EU AI Act GPAI 2 August 2027 deadline: checklist for pre-2025 models

Summary. Article 111(3) of the EU AI Act gives providers of general-purpose AI (GPAI) models placed on the EU market before 2 August 2025 until 2 August 2027 to meet the Act's GPAI obligations. Models placed on the market from 2 August 2025 have been bound since that date, and the Commission's enforcement powers, including fines of up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher, have applied since 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, did not move the legacy date or the GPAI duties in Articles 53 to 55 and 101. It changed three things around them: how the Code of Practice is assessed, which GPAI-based systems the AI Office supervises, and a 2 December 2026 marking deadline for older generative systems. By August 2027 a legacy provider needs Annex XI documentation for the AI Office, Annex XII documentation for integrators, a copyright policy, a public training-content summary on the Commission's template and, if based outside the EU, an authorised representative. The Commission does not expect retraining or unlearning where that is impossible or disproportionate, but every gap must be disclosed and justified. Integrators should collect these artefacts from their vendors now.

About this article. For providers, fine-tuners and integrators of general-purpose AI models that were on the EU market before 2 August 2025. We read Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, using both Official Journal texts and the Commission's consolidated text as at 27 July 2026, and checked the Commission's GPAI guidelines, template, Code of Practice and enforcement pages on 7 November 2026. This is general information, not legal advice: confirm your position with qualified EU counsel. No vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

What applies on 2 August 2027, and what is already live

The GPAI obligations have applied since 2 August 2025 to models placed on the market from that date. For older models, 2 August 2027 ends the transition; from then on, a legacy provider is in the same position as any other.

Sources: Articles 111 and 113, the Service Desk timeline and Commission pages.

The Commission's guidelines say Article 111(3) covers legacy models across their whole lifecycle, which starts with the large pre-training run; later development by the same provider, before or after release, stays part of the same model. As we read it, a 2024 model that its own provider kept updating through 2026 is still a legacy model. A third party's modification is a different case, covered in the worked example.

What the Digital Omnibus changed for pre-2025 models

Not the deadline and not the duties. We compared the 2024 text, the Omnibus and the consolidated text:

• Article 111(3) is unchanged. Its wording is identical before and after. Point 39 of the Omnibus replaces paragraph 2, on older high-risk systems, and adds paragraph 4, on content marking.

• The GPAI chapter is untouched. The Omnibus does not amend Articles 51 to 55, 88 to 94 or 101, or Annexes XI to XIII, so the duties, the 10^25 FLOP systemic-risk threshold and the fine cap stand.

• The start dates hold. Article 113 still applies Chapter V from 2 August 2025 and Article 101 from 2 August 2026.

Three changes reach legacy providers indirectly:

• Code of Practice assessment. Amended Article 56(6) has the Commission, taking utmost account of the AI Board's opinion, assess whether a code covers Articles 53 and 55, and drops the power to give a code general validity by implementing act. The recitals add that codes create no presumption of conformity; under Article 53(4), only harmonised standards do.

• Supervision of your own systems. Rewritten Article 75(1) makes the AI Office exclusively competent for AI systems built on a GPAI model by the same provider or group, and for AI systems in very large online platforms and search engines designated under the Digital Services Act. Exceptions include Annex I products, critical infrastructure and the administration of justice. New Articles 75a to 75d add market-surveillance powers, including inspections.

• Generative products. New Article 111(4) gives providers of generative AI systems, including general-purpose AI systems, placed on the market before 2 August 2026 until 2 December 2026 to meet the Article 50(2) machine-readable marking duty. It is a system duty, but a legacy model shipped in a chat or image product meets it first. See our Article 50 developer guide and our Digital Omnibus explainer.

Does your model count? GPAI, provider and placing on the market

Is it a GPAI model? The guidelines' indicative criterion is training compute above 10^23 floating point operations (FLOP) plus the ability to generate language (text or audio), text-to-image or text-to-video. Generality decides edge cases.

