Enforcement of Chapter V under the EU AI Act

This page aims to provide an overview of the EU AI Act’s enforcement provisions relating to Chapter V, namely the provisions that impose obligations on providers of general-purpose AI (GPAI) models. It also aims to explore the role that other actors can play in the enforcement of the AI Act.

Coming up in this post:

• Summary
• Introduction
• Substantive obligations of GPAI model providers
• Procedural obligations of GPAI model providers
• When are GPAI model providers within the scope of the Act? 
• Supervision and enforcement powers of the Commission
• Routes to enforcement

Introduction

On 2 August 2026, the Commission’s enforcement powers in respect of GPAI model providers will come into force. While the obligations of GPAI model providers, included in Chapter V of the AI Act, came into force on 2 August 2025, the providers are given an adjustment period of one year before the Commission may start exercising its supervision and enforcement powers against them. Providers of GPAI models released before 2 August 2025 must be compliant before 2 August 2027. 

See here for a complete implementation timeline of the EU AI Act

The Commission has exclusive powers to supervise and enforce obligations under Chapter V of the AI Act pursuant to Article 88 AI Act. These powers are complemented by Article 89(1) of the Act, under which the AI Office is also tasked with monitoring GPAI model providers’ compliance with the Act and, where relevant, their adherence to the approved codes of practice. 

Substantive obligations of GPAI model providers

The substantive obligations that the Commission will be responsible for enforcing are included chiefly in Articles 53 and 55 of the Act, namely the obligations to write and keep up-to-date the technical documentation relating to the model, to write, keep up-to-date and provide information and documentation to downstream providers of AI systems, to adopt a policy to comply with EU copyright law, and to write and publish a summary about the content used for training of the model. 

Providers of GPAI models released under a free and open-source licence are only required to comply with the copyright policy and training content summary obligations, unless the GPAI model presents a systemic risk (GPAISR). In addition, providers of GPAISR models must also perform model evaluations, conduct risk assessment and mitigation, record and report serious incidents, and ensure a sufficient level of cybersecurity of the model.

Procedural obligations of GPAI model providers

Perhaps less obviously, the AI Act also imposes several obligations on GPAI model providers that can be described as being procedural in nature. GPAI model providers are under a broad obligation to cooperate with the Commission and national authorities in the exercise of their AI Act powers (Article 53(3)). More specifically, GPAI model providers are under an obligation to respond to a Commission’s request for documentation and information and to avoid providing “incorrect, incomplete or misleading information” (Article 91(4)-(5)). GPAI model providers are also under an obligation to provide access to the GPAI model where requested to do so by the Commission (Article 92(4)-(5)).

Some of these rather procedural obligations relate only to some types of GPAI model providers. For instance, providers established in third countries are under an obligation to appoint an authorized representative in the Union prior to placing their GPAI model on the EU market, unless the model is released under a free and open-source licence (Article 54). The written mandate given by the provider to the authorized representative must meet a set of requirements listed in Article 54(3). 

Similarly, providers of GPAI models with high impact capabilities (which a GPAI model is presumed to have if the cumulative training compute of the model exceeds 10(^25) FLOP), are under an obligation to notify the Commission “without delay and in any event within two weeks after that requirement is met or it becomes known that it will be met”, with the necessary information attached (Articles 51(2) and 52(1)).

When are GPAI model providers within the scope of the Act? 

In order for a GPAI model provider to be subject to the obligations listed above and for those obligations being enforced against them, they must be within the scope of the AI Act. 

Importantly, GPAI model providers are only within the scope of the Act where they place their GPAI model on the Union market, irrespective of where they are based (Article 2(1)(a)). That includes both placing a standalone GPAI model on the Union market, as well as a situation in which the provider integrates its GPAI model into its own AI system and places that AI system on the Union market or puts it into service in the Union, as per Recital 97. 

The same logic could also potentially apply to providers of GPAI models that only place their model on the market in third countries, where it is integrated into an AI system by a downstream provider and then the AI system is placed on the EU market. This approach is especially convincing in light of Recital 97, which states that Chapter V “should apply also when these models are integrated or form part of an AI system”. While this interpretation is supported by Recital 97, it remains to be confirmed in practice.

