a sufficiently detailed summary about the content used for training."

This does not mean publishing the raw training data itself. However, it requires a comprehensive overview of the datasets used to train the model, such as large web scrapes, licensed image banks, or collections of public domain books. This obligation aims to give rightsholders a mechanism to enforce their rights under copyright law. For providers, this means meticulous record-keeping of all data sources is no longer an option, it is a legal necessity.

## When GPAI Becomes a Systemic Risk (Article 55)

The AI Act introduces a higher tier of regulation for GPAI models that have **systemic risk**. A model is presumed to have systemic risk if the cumulative amount of compute used for its training, measured in floating point operations (FLOPs), is greater than 10^25.

The **AI Office** has the authority to designate other models as systemic risk based on other criteria, such as the number of business or end-users, or if the model has a significant impact on the internal market.

If a GPAI model is classified as having systemic risk, its provider must comply with a further set of demanding obligations under Article 55, in addition to those in Article 53:

*   **Mandatory Model Evaluation:** Conduct state-of-the-art, standardised model evaluations, including adversarial testing, to identify and mitigate systemic risks.
*   **Assess and Mitigate Risks:** Identify, document, and mitigate any potential systemic risks the model could pose, whether from intentional misuse or unforeseen emergent capabilities.
*   **Cybersecurity and Physical Infrastructure:** Ensure a high level of cybersecurity protection is in place to prevent attacks that could compromise the model.
*   **Incident Reporting:** Report serious incidents to the AI Office and relevant national market surveillance authorities without delay.

## The Role of the AI Office and Codes of Practice

At the heart of GPAI governance is the new European **AI Office**. Housed within the European Commission, this body is responsible for supervising the GPAI ecosystem. Its key functions include:

*   Monitoring the implementation and enforcement of the GPAI rules.
*   Designating specific GPAI models as having systemic risk.
*   Developing and promoting **codes of practice** in collaboration with industry, stakeholders, and the scientific community. These codes will be crucial for translating the Act's principles into practical, testable standards.

These codes of practice will become the de facto compliance guide for model providers, offering detailed methodologies for technical documentation, risk management, and performance evaluation. Engagement with the AI Office and participation in the development of these codes will be a strategic imperative for any major player in the AI market.

## The Sting in the Tail: Penalties for Non-Compliance

The financial repercussions for failing to meet the GPAI obligations are substantial. The Act empowers regulators to impose fines of up to **EUR 15 million or 3% of the provider's total worldwide annual turnover** from the previous financial year, whichever is higher. For large, global technology companies, this represents a significant financial risk and a powerful incentive to invest in a robust **AI compliance deadline** programme.

## Action Checklist

With the August 2026 deadline approaching, both providers and downstream deployers must take concrete steps. This checklist outlines the critical path to compliance.

*   **For GPAI Model Providers:**
    *   **Catalogue Training Data:** Immediately begin cataloguing and documenting all datasets used for training your models to prepare for the copyright summary requirement.
    *   **Establish a Documentation Framework:** Create a structured system for generating and maintaining the technical documentation required by Article 53.
    *   **Measure Training Compute (FLOPs):** Accurately measure and document the computational resources (especially FLOPs) used to train your models to determine if you cross the systemic risk threshold.
    *   **Engage with the AI Office:** Actively monitor communications from the AI Office and prepare to contribute to the development of codes of practice.

*   **For Downstream AI System Deployers:**
    *   **Audit Your GPAI Dependencies:** Identify all external GPAI models used in your systems and open a dialogue with the providers about their AI Act compliance roadmap.
    *   **Secure Upstream Information Rights:** Ensure your commercial agreements and SLAs with GPAI model providers include clauses that guarantee you will receive the necessary transparency and documentation to meet your own regulatory obligations.
    *   **Develop a Provider Risk Framework:** Create a framework for assessing the compliance risk of different GPAI providers, favouring those who demonstrate a clear commitment to transparency.

## Conclusion: Beyond Compliance

The EU AI Act's GPAI obligations for August 2026 represent a new chapter in technology regulation. While the requirements for technical documentation, risk assessment, and transparency are demanding, they also offer a blueprint for trustworthy AI. Organisations that embrace these principles proactively will not only mitigate significant legal and financial risks but also build a stronger foundation for innovation. In the evolving landscape of artificial intelligence, demonstrable compliance and good governance will become a key competitive differentiator.
''', action_items=[CreateBlogPostActionItems(title=