Are you the provider? The provider develops the model, or has it developed, and places it on the market under its own name or trademark, wherever it is based.

Was it placed on the market? The first making available in the EU counts, whether through an API, a library, a download, a cloud service, a chatbot or an app.

Two further tests change the tier:

• Systemic risk. A model trained with more than 10^25 FLOP is presumed to have high-impact capabilities. The provider must notify the Commission without delay, and within two weeks at the latest, once the model meets the threshold or it becomes known that it will, and may argue that it presents no systemic risk.

• Open-source exemption. A model under a free and open-source licence, with weights, architecture and usage information public and no monetisation, is exempt from the two documentation duties and the representative duty, but not from the copyright policy or the training summary. Systemic risk removes the exemption.

Fine-tuners. Most modification does not create a new provider. The indicative criterion is that the modification uses more than a third of the original model's training compute; if that figure cannot be known or estimated, a third of 10^23 FLOP, or of 10^25 FLOP for a systemic-risk original. A modifier who crosses the line covers only the modification and its data, and a non-EU modifier also needs a representative.

The four Article 53 duties, mapped to legacy evidence

Article 53(1) sets four duties for every GPAI provider; Article 54 adds the representative for non-EU providers and Article 55 adds systemic-risk duties.

Annex contents are from the Act; the relief column is from the guidelines and template Q&A.

Technical documentation. For a model trained in 2023 or 2024, the hard part is reconstructing compute, energy and the data pipeline. The guidelines accept a hardware-based estimate (GPUs, duration, peak performance and utilisation) or, for dense transformer language models, roughly 6 × parameters × training tokens, with the method documented and an error margin of up to 30%.

Downstream documentation. This pack goes to integrators proactively. Both sets must stay current for the model's lifecycle; the Code's Transparency chapter supplies a Model Documentation Form.

Copyright policy. One policy can cover all of a provider's models. For crawled data, the question is whether your crawlers honoured machine-readable opt-outs at collection time. Our explainer on the IETF AI preferences vocabulary and robots.txt covers the publisher side of that signal.

Training-content summary. The template is mandatory. It has three sections: general information, including content types and size per modality in broad ranges; a list of data sources (public, private, scraped, user and synthetic data); and data processing aspects, including removal of illegal content. For scraped data, providers name their crawlers, the collection period and the top 10% of scraped domains, or for SMEs the top 5% or 1,000 domains, whichever is lower. The summary goes on the provider's website and on the model's public distribution channels. When further training changes it, it is updated at six-month intervals, or sooner for a materially significant update.

Legacy relief: what the Commission will and will not accept

Paragraph 111 of the guidelines says a provider of a model placed before 2 August 2025 need not retrain or unlearn it where that cannot be done for past actions, where some training-data information no longer exists, or where retrieving it would be a disproportionate burden. Each such case must be clearly disclosed and justified in the copyright policy and the training summary. The template Q&A applies the same logic: gaps that best efforts cannot fill are stated and justified in the published summary.

The relief does not waive the documentation, the representative or the summary itself. A gap disclosure is a public statement that rightsholders will read, so draft it with counsel, and the copyright policy still governs all future training. The guidelines are not legally binding, but the Commission says it will base enforcement on them.

The Code of Practice route versus alternative adequate means

The GPAI Code of Practice, published on 10 July 2025, has three chapters: Transparency and Copyright for all GPAI providers, and Safety and Security for providers of models with systemic risk. The Commission and the AI Board have confirmed it is an adequate voluntary tool. The Commission's list, last updated on 7 October 2026, names 22 signatories: AI Studio Delta, Aleph Alpha, Almawave, Amazon, Anthropic, Black Forest Labs, Bria AI, Cohere, Domyn, Dweve, Fastweb, Google, IBM, LINAGORA, Microsoft, Mistral AI, Open Hippo, OpenAI, Pleias, Reflection AI, ServiceNow and WRITER. xAI signed only the Safety and Security chapter, so it must show transparency and copyright compliance by other means.

