Europe’s first GPAI enforcement wave is quieter than the hearings — and more expensive
The AI Act’s general-purpose model duties are no longer a slide. Providers are getting letters. The argument is about what counts as a model, and who counts as a provider.
Brussels did not hold a victory lap this week. It sent mail. Several providers of general-purpose AI models received formal information requests and, in at least two cases, preliminary findings that their transparency and copyright summaries do not meet the AI Act’s GPAI obligations.
That is not a fine. It is how fines start.
The first enforcement wave is a definition fight: what is a model, what is a system, and who is allowed to shrug.
The duties that actually landed
For GPAI providers, the glamorous parts of the Act were never the point. The point is paperwork that can be checked: technical documentation, a copyright policy that is not a blog post, and a summary of training content that is more than “the internet.” Downstream deployers want to know who sits above them in the stack when a national authority asks an ugly question.
Labs that treated the Code of Practice as optional branding are discovering that national market surveillance authorities are using it as a rubric anyway. Harmonized or not, a rubric is a rubric.
Open weights do not end the story
A few companies have argued, quietly and then less quietly, that releasing weights transfers the provider role to whoever downloads the files. That argument is going to get tested. The Act was not written to make a torrent the end of accountability. If you put a frontier-class model into the world, Europe’s working theory is that you still owe the public a file.
That will be litigated. It should be. It should not be litigated only in conference hallways.
The expensive part is not the lawyer
The expensive part is the inventory. Most labs do not have a clean account of what they trained on, what they licensed, and which third-party datasets were “public” in the sense a court will accept. Building that account after the fact is how you discover your data pipeline was a graveyard of good intentions.
U.S. firms that assumed Europe would blink are now staffing Dublin and Luxembourg as if the letters were real. They are real. The next ones will have numbers on them.