EU AI Act GPAI Compliance Checklist: August 2, 2026 Deadline

August 2, 2026 is the GPAI enforcement date — and it was not extended. The EU Digital Omnibus moved only the Annex III high-risk AI deadline (to December 2027). GPAI model providers have until August 2 to comply with six obligations. This checklist covers what you must do and who it actually applies to.

Who This Applies To

The GPAI rules apply to providers of general-purpose AI models — companies that train and make available foundation models used in the EU. This includes:

• Companies training and publishing open-weight models (Llama, Mistral, Falcon)
• Companies offering foundation models via API (OpenAI, Anthropic, Google, Cohere, AI21)
• Startups training their own general-purpose base model

This does NOT apply to:

• Companies using a GPAI API in their product (you are a deployer, not a GPAI provider)
• Companies fine-tuning a foundation model for a narrow, specific purpose
• Companies building AI applications on top of third-party foundation models

If your AI product is "we fine-tuned GPT-4 to handle customer service for banks" — you are not a GPAI provider. Your compliance obligations fall under the Annex III deployer rules if your use case is high-risk, or the limited-risk disclosure rules if you run a customer-facing chatbot.

Open-source exception (Article 53(2)): GPAI models released under a free and open-source licence — with model weights, architecture, and usage information publicly available — are partially exempt. Open-source GPAI providers must still comply with Step 2 (training data summary) and Step 3 (copyright opt-out), but are exempt from Step 1 (full technical documentation package) and Step 4 (deployer information package). Open-source models that cross the systemic risk threshold (10²⁵ FLOPs) still face the full obligations in Steps 5, 6, and 7.

Models already on market before August 2, 2025 (Article 111(3)): GPAI models that were placed on the market before August 2, 2025 have a two-year grace period and must comply by August 2, 2027 — not August 2, 2026. If your model was released before that date, use 2027 as your compliance target for Steps 1–4.

The 7-Step GPAI Compliance Checklist

Step 1: Technical Documentation (Annex XI)

Maintain a technical documentation package covering:

• General description of the model — architecture, number of parameters, training approach
• Training data: types of data used, volume, filtering steps, exclusions
• Training methodology: compute used, training duration, fine-tuning steps
• Performance benchmarks: evaluation datasets used, benchmark scores
• Known limitations and failure modes
• Energy consumption during training and inference
• Contact information for the European AI Office

Format: no prescribed format. A structured document, maintained in version control, is sufficient. It must be available to the European AI Office on request and updated when the model changes materially.

Step 2: Training Data Summary

Publish a sufficiently detailed summary of the training data used. The summary must enable third parties to understand the model's data provenance — it does not need to list every source, but must describe categories of data, approximate volume, and steps taken to filter or clean the data.

The European AI Office has published guidance on what "sufficiently detailed" means: it includes data type categories (web crawl, books, code, etc.), rough volume per category, languages included, temporal range, and copyright compliance steps.

Step 3: Copyright Opt-Out Policy

GPAI providers must have a policy in place for complying with EU copyright opt-outs. Under EU copyright law, rights holders can opt out of having their content used for AI training. Your policy must:

• Document how your training data collection respects robots.txt and equivalent opt-out signals
• Describe the process for rights holders to request removal from future training runs
• Apply to web-crawled data, licensed content, and any third-party datasets used

Step 4: Downstream Deployer Information Package

GPAI providers must give deployers (companies building on your model) the information they need to comply with their own EU AI Act obligations. This package must include:

• Intended uses of the model and use cases it was designed for
• Known limitations and risks — including biases, failure modes, and domains where the model underperforms
• Guidance on human oversight — what oversight mechanisms deployers should implement
• Performance benchmarks and evaluation methodology
• Contact information for technical questions

This is typically handled via model documentation, API documentation, system cards, or model cards published alongside the model.

Step 5: Adversarial Testing — Systemic Risk Models Only

If your model was trained with more than 10²⁵ FLOPs, you have additional obligations:

• Conduct adversarial testing (red-teaming) before deployment
• Document the methodology: what scenarios were tested, who conducted testing, what risks were found, and what mitigations were applied
• Make test results available to the European AI Office
• Repeat testing when the model is materially updated

For most startup foundation models, the compute threshold is above your training budget. Frontier-scale models (GPT-4 equivalents and above) are the primary target.

Step 6: Incident Reporting — Systemic Risk Models Only

From August 2, 2026, systemic risk GPAI providers must:

• Report serious incidents to the European AI Office within a defined timeframe (the AI Office is finalizing specific timeframes; expect 72-hour initial notification similar to GDPR breach notification)
• Maintain an incident log
• Cooperate with European AI Office investigations

Step 7: Cybersecurity Measures — Systemic Risk Models Only

Article 55(1)(d) requires systemic risk GPAI providers to ensure an adequate level of cybersecurity protection for the model and its infrastructure. This includes:

• Protecting model weights from unauthorized access, extraction, or exfiltration
• Implementing access controls for fine-tuning infrastructure and training data pipelines
• Documenting the cybersecurity architecture and threat model for the model
• Testing for model extraction attacks and weight-stealing vectors

Cybersecurity obligations apply regardless of whether the model is open-source — open-source systemic risk models cannot rely on the Article 53(2) exemption to avoid the systemic risk requirements in Article 55.

Transition Period for Pre-2025 Models (Article 111(3))

If your GPAI model was placed on the market before August 2, 2025, you have an extended compliance deadline:

This transition period applies only to obligations under Article 53 (Steps 1–4). Systemic risk obligations (Steps 5–7) follow August 2, 2026 regardless of model placement date.

Timeline to August 2, 2026

With roughly 10 weeks to the deadline from the date of this article:

What If You Use (Not Provide) a GPAI Model

If your product uses OpenAI, Anthropic, Google, or any other GPAI API, Steps 1–6 above are the API provider's responsibility, not yours. Your obligations under the EU AI Act depend on what you do with the output:

• Internal productivity use: Minimal-risk. No obligations.
• Customer-facing chatbot: Limited-risk. Disclose it is AI (August 2, 2026).
• Hiring, credit, education, or other Annex III domains: High-risk deployer. Six-step Annex III process, deadline December 2, 2027.

For help assessing your risk tier as a deployer, see the EU AI Act compliance guide for small teams. For background on the GPAI category and how it interacts with the high-risk rules, see the EU AI Act plain English guide.