The comparison draws on the guidelines, the EU SEND instructions, Article 101 and the signing Q&A.

Signing means sending a form signed by someone with authority to bind the company. There is no deadline, opting out of a chapter loses its compliance benefit, and the AI Office reviews the Code at least every two years. Since the Omnibus, the Code's standing rests on the Commission's adequacy assessment under Article 56(6).

Enforcement by the AI Office since 2 August 2026

The AI Office enforces the GPAI rules on the Commission's behalf. Its tools:

• Requests for information. Simple requests come from the AI Office, formal ones by Commission decision. Incorrect or misleading replies to either can be fined, as can non-replies to a decision.

• Evaluations. The AI Office, or experts it appoints, can require access to a model to evaluate it.

• Measures. The Commission can require compliance steps, mitigation of a systemic risk, or restriction, withdrawal or recall of a model.

• Fines. Article 101 caps fines at 3% of annual total worldwide turnover in the preceding financial year or EUR 15 million, whichever is higher, for intentional or negligent infringements, failed or misleading information replies, ignored measures or refused evaluation access. The provider sees preliminary findings and is heard first, and the Court of Justice can cancel, reduce or increase a fine.

Downstream providers have had a right to complain since the original Act, and the AI Office opened a dedicated channel for complaints about Articles 53 to 55 when enforcement began. The guidelines promise a cooperative, step-by-step and proportionate approach. The Commission's enforcement page, last updated on 20 October 2026, reports no fine decision against a GPAI provider. That says little about late 2027.

What downstream integrators need from their model vendors

If you build on a third-party model, the duties sit with the vendor, but you depend on the outputs. A high-risk system in hiring or credit cannot be documented without the Annex XII pack; our guide to EU high-risk AI rules for hiring and credit from 2 December 2027 covers that side. The legal hooks below are from Articles 53 and 111.

Retirement is a real option. Our comparison of AI model retirement policies shows how much notice the major vendors promise.

Worked example: a pre-August 2025 model and two derivatives

Assumed figures, applying the guidelines' thresholds and compute formula; not a real model.

The base model. A non-EU lab releases a 7-billion-parameter text model in March 2025 under a commercial licence, trained on 4 trillion tokens, and offers it in the EU by API and download.

• Training compute ≈ 6 × 7 × 10^9 × 4 × 10^12 = 1.68 × 10^23 FLOP: above the 10^23 criterion, and it generates text, so it is presumed a GPAI model. It is far below 10^25 FLOP, so no systemic-risk presumption.

• Placed before 2 August 2025, so the provider must comply by 2 August 2027, including an EU authorised representative. The commercial licence rules out the open-source exemption.

Derivative 1: a light fine-tune. An Indian HR-tech company fine-tunes the model on 50 billion tokens in 2026.

• Compute ≈ 6 × 7 × 10^9 × 5 × 10^10 = 2.1 × 10^21 FLOP. A third of the original is 5.6 × 10^22 FLOP; the fine-tune uses about 1.25% of the original (2.1 × 10^21 ÷ 1.68 × 10^23).

• The company is not a GPAI model provider. It is a downstream provider of an AI system, and if that system screens candidates for EU employers, the high-risk rules apply from 2 December 2027.

Derivative 2: heavy continued pre-training. Another company continues pre-training on 1.5 trillion tokens and releases the result in 2026.

• Compute ≈ 6 × 7 × 10^9 × 1.5 × 10^12 = 6.3 × 10^22 FLOP, above the 5.6 × 10^22 threshold, so it becomes the provider of a modified GPAI model, with duties limited to the modification and its data.

• As we read Article 111(3), that model was placed on the market in 2026, so it gets no transition to 2027. Its obligations applied at release.

