This page summarizes two European Commission documents read together: the Guidelines on the scope of obligations for providers of general-purpose AI models under the AI Act (last updated 26 March 2026), an interpretive instrument, and the Commission's AI Act Governance and Enforcement overview, an institutional one. The two describe how the AI Act is being implemented in practice: who supervises whom, the Commission's enforcement posture, and the state of member-state preparation. This implementation layer is distinct from the AI Act text itself, covered on EU AI Act (Regulation 2024/1689) and EU AI Act (Regulation 2024/1689), and from the voluntary GPAI Code of Practice.
Sources:
- Commission, Guidelines on the scope of obligations for providers of general-purpose AI models under the AI Act, last updated 26 March 2026
- Commission, AI Act Governance and Enforcement overview page
- Commission, AI Office landing page
Compliance architecture
The documents describe a two-instrument compliance stack for GPAI providers. The guidelines are the Commission's interpretation of who counts as a GPAI provider, what "significant modification" means, how open-source exemptions operate, and what documentation the AI Office expects. The Code of Practice is a voluntary instrument that, once signed, gives providers a presumption of compliance with Articles 53 and 55 (EU General-Purpose AI Code of Practice (Final Version, 2025)). The guidelines are described as updated documents rather than a one-time publication, most recently revised 26 March 2026.
Open-source GPAI models receive partial exemptions under specified conditions, consistent with the AI Act text and the guidelines. This boundary distinguishes the EU approach from broader-scope regimes.
Commission enforcement posture
Under Articles 51–56, the Commission is the exclusive regulator for GPAI model providers. The documents attribute this centralization to the technical capacity GPAI supervision requires at the model level, which individual member states do not possess. The European AI Office had grown to more than 125 staff across six operational units plus two advisory positions as of late 2025, per Commission reporting. Documentation is submitted through the EU SEND platform, a standardized digital channel.
The Digital Simplification Package, proposed in November 2025, included amendments to further centralize GPAI oversight at the Commission. As of the retrieval date it was proposed but not adopted, indicating direction of travel rather than settled law. The Commission's framing presents an orderly phased rollout; the centralization proposal, read alongside the member-state implementation gap below, has been characterized as a response to fragmentary member-state-level enforcement on the GPAI supply chain.
Member-state implementation gap
The deadline for member states to designate national competent authorities and single points of contact was 2 August 2025. As of March 2026, seven months past that deadline, only 8 of 27 member states had designated a single point of contact. For most of the EU, the machinery for enforcing high-risk system obligations and cross-border cooperation was therefore not yet operational, even as those obligations approached their 2 August 2026 application date. The 8-of-27 figure is the most policy-significant factual claim in the source: a direct datapoint on the EU's decentralized enforcement machinery running behind schedule. The official posture of a phased rollout and the operational reality of the designation gap are not formally contradictory; both can hold at once.
Enforcement timeline
| Date | Event |
|---|---|
| 1 Aug 2024 | AI Act enters into force |
| 2 Feb 2025 | Prohibitions (Art. 5) apply |
| 2 Aug 2025 | GPAI obligations apply; member-state authority-designation deadline |
| 2 Aug 2026 | Commission GPAI enforcement powers activate, including fines |
| 2 Aug 2027 | High-risk system obligations fully apply; pre-2025 GPAI models must comply |
The activation of Commission GPAI enforcement powers, including fines, on 2 August 2026 is a fixed statutory date.
Governance bodies
The framework names four governance bodies:
- European AI Office (Commission) — supervises GPAI.
- European AI Board — member-state representatives; coordinates national implementation.
- Scientific Panel — independent experts; systemic-risk advisory.
- Advisory Forum — industry, SMEs, civil society, and academia.
Provenance and relevance
The source documents how the AI Act is being rolled out, complementing the AI Act text on EU AI Act (Regulation 2024/1689) and the operational EU General-Purpose AI Code of Practice (Final Version, 2025), and giving concrete shape to the AI Office's capacity and mandate. The 8-of-27 designation figure is a candidate datapoint for a future page on regulatory-implementation gaps, the broader pattern in which passing a law outruns the capacity to enforce it. The source extends rather than challenges the existing AI Act coverage; no direct contradictions with other pages were detected.
Relationships
- supports: EU AI Act (Regulation 2024/1689), EU General-Purpose AI Code of Practice (Final Version, 2025), EU AI Office
- depends-on: EU AI Act (Regulation 2024/1689) (source summary)
- related: Anthropic's Responsible Scaling Policy (Version 3.1), OpenAI Preparedness Framework V.2, Frontier Compliance Framework (February 2026), Frontier AI Safety Commitments (Seoul, 2024), G7 Hiroshima Code of Conduct for Advanced AI (2023)