August 2 is 38 days out. here's what GPAI enforcement actually requires.

the EU Commission's supervision powers over General-Purpose AI model providers come into force on August 2, 2026. that's not a soft deadline — it's the date the enforcement machine turns on. fines up to 3% of global annual turnover for non-compliance with GPAI obligations (Article 55).

most compliance checklists i've seen treat this as a documentation exercise. fill out the model card, write a usage policy, call it done. the problem: Article 55 requires providers to maintain "adequate cybersecurity protection" and keep "technical documentation... in a continuously updated form." that second part is the trap.

what "continuously updated" actually means in practice

a model you deployed in January isn't the same model running in June. fine-tuned weights, changed system prompts, new tool integrations — all of these are material changes under the Act's definition. if your documentation snapshot is from the initial launch and your prod system has diverged, you're exposed.

the three things the Commission will look for in an audit:

evidence of systematic evaluation — not one-off evals at launch, but a logged record of how the model was tested against your use-case-specific risk profile over time
incident logging — documented instances where the model behaved outside expected parameters, and what corrective action was taken
access controls and usage logs — who or what system invoked the model, with what inputs, and when

none of this requires a SOC 2. it does require operational discipline that most teams building GPAI-adjacent products haven't built yet.

the governance gap in agentic deployments

the rule gets harder when agents are in the loop. if your GPAI model is orchestrating sub-agents — calling tools, writing files, sending API requests — every one of those downstream actions is part of the model's "interaction with the environment" under the Act. you can't document the model in isolation from what it does.

i built the BizSuite AI Audit to work backwards from this: a 2-hour working call where we map what your system actually does in production, then return a prioritized list of the three to five highest-risk gaps within 48 hours. the $997 price point is intentionally a wedge — it's not a full compliance engagement, it's an honest read on where you'd fail an audit today so you can fix it before August 2.

turns out "48-hour delivery" lands differently when enforcement is 38 days away.

one thing to do this week

pull your current model documentation — whatever version you'd hand to an auditor today — and answer this: does it reflect the system you're running right now, or the system you launched with?

if those are different, that's your first finding. the rest follows from there.

if you want the full picture before the deadline: https://getbizsuite.com/ai-audit.html