EU enforcement powers over general-purpose AI providers take effect

The August milestone is part of the AI Act's phased implementation. Providers that placed general-purpose AI models on the EU market after August 2, 2025, have already been subject to documentation, copyright-policy and training-content-summary duties. Providers of models classified as posing systemic risk face additional requirements covering model evaluations, risk assessment and mitigation, serious-incident reporting and cybersecurity.

Commission guidance also says providers of general-purpose AI models placed on the market before August 2, 2025, have until August 2, 2027, to comply. The rules apply to providers placing models on the EU market regardless of whether the provider is based inside or outside the bloc.

That scope makes the enforcement milestone relevant to major model developers serving European users. CNBC highlighted OpenAI and Anthropic among the companies facing the new supervisory environment, but the arrival of enforcement powers is not itself a finding that either company, or any other provider, violated the Act.

The Commission's official Q&A describes powers to request information, conduct evaluations of general-purpose AI models, require measures such as risk mitigations, recall models from the market, and impose fines. These authorities convert existing duties into an operational compliance risk; they do not predetermine how aggressively or quickly the AI Office will use them.

Independent reporting has focused on that implementation question. The Parliament Magazine reported that the office's effectiveness will depend on its willingness and capacity to supervise technically complex systems, while Tech Policy Press described an intended period of constructive dialogue with providers and reported separate staffing counts for the office's compliance and AI-safety teams. Those figures refer to different organizational units and should not be collapsed into a single definitive enforcement-headcount claim.

For model providers serving the EU, the immediate consequence is a greater need to produce evidence on request. Useful records include versioned technical documentation, reproducible evaluations, systemic-risk assessments, incident reports, cybersecurity controls, training-content summaries and a clear chain from identified risks to mitigations.

The practical test now is enforcement: which information the Commission requests, how it evaluates systemic-risk models, what corrective measures it considers proportionate, and when dialogue escalates into a formal action. Until such an action is announced, the accurate claim is that the Commission's powers are active—not that a named provider has already been found noncompliant.