What are the Enforceable GPAI Rules Under the EU AI Act, and Why are Regulators Now Issuing Fines and Audit Letters?

The European Union Artificial Intelligence Act (EU AI Act) has transitioned from a theoretical legislative framework into an actively enforced regulatory reality. The provisions governing General-Purpose AI (GPAI) models are now operational, establishing compliance requirements for both the developers who publish these models and the enterprises that deploy them.

GPAI models are versatile AI systems capable of performing a wide range of distinct tasks. They are subject to tiered regulatory scrutiny based on their capabilities and potential for systemic risk. With key obligations having taken effect in August 2025 and full enforcement powers active as of August 2026, European regulators have moved into an active enforcement posture, utilizing audit letters and financial penalties to ensure transparency, safety, and accountability across the AI supply chain.

Core Enforceable Rules for GPAI

The EU AI Act mandates specific operational and reporting standards for organizations developing and publishing GPAI models:

• Technical Documentation: Model publishers must maintain comprehensive records detailing the architecture, training methodologies, and intended use cases of their AI systems. This documentation must be provided to regulatory authorities upon request.
• Copyright Compliance: AI developers are required to implement policies that respect EU copyright law. This includes publishing detailed, publicly available summaries of the data used to train their GPAI models, allowing rights holders to exercise their rights.
• Systemic Risk Management: GPAI models classified as posing systemic risks face stricter mandates. Publishers must conduct model evaluations, perform adversarial testing (red-teaming), and report serious incidents directly to the European AI Office.
• Cybersecurity and Energy Reporting: High-impact GPAI providers must ensure robust cybersecurity protections for their model weights and report on the energy consumption and environmental impact of their training processes.

Mechanisms of Active Enforcement

Regulators are no longer treating AI regulation as a future agenda item. Authorities are now utilizing several tools to enforce compliance:

• Audit Letters: The European AI Office and national regulatory bodies are issuing formal requests for technical documentation and proof of copyright compliance. These letters require detailed responses and serve as the first step in regulatory investigations.
• Financial Penalties: Regulators can levy significant fines against organizations that fail to meet transparency requirements, ignore copyright obligations, or inadequately manage systemic risks.
• Market Withdrawal Orders: In cases of severe non-compliance or identified public danger, authorities possess the power to order the restriction, recall, or complete withdrawal of a GPAI model from the European market.

Impact on Corporate Procurement

The enforcement of these rules extends beyond the creators of AI models to the businesses that utilize them, fundamentally changing how software is purchased and integrated:

• Deployer Liability: Companies integrating GPAI into their workflows must ensure their AI vendors are compliant with the EU AI Act. Under the Act, liability cascades through the supply chain, meaning that deploying a non-compliant model exposes the deploying organization to secondary regulatory scrutiny and operational risk.
• Procurement Checklists: To mitigate legal and financial risk, enterprise IT and legal departments are adopting stricter procurement processes. These verify that any third-party AI tool possesses the necessary EU compliance documentation, copyright summaries, and risk assessments before it can be licensed or deployed.

Summary

The EU AI Act’s move into active enforcement marks a significant shift in how AI is regulated in Europe. By enforcing rules around transparency, copyright, and risk management through audit letters and financial penalties, regulators are making clear that both the publishers of General-Purpose AI models and the enterprises that deploy them are expected to prioritize safety, legal compliance, and accountability.