Supervision and enforcement powers of the Commission

Supervision and non-fining enforcement powers

Moving on to the supervision and enforcement powers of the Commission, the powers that the Commission has in respect of GPAI model providers consist of the power to request documentation and information (Article 91), the power to conduct evaluations (Article 92) and the power to request measures (Article 93). 

Under Article 91, the Commission may request the documentation drawn up pursuant to Articles 53 and 55, or any other necessary information. Similarly, it may request information on behalf of the scientific panel, where necessary and proportionate.

Under Article 92, the Commission may conduct evaluations of GPAI models with a view of either determining compliance (both of GPAI and GPAISR model providers) with the Act, where the information provided by them was insufficient, or with a view of investigating systemic risks posed by GPAISR models. Independent experts, including those from the scientific panel, may conduct evaluations on behalf of the Commission, if the Commission so decides.

Lastly, under Article 93, the Commission may request providers to “take appropriate measures to comply” with their obligations. It also grants the Commission the power to request providers to put in place mitigation measures, where, following an evaluation, there is a “serious and substantiated concern of a systemic risk at Union level”. Finally, the Commission may request providers to “restrict the making available on the market, withdraw or recall the model”.

Fining powers

While Articles 91–93 of the Act confer supervision and non-fining enforcement powers on the Commission, Article 101 provides for the Commission’s power to impose fines.

Fines against whom?

Article 101 empowers the Commission to impose fines on GPAI model providers. Unlike Article 99, which provides for fines to be imposed on operators of AI systems by national MSAs, Article 101 does not expressly refer to the possibility for the imposition of a fine on the provider’s authorized representative. Instead, the wording of Article 101(1) suggests that the Commission may only impose fines on GPAI model providers.

Yet, it could be argued that Article 101 should be interpreted in light of Article 54(4) which states that the authorized representative’s mandate shall empower them “to be addressed, in addition to or instead of the provider, by the AI Office or the competent authorities, on all issues related to ensuring compliance with this Regulation”. Since the imposition of a fine could be regarded as ensuring compliance with the Act, the imposition of fines would not, on this view, be limited to GPAI model providers.

How high?

The maximum level of the fines that may be imposed on GPAI model providers is “3 % of their annual total worldwide turnover in the preceding financial year or EUR 15 000 000, whichever is higher”.

Based on what infringements? 

There are four legal bases for the imposition of a fine under Article 101(1): 

1. infringing the relevant provisions of the AI Act; 
2. not complying with a documentation/information request or supplying deficient information under Article 91; 
3. not complying with a measure requested pursuant to Article 93; and 
4. not providing the Commission with access to the GPAI or GPAISR model in order to carry out an evaluation under Article 92. 

Two of these grounds clearly match the two obligations of procedural nature imposed on GPAI model providers by virtue of Articles 91 and 92 and mentioned earlier in this text. While complying with the request for a measure is not an expressly laid down obligation under Article 93 in the same way the aforementioned obligations under Articles 91 and 92 are, it can still be mapped onto the broader obligation to cooperate with the Commission, specified under Article 53(3).

Yet, this broader obligation of cooperation is likely not limited to the obligation to comply with the Commission’s request for measures. Furthermore, some GPAI model providers are subject to other, non-cooperation related, obligations of procedural nature, such as appointing an authorized representative or notifying the Commission of their GPAI model’s high impact capabilities, as further described earlier in this text. For these reasons, it is highly plausible that the first legal basis for the imposition of a fine, namely where the GPAI model provider infringes “the relevant provisions” of the Act, is not limited to the substantive obligations included in Articles 53 and 55. Instead, it likely also extends to, where applicable, the obligations of procedural nature mentioned in Articles 52, 53(3), and 54.

Routes to enforcement

While the Commission alone is entrusted with the supervision and enforcement of GPAI model obligations under Chapter V of the AI Act, several other actors may also contribute to its enforcement.

