From 2 August 2026, the AI Office holds live enforcement powers over general-purpose AI (GPAI) models under the EU AI Act, including the authority to investigate providers, request information, conduct on-site inspections, and impose significant financial penalties. The timeline was confirmed despite wider schedule changes introduced by the Digital Omnibus on AI (Regulation (EU) 2026/1744), which deferred certain high-risk obligations but left the Article 50 transparency requirements and the AI Office's enforcement mandate intact and on schedule. International businesses deploying or developing GPAI systems in or into the EU should treat 2 August 2026 not as a future planning horizon but as an operative compliance date that has already passed.
Legislative Context: The Digital Omnibus on AI and What Changed
The regulatory landscape shifted materially in mid-2026. Political agreement on the Digital Omnibus on AI (Regulation (EU) 2026/1744) was reached on 7 May 2026, followed by a plenary vote in the European Parliament on 16 June 2026. The text was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026 – three days before the originally scheduled GPAI enforcement date.
The Digital Omnibus introduced two significant deadline extensions that operators had lobbied for. First, Annex III high-risk AI system obligations were postponed from 2 August 2026 to 2 December 2027. Second, Annex I obligations covering AI embedded in regulated products were pushed further, to 2 August 2028. These extensions gave affected industries additional preparation time, and their importance should not be understated.
However, the extensions did not touch everything. The legislation expressly preserved the following on their original schedule: the Article 50 transparency obligations (covering chatbots, synthetic content and emotion-recognition disclosures), the AI Office's supervisory and enforcement powers, and the penalty regime applicable to GPAI model providers. All three applied as of 2 August 2026. Businesses that relied on general assumptions that "the AI Act has been delayed" may have drawn the wrong conclusion for their own risk profile.
The AI Office: Structure and Legal Mandate
The AI Office operates within the European Commission and serves as the primary supervisory body for GPAI models at Union level. Its mandate is distinct from the national market surveillance authorities that oversee most other AI Act obligations. For GPAI providers – regardless of where in the world they are incorporated – the AI Office is the single interlocutor, giving it an unusually concentrated reach over globally active technology firms.
The Office's enforcement powers as of 2 August 2026 include:
- Information requests: compelling providers and deployers to supply technical documentation, training data summaries, model evaluations and incident records;
- On-site inspections: accessing premises, infrastructure and systems, with or without prior notice in urgent circumstances;
- Interim measures: ordering temporary restrictions on model access where serious risk is identified pending full investigation;
- Corrective action orders: requiring providers to modify, retrain, restrict or withdraw models;
- Penalty decisions: recommending fines to the Commission for formal adoption.
Procedurally, the AI Office coordinates with the European AI Board (comprising national authority representatives) and, where financial sector conduct is involved, with sectoral regulators such as ESMA and the EBA. Overlaps between AI Act obligations and existing sectoral frameworks – particularly in banking, insurance and asset management – remain an area of active interpretive work, and the delineation of supervisory competence is not yet fully settled.
Penalty Regime: Thresholds and Triggers
The penalty structure under the AI Act is tiered according to the nature of the infringement. For GPAI providers, the most significant exposures arise from failure to comply with transparency and documentation obligations, failure to cooperate with the AI Office, and – for providers of so-called systemic-risk GPAI models – breach of the specific obligations attached to that classification.
The penalty thresholds established in the AI Act are expressed as a percentage of global annual turnover, applying the higher of the percentage figure or an absolute euro amount. The precise operative thresholds applicable to each infringement category are set in the Regulation itself; operators should consult the EUR-Lex text of the AI Act directly for current figures, as the Digital Omnibus introduced technical amendments that affect how certain provisions are read in conjunction with one another. What is unambiguous is that the penalty regime is modelled on GDPR enforcement in scale and approach: the Commission adopts the formal penalty decision following an AI Office investigation, and decisions are subject to review before the CJEU.
Aggravating factors include repeated infringement, obstruction of investigation, and failure to implement interim measures. Mitigating factors – recognised in the Regulation – include cooperation, prompt remediation and demonstrable good-faith compliance efforts prior to the infringement.
If your organisation has received an information request from the AI Office or anticipates one, early engagement with external counsel is advisable. Contact our team at info@ferrazwhitmore.com or visit our contacts page to discuss your situation confidentially.
GPAI Model Classification: Who Bears the Heaviest Obligations
The AI Act creates a two-tier structure within the GPAI category. All GPAI model providers face baseline obligations, primarily around technical documentation, transparency to downstream providers and deployers, and copyright-compliance policies. However, providers of models meeting the threshold for systemic risk classification carry a substantially heavier burden.
Systemic-risk classification is triggered by training compute at or above the threshold set in the Regulation, or by a Commission decision based on qualitative criteria such as reach, capability and impact. Systemic-risk GPAI providers must additionally:
- conduct and document adversarial testing (red-teaming) against defined risk categories;
- report serious incidents to the AI Office without undue delay;
- maintain and periodically update a model evaluation report;
- ensure cybersecurity measures appropriate to the model's risk profile;
- maintain records enabling post-incident traceability.
A significant open question is how the AI Office will treat incremental model updates – fine-tuned variants, retrieval-augmented versions, and models accessed through third-party APIs. The Regulation distinguishes between providers who place a model on the market and those who merely use or further deploy it, but the boundary is context-dependent and will likely be clarified through guidance or early enforcement precedent.
