For most of the last year, the European Union's AI Act has been a law with teeth it could not yet use. That changed this autumn. Since 2 August the European Commission's AI Office has held the power to act directly against the companies that build general-purpose AI models, the large systems that sit beneath products like ChatGPT, Gemini and Claude. The obligations themselves have been on the books since August 2025. What is new is that someone can now enforce them.
The practical shift matters more than the date. The AI Office can request a provider's technical documentation, ask how a model was trained, and in the more serious cases obtain access to the model itself to run its own evaluations. Where it finds a problem it can order corrective measures. At the far end of the ladder it can push for a model to be withdrawn from the European market altogether. Fines reach the higher of 15 million euros or 3 percent of a company's worldwide annual turnover, a figure drawn straight from Article 101 of the Act.
What providers already owe
The baseline duties are not dramatic, but they are specific. A provider must keep technical documentation on how its model works, publish a summary of the content it was trained on, and adopt a policy for complying with EU copyright law. Models judged to carry "systemic risk," broadly the largest and most capable, take on more: structured evaluations, risk assessment and mitigation, reporting of serious incidents, and cybersecurity protections for the model's weights.
That last category is where the friction is likely to show first. Deciding which models count as systemic-risk systems, and how much a company must reveal about training data it has long treated as a trade secret, is exactly the kind of question that tends to end up argued line by line.
A softer landing for older models
Models placed on the market before August 2025 get until 2 August 2027 to come into line, a transition window the Commission's own guidance spells out. So the first real tests of the regime will more likely involve newer systems, or the newer versions of established ones, rather than the models that were already in wide use when the rules took hold.
It is worth being precise about what this milestone is and is not. Enforcement powers becoming active does not mean any company has been found in breach. It means the duties that have applied for over a year are now backed by a body that can demand answers and impose penalties if it does not get them.
The European approach stands in contrast to the mood in Washington, where the current administration has leaned on existing liability law rather than new AI-specific rules. Europe has chosen the opposite path, and the companies affected are global. The same firm that began watermarking its chatbot's text for EU users this month is now operating inside a framework that can ask it to prove the claims it makes. Whether that produces genuine accountability or a paperwork exercise is the question the next year will answer.
Commentarii · 0