The AI Office can now fine model providers: what a year of the Code of Practice has shown

On 2 August 2026 the Commission's AI Office began enforcing the AI Act, alongside the national authorities that supervise other AI systems[1]. The date matters above all for the providers of general-purpose AI models, the firms that train the models on which chatbots and most new software are built. Their obligations under Chapter V of Regulation (EU) 2024/1689 have applied since 2 August 2025[2]. For twelve months, however, the Commission had no power to fine them. Article 113 of the Regulation excludes Article 101, the fining provision for these providers, from the obligations that applied in 2025, so that it took effect only with the general application date of 2 August 2026[2]. The year of preparation is over[3].

What the AI Office can now do

The AI Office may request information and documents from a provider under Article 91, including technical documentation, training data summaries and model reports. It may commission evaluations of a model under Article 92. It may require measures under Article 93, up to the restriction, withdrawal or recall of a model[4]. Article 101 lets the Commission fine a provider up to 3% of its annual worldwide turnover or EUR 15 million, whichever is higher. The grounds are an infringement of the Regulation, a failure to answer a request for information, the supply of incomplete or misleading information, a failure to comply with a measure under Article 93, or a refusal of access for an evaluation[5].

What must a provider show? Every provider of a general-purpose AI model must keep up-to-date technical documentation, pass information to the firms that build systems on the model, hold a policy for complying with Union copyright law and publish a summary of the training content[6]. A provider whose model is presumed to carry systemic risk, which Article 51 ties to training compute above 10^25 floating-point operations, must in addition evaluate the model, assess and mitigate systemic risks, report serious incidents and protect the model against cyberattack[7][2]. Under Article 52 it must notify the Commission within two weeks of the model meeting that threshold[15]. Models placed on the market before 2 August 2025 must comply by 2 August 2027[3].

The AI Office says it will not open with fines. Its FAQ states that "technical compliance dialogues" with providers have been its main tool since 2025, that they will continue and may intensify, and that formal powers will be used where the dialogues prove insufficient[8]. Two facts qualify that promise. The Office's two relevant units employ 71 people, and the Commission expects about 40 further posts in 2027; a scientific panel of 60 independent experts, with Alessandro Abate of Oxford as chief scientific adviser, supports its work[9]. Complaint channels now exist for citizens, for whistleblowers and for downstream firms[1]. The Office will hear about problems before it has the staff to investigate many of them.

What the first year of the Code taught

The General-Purpose AI Code of Practice was published on 10 July 2025 in three chapters, on transparency, copyright, and safety and security; the first two apply to all providers, the third only to models with systemic risk[6]. The Commission and the AI Board assessed it as an adequate way to demonstrate compliance, and the Commission promised close cooperation with signatories during the first year, on condition of good faith[3]. The first lesson is that most providers signed. By 1 August 2025 some 26 companies had signed, among them Amazon, Google, Microsoft, IBM, OpenAI, Mistral AI and Aleph Alpha. xAI signed only the safety and security chapter and must show compliance with the transparency and copyright obligations by other means[10].

The second lesson is that refusal was possible and cheap for a year. Meta declined to sign on 18 July 2025. Its chief global affairs officer wrote that "Europe is heading down the wrong path on AI" and that the Code created legal uncertainty beyond the scope of the Act[11]. Alibaba, Baidu and DeepSeek did not sign either[6]. Nothing happened to them, because nothing could happen. A non-signatory must now demonstrate compliance with Articles 53 and 55 through its own documentation, and it faces the same Article 91 requests as everyone else. The difference between signatories and non-signatories now becomes a difference in the burden of proof.

The third lesson concerns the rest of the Act. The Digital Omnibus on AI, Regulation (EU) 2026/1744, was adopted by Parliament on 16 June 2026 by 423 votes to 57 with 174 abstentions and entered into force on 27 July 2026. It postponed the high-risk obligations to 2 December 2027 for stand-alone systems and to 2 August 2028 for AI embedded in regulated products[12][13]. It did not touch the general-purpose model obligations or the 2 August 2026 enforcement date[12]. The Omnibus also gave the AI Office exclusive competence over AI systems built on a general-purpose model when the system and the model come from the same provider or corporate group[14]. The Union has postponed the rules that bind the hospitals, employers and schools that deploy AI, and it has kept the rules that bind the handful of firms that build the models.

Our generation has grown up using these models without seeing what sits behind them. From 2 August a public authority has the right to look. We make four recommendations.

First, the AI Office should publish, within six months, a register of the models notified to it as presumed to carry systemic risk, with the date of notification and the provider's Code status. The public could then see who is subject to Article 55[7][15].

Second, the Office should state in advance how many technical compliance dialogues it can run in parallel with 71 staff, and the Commission should bring forward the 40 posts planned for 2027 to the 2026 budget[9].

Third, the Commission should use its first Article 91 request on a non-signatory, so that the market learns within the year that refusing the Code carries a cost in scrutiny[5][11].

Fourth, Parliament should ask the Office to report before December 2027 on what the model documentation revealed about training data and copyright, because that evidence will decide whether the postponed high-risk rules need amending before they apply[12].