Article 50 Transparency Obligations: Already Operative
Article 50 imposes disclosure duties that apply both to providers and to deployers. As of 2 August 2026, persons deploying AI systems that interact with natural persons must inform those persons that they are interacting with an AI – unless this is obvious from context. Providers of AI systems generating synthetic audio, video or image content must ensure that outputs are marked in a machine-readable format enabling detection. Deployers of emotion-recognition or biometric categorisation systems must inform exposed individuals accordingly.
Algorithmic transparency requirements under Article 50 intersect with existing obligations under the GDPR and the Digital Services Act in ways that are not always resolved. For example, where an AI system makes or meaningfully influences a decision affecting an individual, the interplay between Article 50 disclosures, Article 22 GDPR (automated individual decision-making) and DSA transparency requirements creates a compliance matrix that each organisation must map against its specific operational model.
The AI Office has indicated that it will focus early enforcement attention on Article 50 compliance, partly because these obligations are self-executing and relatively measurable, and partly because they sit at the interface of consumer protection and fundamental rights – areas where political pressure for visible enforcement is strong.
Cross-Border Implications: Non-EU Providers
The territorial scope of the AI Act is broad. It applies to providers placing models on the EU market or putting them into service within the EU, regardless of where the provider is established. It also applies to deployers within the EU even where the underlying model is developed and maintained outside the Union. This extra-territorial reach mirrors the approach of the GDPR and is likely to be tested before the CJEU in due course.
For non-EU providers, the Regulation requires designation of an EU representative – a legal or natural person established in the Union who can engage with the AI Office and national authorities on the provider's behalf. Failure to designate a representative does not insulate the provider from liability; it is itself an infringement and may complicate the Office's ability to act swiftly, which can increase the risk of interim measures.
Financial institutions, insurance groups and asset managers operating across multiple EU jurisdictions face an additional layer of complexity. The AI Office supervises GPAI model providers at Union level, but the deployment of those models within regulated financial services remains subject to the sectoral oversight of ESMA, the EBA and national competent authorities. Institutions subject to both regimes must maintain a coherent AI governance framework that satisfies both supervisory expectations simultaneously – a challenge that the regulators themselves have acknowledged requires co-ordinated guidance.
Firms operating in Spain can find practical context on jurisdiction-specific compliance approaches at our AI Act compliance page for Spain. For an illustration of how a gap assessment was structured in an analogous context, our Portugal gap assessment case study offers a worked example of the methodology.
Practical Impact on Workforce and Operational Decisions
AI Office enforcement powers have direct implications not only for technical and compliance teams but also for human resources strategy. Where GPAI models are used in recruitment, performance management, workforce monitoring or dismissal decisions, the obligations under the AI Act – including Article 50 disclosures and, from December 2027, the fuller Annex III high-risk requirements – combine with existing protections under EU employment law.
Works councils and employee representatives in many EU member states have co-determination or information rights that are triggered when employers introduce AI-assisted decision-making affecting workers. Employers who rely solely on AI Act compliance without mapping their obligations under national employment law risk both regulatory exposure and industrial relations difficulties. Our employment law practice regularly advises on the intersection of AI deployment and workforce rights.
Strategic Recommendations for Organisations
With enforcement already live as of 2 August 2026, the window for purely preparatory activity has closed. Organisations should now focus on operational readiness across four areas:
- Documentation audit: Verify that technical documentation for all GPAI models in use or deployment meets the AI Act's requirements. Gaps in model cards, training data summaries or evaluation logs are likely to be the first points of examination in any AI Office inquiry.
- Article 50 implementation: Confirm that disclosure mechanisms – for chatbots, synthetic content and emotion-recognition systems – are deployed, tested and logged. Retain evidence of implementation decisions and the legal basis for any exemption claims.
- Incident response protocol: Establish a clear internal escalation path for AI-related incidents, including criteria for when notification to the AI Office is required and who within the organisation is authorised to engage with supervisors.
- Vendor and supply-chain review: Where your organisation is a deployer rather than a provider, obtain and verify the documentation that the AI Act requires providers to supply to downstream parties. Contractual representations from providers are not a substitute for actual documentation review.
Organisations subject to systemic-risk classification, or uncertain whether they meet the threshold, should seek legal analysis promptly. Classification triggers enhanced obligations retroactively from the date the threshold is met, not from the date of formal designation.
Open Questions and Outlook
Several interpretive questions remain unresolved as enforcement begins. The AI Office has committed to issuing guidelines on systemic-risk assessment and on the application of Article 50 to specific deployment contexts, but the timeline for those guidelines is not confirmed as of this writing. In their absence, organisations must make documented judgements based on the Regulation's text, its recitals and the legislative history – an exercise that benefits considerably from structured legal analysis.
The interplay between the AI Act and sector-specific AI regulations – in finance, pharmaceuticals, aviation and critical infrastructure – will also develop through practice and, where disputes arise, through CJEU jurisprudence. The Court's approach to the proportionality of penalties and the evidential standards required for systemic-risk designation will shape the enforcement culture of the AI Office for years ahead.
The Digital Omnibus amendments, while deferring Annex III obligations, also introduced technical refinements to definitions and cross-references within the AI Act that practitioners are still working through. Organisations that took legal advice prior to 24 July 2026 should confirm whether that advice accounts for the amendments now in force.
Ferraz & Whitmore advises international clients on AI Act compliance, regulatory engagement and risk assessment across EU jurisdictions. To discuss your organisation's position under the August 2026 regime, write to info@ferrazwhitmore.com or use our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.