Starting with the Commission, the AI Office is tasked with the monitoring of GPAI model providers’ compliance with the Act pursuant to Article 89(1). This includes monitoring the providers’ adherence to approved codes of practice, which constitute a voluntary tool enabling providers to demonstrate compliance with the Act. While codes of practice do not provide a presumption of conformity, the Commission has, in its Guidelines for providers of general-purpose AI models, expressed that “[f]or providers of general-purpose AI models that adhere to a code of practice that is assessed as adequate, the Commission will focus its enforcement activities on monitoring their adherence to the code of practice”. Those providers will also “benefit from increased trust from the Commission and other stakeholders”. 

Given the Commission’s admitted limited scope of the monitoring of and increased trust towards providers that have signed up to the GPAI Code of Practice, effective from 2 August 2025, other actors’ role in the enforcement of the AI Act may prove to be important. The actors that may bring attention to non-compliance and therefore contribute to the enforcement of the Act include national MSAs, downstream providers, and the scientific panel.

Market surveillance authorities

Turning to MSAs, where an MSA is unable to finalize investigation of a high-risk AI system built on a GPAI model because of lack of information pertaining to the underlying GPAI model, the AI Office shall provide that information to the MSA (Article 75(3)). Furthermore, and even more importantly, MSAs may request the Commission to exercise its powers under Articles 91–93 of the Act “where that is necessary and proportionate to assist with the fulfilment of their tasks” under the Act (Article 88(2)). 

Therefore, MSAs can be powerful actors in gaining information about, bringing attention to and requesting action in regard to non-compliance of providers of GPAI models underlying the AI systems that are within the MSAs’ regulatory remit. This mechanism could be particularly significant when combined with the right of a natural or legal person to lodge a complaint with the relevant MSA, where they have reasons to suspect an infringement of the Act (Article 85). The provision adds that “such complaints shall be taken into account for the purpose of conducting market surveillance activities”.

Importantly, Article 85 does not specify that the infringements that are subject to the complaint must relate to infringements at the AI system level. While the reference to the “relevant market surveillance authority” may suggest that the complaint should be limited to the AI systems over which the particular MSA has oversight, it could also be interpreted as referring to the MSA in the member state where the natural or legal person that lodged the complaint is based. This latter interpretation would enable a natural or a legal person to submit a complaint relating to suspected GPAI models’ infringements of the AI Act.

While this interpretation remains to be confirmed in practice, the obligation on part of MSAs to take the complaint into account for the purpose of conducting their activities, which includes their powers to request the Commission to exercise its supervision and enforcement powers under Articles 91–93, could render this combination a powerful tool for individuals to ensure the enforcement of the AI Act against GPAI model providers.

Downstream providers

It is worth mentioning that downstream providers are also granted the right to submit a complaint concerning a suspected infringement of the Act (Article 89(2)). A downstream provider is “a provider of an AI system, including a general-purpose AI system, which integrates an AI model” (Article 3(68)). 

Downstream providers are in possession of the technical documentation drawn up by the GPAI model provider pursuant to Article 53(1)(b) and they are more familiar with the functioning of the underlying model than an average individual. For these reasons, downstream providers are in a unique position to contribute to the enforcement of the AI Act against GPAI model providers if they decide to submit a complaint as a result of which the AI Office decides to exercise its enforcement powers.

The scientific panel

Lastly, the scientific panel plays an important role in ensuring the proper enforcement of the Act. It may issue a qualified alert to the AI Office in case of a suspicion of a GPAI model posing concrete identifiable risk at the EU level or where a GPAI model constitutes a GPAISR model (Article 90). Pursuant to Article 18(1) of the Commission’s implementing act on the scientific panel, the issuance of a qualified alert requires at least a simple majority of the scientific panel’s members. 

The Commission may, based on this alert, exercise its powers under Articles 91–93 AI Act. While not mentioned directly, the Commission may also exercise its fining powers under Article 101 AI Act in such cases, as Article 101 confers a free-standing power to impose a fine based on an infringement of GPAI model obligations. This reasonably includes the infringements that the Commission is alerted to by the scientific panel.

After receiving the qualified alert, the AI Office must decide on whether to exercise its powers under Articles 91–93 AI Act within two weeks, as per Article 19(2) of the implementing act. This provision for a swift procedure renders the mechanism of qualified alerts particularly useful in the AI Act’s enforcement schema.