Skip to content
EU AI Act milestone Breaking

EU AI Act GPAI enforcement begins 2 August 2026: what Irish SMEs using AI tools need to check

Regulatory event dated 2 August 2026. Published 1 June 2026.

From 2 August 2026 the EU AI Office can fine providers of general-purpose AI models up to EUR 15 million or 3 percent of global annual turnover under Article 101 of the EU AI Act.

What changed

  • From 2 August 2026 the European Commission's AI Office gains enforcement powers over providers of general-purpose AI (GPAI) models, including the power to fine.
  • Under Article 101 of the AI Act, fines on GPAI providers can reach EUR 15 million or 3 percent of total worldwide annual turnover, whichever is higher.
  • GPAI provider obligations under Articles 53 to 56 cover technical documentation, transparency to downstream deployers, a policy to comply with EU copyright law, and a public summary of training content.
  • A GPAI model is presumed to carry systemic risk once training compute exceeds 10 to the power of 25 floating-point operations (Article 51), which adds Article 55 duties: model evaluation, adversarial testing, systemic-risk mitigation and serious-incident reporting to the AI Office.
  • The GPAI Code of Practice, finalised in 2025, is voluntary. Signing it is one route to demonstrate compliance, but it is not legally binding and not mandatory.

What you need to do

  1. List the AI tools your business uses that are built on a general-purpose model (chat assistants, content generation, support automation, AI features inside your CRM or marketing platform). The obligation sits with the model provider, but your supplier choice is your exposure.
  2. Ask each AI vendor whether the underlying model provider publishes the Article 53 technical documentation and the public summary of training content, and whether they have signed the GPAI Code of Practice.
  3. For any tool that processes personal data, keep your GDPR position separate and current. The AI Act sits on top of GDPR; it does not replace your data-protection obligations to the Data Protection Commission.
  4. Note that models placed on the market before 2 August 2025 have until 2 August 2027 to comply, so a tool's compliance timeline depends on when its model launched.

On 2 August 2026 the EU AI Office gains the power to enforce the AI Act’s rules on providers of general-purpose AI (GPAI) models, including the power to impose fines. This is the date the obligations that came into application on 2 August 2025 acquire teeth.

For an Irish SME, the obligation itself sits with the model provider, not with you as a user. The companies in scope are the developers of the underlying general-purpose models. But your exposure runs through the tools you buy. If an AI feature in your CRM, your customer-support desk or your marketing platform is built on a model whose provider is not meeting its Article 53 to 56 duties, that is a supply-chain risk you should be able to see.

The four core GPAI obligations under Articles 53 to 56 are: maintaining technical documentation, providing transparency information to the businesses that build on the model, putting in place a policy to comply with EU copyright law, and publishing a sufficiently detailed public summary of the content used to train the model.

A second, heavier tier applies to the most capable models. Article 51 presumes a model carries systemic risk once the cumulative training compute exceeds 10 to the power of 25 floating-point operations, a level calibrated to the most advanced models at the time the law was written. Models above that line, or designated by the Commission, pick up Article 55 duties: model evaluation including adversarial testing, assessment and mitigation of systemic risks, and reporting of serious incidents to the AI Office without undue delay.

The penalties are set in Article 101. The AI Office can fine a GPAI provider up to EUR 15 million or 3 percent of total worldwide annual turnover, whichever is the higher figure.

One nuance on timing. Models placed on the market before 2 August 2025 have a grace period to 2 August 2027, while models launched after that date had to comply on launch. So a tool’s compliance posture depends partly on when its model went live.

This page surfaces the regulation and links the primary EU sources. It is not legal advice. Confirm your own obligations, particularly where AI tools process personal data under GDPR, with a qualified adviser.

Vendors signalling eu data residency

Generated live from the Vendors.ie dataset: vendors in the affected categories that carry a verified eu data residency signal, the data point most relevant to this event. This is a starting filter for your own due diligence, not a ruling that any vendor is compliant with the regulation.

Affected categories

Related on Vendors.ie

Sources

Vendors.ie surfaces the regulation and links the authority's primary document. This is not tax, legal or financial advice. Consult your own adviser before acting.

Last reviewed 1 June 2026