Brussels: The countdown to 2 August 2026, when the European Commission’s enforcement powers under the AI Act’s general-purpose AI chapter shift from advisory to coercive, has begun to dictate the operational tempo inside the AI Office on Rue de la Loi and across the research and compliance teams of the providers that fall within its remit. The legislation entered into force on 1 August 2024, and the staggered application schedule has already brought governance and GPAI obligations into force on 2 August 2025. What changes in August 2026 is not the substantive duties of providers but the Commission’s ability to investigate, request information under penalty of administrative fines, and impose sanctions of up to fifteen million euros or three percent of global turnover, whichever is greater, on those that fail to meet them.
The Code of Practice published on 10 July 2025 is the instrument that the legislator inserted between the abstract duties of Article 53 and the live enforcement architecture that activates next August. Confirmed adequate by the Commission and the AI Board, the Code offers signatories a presumption of compliance with the transparency, copyright and safety obligations carried in the GPAI chapter. The presumption is rebuttable but procedurally meaningful: regulators bear the burden of demonstrating that a signatory’s documented practice diverges from what the Code specifies, rather than requiring the provider to construct its own compliance evidence from scratch. For models trained with the largest compute budgets, classified as GPAI with systemic risk under the ten-to-the-twenty-five FLOPs threshold, the safety and security chapter of the Code goes further, requiring internal model evaluations, red-teaming, post-market monitoring and serious incident reporting that mirror the practices that the largest American and European labs had already adopted voluntarily.
The compliance choreography that has emerged in the ten months since the Code’s publication is more uneven than the Commission’s framing suggests. A first cohort of signatories, drawn primarily from the European research-laboratory ecosystem and a subset of the United States frontier labs that maintain European entities, signed during the autumn 2025 window. A second cohort hesitated through the early months of 2026, citing concerns about how the copyright chapter’s text-and-data-mining opt-out enforcement obligations interact with the Digital Single Market Directive’s framework. The Commission’s clarifications in March of this year did not fully resolve those concerns, and the legal departments of several providers are reportedly preparing alternative compliance dossiers that would satisfy Article 53 without signing the Code, banking on the eighteen-month enforcement window before the older models placed on the market before 2 August 2025 must comply.
The institutional plumbing that will make the August trigger operational has filled out only recently. The AI Office has expanded to roughly one hundred and forty staff, drawn from the Commission’s existing digital cadre, member state secondments and external recruitment. The European Artificial Intelligence Board has formalised its working groups, and the scientific panel of independent experts that advises on systemic risk models has held its first calls. National competent authorities, designated by member states under Article 70, are now nominally in place across all twenty-seven jurisdictions, though the maturity of the supporting market surveillance apparatus varies sharply between member states that have invested in dedicated digital regulators and those that have folded AI Act work into existing telecommunications or data protection authorities.
What the August trigger will deliver, in practical terms, is closer to a moment of regulatory pressure-testing than to a sudden enforcement wave. The Commission’s stated posture is that the first eighteen months of enforcement will focus on the largest providers, the systemic-risk tier, and on documentation quality rather than substantive product changes. Civil society groups have argued that this risk-tiered approach leaves smaller providers under-policed, particularly on the copyright and training data transparency obligations that have produced the loudest criticism of the GPAI chapter from European publishers and rights holders. The next twelve months will be shaped by how the AI Office calibrates its first information requests, by whether providers that declined to sign the Code face heightened scrutiny, and by whether the Court of Justice begins to receive references on the boundary between provider obligations and downstream deployer responsibilities. The Act’s deeper architectural choices, from the systemic-risk threshold to the relationship between the GPAI chapter and the Data Act, will be tested through enforcement long before any formal review.
