The European Commission can now demand model evaluations, restrict E.U. market access, and levy fines on general-purpose AI providers
Bloomberg / Getty Images
The European Commission began enforcing the E.U. AI Act's rules for general-purpose AI models on Sunday, gaining new powers to inspect models, restrict access to the European market, and fine providers up to €15 million or 3% of annual turnover, whichever is higher.
The enforcement powers, which took effect August 2, are administered by the Commission's AI Office and cover every company that makes a general-purpose AI model available in the E.U., no matter where that company is headquartered, according to CNBC. That puts U.S. companies including Anthropic, OpenAI, and Google $GOOGL among those subject to the new rules.
Under the AI Act, providers of general-purpose AI models must document certain information and share it with competent authorities or downstream providers. They must also establish a copyright policy and publish a summary of the data used to train their models. Providers of the most advanced models, which the Act defines as those that may pose systemic risks, face additional requirements covering potential large-scale harms including cybersecurity threats and risks to fundamental rights, the Commission said.
The enforcement regime also covers prohibited AI practices — including systems that manipulate people, exploit vulnerabilities, or score individuals in ways that threaten their rights — as well as new transparency requirements. Chatbots and other interactive AI systems must now tell users they are interacting with AI rather than a human, and AI-generated or altered content must carry machine-readable marks.
Henna Virkkunen, executive vice-president for tech sovereignty, security and democracy at the European Commission, said in a statement: "Harms can occur if AI is not properly designed and used and the most advanced models create risks on an entirely new scale."
Elisabetta Righini, partner at law firm Sidley Austin, said that exposure to fines is real and extends beyond substantive violations. "What's rarely appreciated is that GPAI liability isn't limited to substantive breaches: refusing an information request, giving misleading answers, or blocking a model evaluation is fineable on its own," she said. Righini also noted that companies headquartered outside the E.U. are required to designate a local representative through whom regulators can make contact.
Tom Gordon, VP of EMEA policy at OpenAI, said in a statement the company would continue working with the Commission. "We've collaborated closely with the European Commission and the wider ecosystem on implementing the AI Act, including its Codes of Practice, and will continue working together to help Europe realise the benefits of the Intelligence Age," he said. A Google spokesperson said the company remains committed to meeting all applicable rules.
The E.U. has also opened discussions with OpenAI and Anthropic in the wake of cyber attacks that have been linked to their models, according to CNBC. The new enforcement powers arrive after months of tension between the bloc and U.S. AI labs over model access. Anthropic agreed to give the EU's cybersecurity agency ENISA access to its Mythos model after senior Commission officials traveled to San Francisco to press Anthropic leadership directly, following an earlier arrangement in which OpenAI offered the EU access to its GPT-5.5-Cyber model.
Join 500,000+ readers who start their day with Quartz.
By subscribing, you agree to our Terms of Service and Privacy Policy.
