August 2, 2026 marked a before-and-after in Brussels: not because general-purpose AI (GPAI) obligations were born from scratch—they had applied substantively since August 2025—but because the Commission, through the AI Office, gained full investigation and sanction powers. Firms such as Wilson Sonsini, Taylor Wessing and Morgan Lewis converged in August–September explainers: the “paper compliance” phase ended; formal information requests began.
The powers menu is broad. The AI Office can demand documents and information, request API or even source-code access for evaluations (Art. 92), require compliance with Arts. 53 and 54, open structured dialogues and make commitments binding. Where serious systemic-risk concerns arise, it can impose mitigations or restrict, withdraw or recall a model. Article 101 fines reach the higher of €15 million or 3% of worldwide annual turnover.
Commission Implementing Regulation (EU) 2026/1755, in force since August 10, 2026, added procedural detail: opening of proceedings, interim measures and a five-year limitation period for fines. In practice, any AI Office letter should be treated as a formal regulatory matter—with EU counsel—not a product-support ticket.
In parallel, Article 50 transparency began applying on August 2, 2026: disclose when users interact with AI (unless obvious), mark synthetic content in machine-readable format, and reveal certain emotion-recognition, biometric-categorisation and deepfake uses. The Digital Omnibus/AI Omnibus granted a limited transition: synthetic-generation systems placed on the market before August 2 have until December 2, 2026 for machine-readable marking; the rest of Article 50 is not deferred.
For U.S. providers without an EU establishment, September explainers spell out the territorial hook: if they place the model on the EU market or its outputs are used there, they can be covered. They generally must appoint an EU authorized representative before placing covered GPAI models. Skipping the representative is not a clever shortcut; it is an enforcement flank.
The practical checklist repeated by law firms includes: role inventory (provider vs deployer); Article 53 technical documentation; an EU copyright-compliance policy; a sufficiently detailed training-content summary; evaluation and mitigation if systemic risk applies; cybersecurity and incident reporting; and—increasingly cited after the agentic debate—logging of relevant intermediate events, not only final responses.
Neural Pulse avoids conflating this angle with prior pieces on U.S. Senate bills. The focus here is European reality after August 2: active powers, synthetic-marking deadlines, and everyday friction for U.S. labs selling APIs in Europe. The GPAI Code of Practice remains a voluntary soft-compliance tool, not an absolute shield against fines.
Models placed on the market before August 2, 2025 generally enjoy a transition until August 2, 2027 for substantive GPAI duties; later models were already expected to comply. That duality creates “grandfather” and “grandchild” regulatory queues inside one provider’s catalog—a product-management headache as much as a legal one.
Deployer-only companies do not escape Article 50: they must disclose AI interactions and certain biometric/emotion uses. Provider/deployer confusion in SaaS chains with embedded models will predictably be an early field of interpretive litigation.
As of September 15, 2026, nobody needs to wait for the first splashy fine to act. Explainers already translate the regulation into tasks: appoint a representative, close training summaries, label deepfakes, and prepare playbooks for AI Office requests. Anyone waiting for the sanction headline has already lost months of runway.
The link to Muse Spark and other frontier models is direct: opening or closing weights interacts with Article 53, but systemic risk does not vanish under an MIT license. Brussels designed the system precisely to catch the high-capability tail, not only who forgets a watermark.
Editorial close: the AI Act is no longer a future PDF. It is a regime with a phone number, a case file and a fine. For U.S. GPAI providers, September 2026 is a month for operational compliance—or blind faith that the AI Office will look elsewhere. The second option is not a strategy.
The GPAI Code of Practice remains the “friendly” path to show good faith, but Taylor Wessing and others warn it does not immunize against Arts. 88–94 or interim measures under the implementing regulation. Treating the code as a plenary indulgence repeats the mistake of confusing ISO certificates with real agentic security.
A reasonable 90-day plan for a U.S. lab would include: appoint an EU representative; map pre/post August 2025 models; publish or prepare a training summary; inventory Article 50 systems; implement synthetic marking with the December 2 deadline; and run a tabletop response to an AI Office request—including who can authorize model access under Art. 92.
