Since 2 August 2026, the European Commission's AI Office is no longer a standards-writing body watching a calendar — it is a regulator with the power to investigate and fine. For general-purpose AI (GPAI) providers, that date did not add a new obligation; it activated the enforcement machinery behind obligations that have applied since August 2025. (It was also the Act's general date of application under Article 113, the day the Article 50 transparency obligations began to apply.)
This post is about what changed in the AI Office's authority, not about deadlines. For the full Annex III / Annex I compliance-deadline picture — what moved and what didn't in the Digital Omnibus — see our omnibus explainer; the deadline table lives there, not here.
What actually changed on 2 August 2026
2 August 2026 is when the Commission, acting through the AI Office, gained the power to enforce the GPAI obligations with real consequences: the supervision and enforcement provisions for GPAI providers (Articles 88 to 94) and the Commission's fining power (Article 101) apply from that date. Until then, GPAI providers had substantive obligations to meet but the Commission lacked the fining power to act on non-compliance; from that date, it has it.
This is a mechanics change, not a scope change. The obligations a GPAI provider must meet did not change on 2 August 2026 — the full engineering-oriented obligation set is covered in the EU AI Act explained for engineering teams. What changed is that the Commission can now investigate whether a provider is meeting them, and act if it is not.
Prohibited practices run on a different track and a different enforcer. The Article 5 bans have applied since 2 February 2025, and the penalty provisions, including the Article 99(3) fine ceiling, since 2 August 2025 (Article 113(a) and (b)). Those fines come from each Member State's penalty rules and are imposed at national level, with national market surveillance authorities supervising the bans, not the Commission. The exception is the set of AI systems the AI Office now supervises directly, covered below.
The five things the Commission/AI Office can now do
Under the enforcement provisions that took effect on 2 August 2026 (Articles 91 to 93 and 101), the AI Office can: request documentation from a GPAI provider; run its own technical evaluations of a model; demand risk-mitigation measures where it finds a gap; restrict or withdraw a model from the EU market; and issue fines. Four of those five are investigative or corrective — only the fifth is punitive, and it's the one most compliance teams fixate on.
| Power | What it does |
|---|---|
| Request documentation | Compels a GPAI provider to produce technical documentation supporting its compliance position |
| Run technical evaluations | Lets the AI Office independently assess a model rather than rely solely on provider self-reporting |
| Demand risk-mitigation measures | Requires specific corrective action where the AI Office finds a gap |
| Restrict or withdraw a model | Can limit or remove a model's availability in the EU market |
| Issue fines | Financial penalty, up to the ceilings below, for established violations |
That ordering matters operationally. A provider under scrutiny is more likely to first receive a documentation request or face a Commission-run technical evaluation than an immediate fine notice — the design leans toward investigate-then-escalate rather than fine-on-first-contact. Treat a documentation request as the live signal to respond to; it is the step that actually starts an enforcement cycle under this regime, well before a fine becomes a live possibility.
The fine ceilings: up to €15M or 3% for GPAI, up to €35M or 7% for prohibited practices
GPAI provider violations are fineable by the Commission up to the higher of €15 million or 3% of worldwide annual turnover (Article 101(1)); prohibited-practice violations — the unacceptable-risk category the Act has banned outright since February 2025 — are fineable up to the higher of €35 million or 7% of worldwide annual turnover (Article 99(3)), under the penalty rules each Member State lays down. Both figures use "the higher of," which is the detail most summaries drop: for a large GPAI provider, 3% of global turnover is very likely to exceed €15 million, so the real ceiling scales with company size rather than capping out at the flat euro figure. The size rule runs the other way for small companies, but only under Article 99: for SMEs, including start-ups, each Article 99 fine is capped at whichever figure is lower (Article 99(6)). The Digital Omnibus extended that rule to small mid-caps, but only for the €15 million and €7.5 million tiers, not for prohibited practices (Article 99(6a)). Article 101 has no such carve-out, so a GPAI provider's ceiling is the higher figure whatever its size.
The gap between the two ceilings — 3% vs. 7% — reflects the Act's risk-tier structure: prohibited practices sit above GPAI obligations in severity, and the fine ceiling is roughly double.
The Digital Omnibus added one route by which the AI Office itself fines at the Article 99 levels. Since 2 August 2026 it has been exclusively competent to supervise and enforce the Act for AI systems built on a general-purpose AI model by the same provider or undertaking, and for AI systems that are or sit inside a designated very large online platform or search engine, subject to sector exceptions (Article 75(1)). For those systems it can impose fines under Article 99(3) to (7), which includes the prohibited-practice ceiling (Article 75c(4)). Every other prohibited-practice case stays with the national authorities.
| Violation category | Fine ceiling | Imposed by | Applies since |
|---|---|---|---|
| GPAI provider obligations | Higher of €15 million or 3% of worldwide annual turnover (Art. 101) | European Commission (AI Office) | 2 August 2026 |
| Prohibited practices (unacceptable-risk uses) | Higher of €35 million or 7% of worldwide annual turnover (Art. 99(3)); the lower of the two for SMEs (Art. 99(6)) | National authorities under Member State penalty rules; the AI Office for systems under Art. 75(1) | 2 August 2025; AI Office route 2 August 2026 |
Neither figure is a routine expectation; both are the maximum the competent authority can impose after establishing a violation, not a default penalty applied automatically. For most organizations, the more useful planning exercise is not estimating what a fine could theoretically reach, but confirming which category — GPAI provider or deployer of a system that could implicate prohibited-practice rules — actually applies to what you've built, since the two ceilings and the obligations behind them are not interchangeable.