India note

An Indian lab that makes model weights or an API available to EU users is placing a model on the EU market and, unless the open-source exemption applies, needs an EU authorised representative. Indian IT services firms that integrate vendor models into EU clients' systems are usually downstream providers or deployers. The logging work overlaps with India's DPDP rules, covered in our DPDP engineering playbook.

Compliance checklist for 2 August 2027

1. Inventory models with first EU placement date, licence, channels and version lineage.

1. Classify each model: GPAI, systemic risk, open-source exemption, with the compute estimate and method.

1. Choose the route: sign the Code, or prepare an alternative-means report with a gap analysis.

1. Appoint an EU authorised representative if you are outside the EU and not exempt.

1. Build the Annex XI file and the Annex XII pack, with an owner who keeps both current.

1. Update the copyright policy, including how crawlers honour machine-readable opt-outs.

1. Write the gap disclosures where retraining, unlearning or data retrieval is impossible or disproportionate.

1. Publish the training summary on the template, on your site and every public channel.

1. Check systemic-risk status and notify within two weeks if a model meets 10^25 FLOP.

1. Set up an AI Office response process: owner, EU SEND access, triage and legal review.

1. Check generative products on legacy models against the 2 December 2026 marking deadline.

1. Decide which legacy models to retire, and give customers notice.

1. For integrators: collect vendor artefacts, log model versions in production, and map high-risk use to the December 2027 rules.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our EU AI Act compliance engineering service builds the evidence these rules assume, such as model inventories, compute estimates, crawler records and output logging, alongside your EU counsel. Talk to us at /contact-us/.

Last updated: 7 November 2026.

References

1. Article 111: AI systems already placed on the market or put into service and general-purpose AI models already placed on the market, consolidated text as at 27 July 2026 — AI Act Service Desk, European Commission

1. Article 101: Fines for providers of general-purpose AI models — AI Act Service Desk, European Commission

1. Article 113: Entry into force and application, as amended by the Digital Omnibus — AI Act Service Desk, European Commission

1. Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), Official Journal L, 24 July 2026 — Publications Office of the European Union

1. Guidelines on the scope of the obligations for providers of general-purpose AI models, C(2025) 5045, 18 July 2025 — European Commission

1. Guidelines for providers of general-purpose AI models — European Commission, Shaping Europe's digital future

1. Guidelines on obligations for General-Purpose AI providers, questions and answers — European Commission

1. Timeline for the implementation of the EU AI Act — AI Act Service Desk, European Commission

1. The General-Purpose AI Code of Practice and signatories, last updated 7 October 2026 — European Commission

1. Explanatory Notice and Template for the Public Summary of Training Content for general-purpose AI models, 24 July 2025 — European Commission

1. AI Omnibus enters into force, 27 July 2026 — European Commission

1. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal L, 12 July 2024 — Publications Office of the European Union

1. Article 56: Codes of practice, as amended by the Digital Omnibus — AI Act Service Desk, European Commission

1. Article 53: Obligations for providers of general-purpose AI models — AI Act Service Desk, European Commission

1. Article 75a: Supervisory and enforcement powers of the AI Office — AI Act Service Desk, European Commission

1. Article 52: Procedure — AI Act Service Desk, European Commission

1. Article 54: Authorised representatives of providers of general-purpose AI models — AI Act Service Desk, European Commission

1. Article 55: Obligations of providers of general-purpose AI models with systemic risk — AI Act Service Desk, European Commission

1. Template for general-purpose AI model providers to summarise their training content, questions and answers — European Commission

1. Signing the General-Purpose AI Code of Practice, questions and answers — European Commission

1. The enforcement framework of the AI Act, last updated 20 October 2026 — European Commission

1. Article 93: Power to request measures — AI Act Service Desk, European Commission

1. Commission starts enforcing AI Act rules and new transparency requirements on 2 August, 31 July 2026 — European Commission press release