EU AI Act GPAI fines go live on 2 August 2026: how a €15M penalty actually lands on Indian and UK builders

What changes on 2 August 2026

The obligations themselves are not new. GPAI provider duties under the AI Act entered into application on 2 August 2025, and any general-purpose AI model placed on the EU market after that date has been on the hook ever since. What was missing for the first year was the Commission's enforcement teeth. From 2 August 2026 the Commission — operating through the AI Office — can investigate, request information, conduct audits and issue fines.

• Maximum penalty: up to 3% of worldwide annual turnover or €15 million, whichever is higher. This is the GPAI-specific cap; non-compliance with other AI Act provisions (prohibited practices, high-risk system breaches) carries higher caps.
• Who enforces: the European Commission's AI Office, with national co-ordination through Member State authorities.
• Models placed on market before 2 August 2025 get a longer runway — they must comply by 2 August 2027. Everything placed after that date is already covered.
• Code of Practice: the final voluntary Code is in place. Signing it gives a presumption of compliance with related transparency, copyright and safety/security obligations — not immunity.

The four baseline obligations every GPAI provider owes

Every GPAI provider — open or closed, hosted or distributed — owes the same four baseline obligations. None of these require legal interpretation; they are pure documentation and engineering work.

1. Technical documentation covering training, evaluation, intended purpose, limitations and capabilities — kept up to date and made available to the AI Office on request.
2. Instructions for use for downstream providers integrating the model, including the model's capabilities, limitations and the conditions under which it can be used safely.
3. Copyright compliance policy aligned with the EU Copyright Directive — in practice this means honouring the machine-readable opt-out mechanism rights-holders use to signal they do not want their content used for training.
4. Public training-data summary — a sufficiently detailed summary of the content used to train the model, published openly. This is the hardest of the four, because most teams have not been organising their training-data provenance to a publishable standard.

The systemic-risk tier — four more obligations on top

If your model crosses the systemic-risk threshold (the compute-based criterion the Commission has set, plus designation by the AI Office), four additional obligations apply on top of the baseline four:

5. Model evaluations using state-of-the-art protocols.
6. Adversarial testing (red-teaming) to identify and mitigate systemic risks.
7. Tracking and reporting of serious incidents to the AI Office, with corrective measures.
8. Cybersecurity protections covering the model and its physical infrastructure.

Crucially, the systemic-risk tier applies regardless of whether the model is open-weight or closed. An open-weight release does not exempt you from red-teaming or incident reporting if the model is large enough to qualify.

Obligation → who has to comply → deadline → suggested artefact

The mapping below is the cleanest way to translate the regulation into a sprint backlog.

Who is exposed in India

Indian builders frequently assume the AI Act stops at the EU border. It does not. Any Indian organisation that places a GPAI model on the EU market — by distributing weights to EU customers, offering a hosted API to EU users, or shipping the model inside a downstream product sold in the EU — is a GPAI provider under the Act.

• Sarvam — multilingual foundation models with EU enterprise interest. Hosted-API distribution today, but any weight-distribution channel triggers the heavier documentation burden. Our earlier coverage of Sarvam's $350M Series C noted EU expansion as part of the funding thesis.
• BharatGen — Indian government-backed multilingual foundation model programme. Any EU-facing distribution from the consortium or its participating labs lands inside the Act. See our coverage of the IndiaAI Mission's 12 LLM partners.
• Krutrim — Ola's foundation model effort. Same calculus.
• Any Indian startup distributing weights to EU customers — this includes fine-tunes of open base models if the fine-tune materially changes capabilities and is redistributed.

The Indian regulatory parallel is the DPDP Phase 2 AI compliance regime, which has different mechanics but a similar artefact-driven posture. Teams that have already organised their data lineage for DPDP have most of the raw material for the EU training-data summary.

Who is exposed in the UK

UK builders are in a peculiar position post-Brexit. The UK Frontier AI Bill is a separate regime that applies inside the UK; it does not exempt UK firms from the EU AI Act when they serve EU users. The trigger is the geography of the user, not the provider.

• Stability AI — UK-headquartered, models distributed globally including in the EU. Squarely inside the GPAI obligations.
• Any UK-based GPAI provider serving EU users — hosted-API access from EU users counts as placing the model on the EU market.
• UK-based fine-tuners redistributing materially modified open base models to EU customers — same exposure as the original provider for the redistributed derivative.

The UK government's parallel investment — the £500M UK Sovereign AI Fund — has been quiet on AI Act preparation for portfolio companies. Founders should not assume the Fund will cover compliance work.

Why €15M is not a theoretical number

The instinct among engineering teams is to treat €15M as a paper ceiling. The EU's record on GDPR fines should break that instinct. European data-protection authorities, coordinating under the European Data Protection Board and the Commission, have issued fines above €200M against named US tech platforms over the last five years — the Irish DPC's €1.2 billion Meta penalty in May 2023 and Luxembourg's €746 million Amazon penalty in 2021 are the most cited examples. Procedural muscle, investigator headcount, in-house legal capacity and political appetite for high-profile enforcement are all in place. The AI Office inherits that institutional muscle.

What is likely to differ in the first wave of GPAI enforcement is the target profile. Early enforcement actions usually focus on the most visible and most demonstrable non-compliance — missing training-data summaries, absent copyright opt-out mechanisms, failure to respond to AI Office information requests — rather than borderline interpretive disputes. If your team is sitting on incomplete documentation hoping for grace, recalibrate now. For the prior reporting on the runway, see our August 2026 GPAI checklist and the enforcement-day Builder checklist.

What to ship in the next nine weeks — the concrete checklist

If you are a GPAI provider and have not yet published the four baseline artefacts, the next nine weeks is your runway. Order matters — the training-data summary is the slowest, so it goes first.

1. Training-data summary — start now. Pull together provenance for every dataset that fed pre-training and any large-scale fine-tune. The Commission has published a template; use it. If you cannot fully reconstruct provenance for older data, document the gaps honestly rather than fabricate completeness.
2. Copyright opt-out mechanism — implement and document. The Copyright Directive's machine-readable opt-out is the operative standard; honouring it is the cheapest defence.
3. Technical documentation — pull existing model cards into the AI Office's expected structure. Most labs already have 70% of what is needed; the gap is usually evaluation methodology and known limitations.
4. Instructions for use — a single developer-facing page covering capabilities, limitations, intended use, and safe-use conditions. This is the easiest artefact.
5. Decide on the Code of Practice — read the final text, decide whether to sign. The presumption-of-compliance benefit is real; the cost is publicly committing to the Code's specifics.
6. If you are systemic-risk tier — start the model evaluations and red-team report now. These cannot be backfilled in the last week.

For background on how the wider AI Act timeline interacts with these GPAI obligations, see our coverage of the high-risk system deadline and the omnibus delay debate that briefly threatened to push parts of the timetable back. Primary sources: the official AI Act implementation timeline at artificialintelligenceact.eu/implementation-timeline, the Commission's regulatory framework page at digital-strategy.ec.europa.eu, the GPAI provider guidelines at digital-strategy.ec.europa.eu/guidelines-gpai-providers, and Latham & Watkins' summary of the GPAI obligations and final Code of Practice at lw.com.