EU AI Act enforcement powers begin for general-purpose AI providers

The European Commission’s EU AI Act enforcement powers began applying on Aug. 2, giving the bloc a new way to police companies that provide general-purpose AI models. For investors tracking the AI industry, the change adds a direct regulatory risk for providers operating in Europe, including possible fines and orders to fix problems or limit market access.

The new authority does not mean OpenAI, Anthropic or Google has been charged under the AI Act. Reuters reported on July 31 that Commission officials were in contact with OpenAI and Anthropic after separate cybersecurity incidents involving their AI systems. Officials said they would assess whether a more formal response was needed, but the reporting did not describe a new enforcement case.

What can the EU do under its new AI Act enforcement powers?

The Commission can enforce the AI Act’s obligations for providers of general-purpose AI, or GPAI, models. The EU AI Office defines these as models able to perform a broad range of tasks and to be incorporated into different later-stage products or applications.

Under the Commission’s guidance, GPAI providers must prepare technical documentation, make certain information available to companies building on their models, adopt a copyright policy and publish a summary of training content. They must also provide documentation when requested by the AI Office or national authorities.

Providers of the most advanced models that pose “systemic risk” face further duties. Those include notifying the Commission, testing and reducing risks, reporting serious incidents and maintaining adequate cybersecurity. The EU says systemic risks can include large-scale cyber harm, harmful manipulation, threats to basic rights, and situations where autonomous systems operate outside human control.

The rules for providers started applying on Aug. 2, 2025. The important shift this month is that the Commission can now enforce them, including through fines, according to the Commission’s published timeline. Providers of GPAI models put on the market before Aug. 2, 2025 have until Aug. 2, 2027 to comply.

How large can AI Act penalties be?

The ceiling depends on the breach. Reuters reported penalties can range from €7.5 million or 1.5% of turnover to €35 million or 7% of global turnover. Separately, Jurist reported that violations of the AI Act’s Article 50 transparency rules can carry fines of up to €15 million or 3% of worldwide annual turnover.

CNBC reported the Commission can inspect models, restrict access to the EU market and impose penalties. Elisabetta Righini, a partner at law firm Sidley Austin, told CNBC that the powers can reach companies offering GPAI models in the EU even when those companies are based elsewhere.

OpenAI told CNBC it had worked with the Commission and other stakeholders on implementing the AI Act and its voluntary codes of practice. That is the company’s account of its engagement, rather than a Commission finding on compliance.

This story draws on original reporting from CNBC.