Analysis
The part of the EU AI Act that binds foundation model providers is live. As of Aug. 2, 2026, the Commission's AI Office holds enforcement and penalty powers over general-purpose AI providers, and the Article 50 transparency obligations took effect on the original schedule. Axios covered the shift this week as the moment the law stopped being a compliance calendar and started being a liability.
The penalty structure is tiered. GPAI obligation breaches -- documentation, copyright policy, training-data summaries, systemic-risk assessments for the largest models -- carry fines up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher. Prohibited practices sit at EUR 35 million or 7%. For a company at OpenAI's or Google's scale, 3% of global turnover is not a compliance cost, it is a board-level number.
What did not arrive is the rest of it. The Digital Omnibus on AI, adopted by the European Parliament on June 16, 2026 and given final Council approval on June 29, deferred the substantive high-risk regime -- conformity assessment, registration, risk management, data governance, logging, human oversight -- to Dec. 2, 2027 for Annex III systems and Aug. 2, 2028 for Annex I product-embedded systems. Crucially, the Omnibus left the Aug. 2, 2026 GPAI date standing.
“For a company at OpenAI's or Google's scale, 3% of global turnover is not a compliance cost, it is a board-level number.”
That asymmetry produces an odd result. The handful of companies that train frontier models -- OpenAI, Google, Anthropic, Meta, Mistral, and a short list of others -- face active enforcement in Europe now. The thousands of companies deploying AI into hiring, credit, education and medical devices, which is where the Act's actual harm theory sits, have another eighteen months to four years.
The reasonable reading is that the delay reflects industry lobbying and genuine unreadiness in equal measure. Notified bodies for conformity assessment do not exist in sufficient number, and harmonized standards from CEN-CENELEC have run late. Regulators cannot enforce a regime that has no assessors.
For US founders selling into Europe: the immediate obligation is transparency, not conformity. If you fine-tune or distribute a general-purpose model you have documentation duties now. If you build an application on someone else's model, your clock starts in December 2027 -- which is exactly enough time to build the logging and human-oversight architecture properly, and exactly enough time to forget to.