The first year: obligations in force, no Commission fines
For GPAI models placed on the market on or after 2 August 2025, the provider obligations apply from placement (Chapter V applies from 2 August 2025, Article 113(b)); models already on the market before then have until 2 August 2027 to comply (Article 111(3)). Article 101 is the one penalty provision held back to 2 August 2026, so for a year the obligations applied but the Commission could not fine a breach of them. That gap between "the rule applies" and "the rule is enforceable by fine" closed on 2 August 2026. The text does not say whether Article 101 reaches an infringement that ended before that date; an obligation that applies and is still unmet after 2 August 2026 is a present infringement, not a past one. Confirm the position for your own models with counsel.
Practically, a GPAI provider that treated August 2025-to-August 2026 as a compliance grace period was correct that Commission fines weren't possible yet, but wrong if it read that as meaning the obligations themselves were optional. Documentation and evaluation gaps that opened during that first year are now within scope for an AI Office inquiry.
What this means for agent deployers who are not GPAI providers
If you deploy agents built on top of GPAI models rather than provide a GPAI model yourself, the enforcement mechanics above aren't aimed at you directly — but they aren't irrelevant either. First, an AI Office restriction or withdrawal action against an underlying model is a supply-chain risk for anything you've built on it: a governance program that can show why a specific model was selected, and can substitute or roll back quickly, is now hedging against a live regulatory tool rather than a hypothetical one, not a purely theoretical scenario. Second, deployer-side obligations — transparency, registration, and on a later timeline, high-risk conformity duties — run on separate provisions from the GPAI enforcement powers described here; a compliance checklist that tracks your own obligations by article, rather than by GPAI-specific headlines, keeps the two straight.
Third, and easy to overlook: a documentation request or technical evaluation aimed at a model provider can pull deployer-side evidence into scope indirectly, if the AI Office's inquiry touches how the model is actually being used in production. A deployer that already has clean records of what agent, what model version, and what configuration was live at a given time isn't just meeting its own transparency duties — it's also the party best positioned to answer quickly if a question arrives secondhand, through the provider, rather than directly.
What the Digital Omnibus did and did not move
The Digital Omnibus — Regulation 2026/1744, in force since 27 July 2026 — deferred the Annex III standalone high-risk conformity obligations and the Annex I obligations for AI embedded in regulated products; it did not touch the GPAI enforcement date or the fine ceilings described above. GPAI enforcement and high-risk conformity deadlines are separate tracks in the Act, and the Omnibus moved only the second one. It did change who enforces: it rewrote Article 75 and added Articles 75a to 75c, which make the AI Office the exclusive supervisor, with fining powers, for certain AI systems (see the fine-ceilings section above). As of August 2026, the regulation's implementing and delegated acts are still pending, so treat the mechanics in this post as the current legal position, not a fully settled one.
What to do with this now
No confirmed fine or enforcement action under these powers has been reported as of August 2026 — the AI Office gained a capability, not a track record. That's a reason to prepare, not to relax: a regulator's earliest actions after enforcement powers activate tend to set the pattern for what it actually prioritizes, and a provider that comes under review will have had months of warning that the powers existed. If you provide a GPAI model, your documentation and evaluation posture should already assume an AI Office request could arrive. If you deploy on top of one, your governance program should track which upstream models you depend on and how quickly you could respond to a supply-side disruption.
Common questions
Has the EU AI Office issued any fines yet? Not that has been publicly confirmed as of August 2026. The Commission's power to fine GPAI providers (Article 101) has applied since 2 August 2026; no confirmed fine or enforcement action under that power had been reported as of mid-August 2026. Prohibited-practice fines run mainly on a separate, national track (Article 99) that has applied since 2 August 2025.
Does the 2 August 2026 enforcement date apply to high-risk systems under Annex III? No — that's a separate track. Annex III high-risk conformity obligations were deferred to 2 December 2027 by the Digital Omnibus. The enforcement powers described here apply to GPAI provider obligations, which applied from 2 August 2025 and became fineable by the Commission on 2 August 2026. Prohibited practices are a third track: banned since 2 February 2025, with Article 99 penalties, imposed under national rules, applicable since 2 August 2025.
What is the fine for a GPAI provider that violates its obligations? Up to the higher of €15 million or 3% of worldwide annual turnover, imposed by the Commission (Article 101). Prohibited-practice violations carry a higher ceiling, up to the higher of €35 million or 7% of worldwide annual turnover (Article 99(3)), or the lower of the two for SMEs and start-ups (Article 99(6)), imposed under national penalty rules rather than by the Commission, except for the AI systems the AI Office supervises under Article 75(1).
If GPAI obligations applied since August 2025, why weren't providers fined during that first year? Because the obligations and the Commission's fining power apply from different dates. The GPAI obligations applied from 2 August 2025 (models already on the market before then have until 2 August 2027, Article 111(3)), but Article 101, the Commission's power to fine GPAI providers, was held back to 2 August 2026 (Article 113(b)). The text does not say whether that power reaches an infringement that ended before 2 August 2026; confirm with counsel.
Is my organization a GPAI provider, or a deployer? That distinction determines which obligations and which enforcement track apply to you, and it's worth confirming explicitly rather than assuming. If you build and release a general-purpose AI model, GPAI provider obligations and the enforcement powers in this post apply to you directly. If you build agents or applications on top of a model someone else provides, you're a deployer — subject to a different, and in some respects later, set of obligations under the Act, covered in the EU AI Act explained for engineering teams.