By Sagar Shankaran, Founder of CallSphere
The August 2026 EU AI Act deadlines are real. The technical files, transparency reports, and incident docs GPAI providers actually have to ship.
Key takeaways
The EU AI Act entered into force in August 2024 with staged effective dates. By April 2026 most teams have absorbed the prohibited-practices and transparency provisions. The next big milestone is August 2, 2026 — when the General-Purpose AI (GPAI) provider obligations apply to models placed on the EU market.
This piece walks through what GPAI providers actually have to file, with practical detail rather than treaty-language summaries.
flowchart TD
Q1{Develops a general-purpose<br/>AI model?} -->|Yes| Q2
Q1 -->|No| Skip[Article 50 transparency<br/>still applies]
Q2{Places it on the EU<br/>market or puts into service?} -->|Yes| GPAI[GPAI provider obligations]
Q2 -->|No| OutOfScope[Out of scope]
A "general-purpose AI model" is one that can be applied to a wide range of distinct tasks. Foundation models, frontier LLMs, and large open-weights releases are all in scope. Smaller fine-tunes are also in scope if they substantially modify the base.
If you fine-tune an existing GPAI for a narrow use case, you are typically a downstream deployer, not a GPAI provider. Important distinction — different obligations apply.
Per Article 53 + Annex XI, providers must maintain technical documentation on:
Hear it before you finish reading
Talk to a live CallSphere AI voice agent in your browser — 60 seconds, no signup.
The training-data summary is the lightning rod. The template asks for a "sufficiently detailed summary" of training data sources. Frontier providers have published high-level summaries; the EU AI Office is expected to publish stricter guidance through 2026.
Providers must give downstream users enough information to comply with the Act themselves. In practice this means:
Providers must publicly summarize training data and have a copyright-compliance policy. The Commission's template walks through how to do this without revealing trade secrets.
Open-source models with publicly disclosed weights, architecture, and training info get exemptions from some obligations — except if they are systemic-risk models.
flowchart TD
Train[Training compute] --> Check{>= 10^25 FLOPs?}
Check -->|Yes| Sys[Systemic-risk presumption]
Check -->|No| Reg[Regular GPAI obligations]
Sys --> Notify[Must notify Commission]
Sys --> Extra[Adversarial testing,<br/>incident reporting,<br/>cybersecurity safeguards]
Models trained with >= 10^25 FLOPs are presumed to have systemic risk. They get extra obligations:
The 10^25 FLOP threshold is rough. By 2026 most frontier models from OpenAI, Anthropic, Google, Meta, and the strongest Chinese open-weights are above it.
Still reading? Stop comparing — try CallSphere live.
CallSphere ships complete AI voice agents per industry — 14 tools for healthcare, 10 agents for real estate, 4 specialists for salons. See how it actually handles a call before you book a demo.
There is no public filing for GPAI obligations — the documents are kept by the provider and shown to the AI Office on request. But the AI Office has signaled it will request documentation upon perceived non-compliance, and the Code of Practice that 200+ companies signed in 2025 included voluntary public disclosure.
The voluntary GPAI Code of Practice signed in 2025 is the de facto compliance standard. Signatories include OpenAI, Anthropic, Google, Microsoft, Mistral, and many others. Notably absent: some open-source-focused providers and some Chinese providers.
Following the Code of Practice is the lowest-friction path to demonstrating compliance. The Code is a few hundred pages of prescriptive guidance on technical docs, transparency, and risk management.
For teams shipping a GPAI in the EU in 2026:
Most teams have stood this up over Q1-Q2 2026 to be ready for August.
If you fine-tune a GPAI for a narrow use case, you are a deployer. Your obligations are different:
Written by
Sagar Shankaran· Founder, CallSphere
LinkedInSagar Shankaran is the founder of CallSphere, where he builds production AI voice and chat agents deployed across healthcare, hospitality, real estate, and home services. He writes about agentic AI, LLM engineering, and shipping voice agents that handle real calls in production.
See how AI voice agents work for your industry. Live demo available -- no signup required.
Using GPT-Realtime-2 for healthcare voice agents. BAA scope, PHI handling, retention, logging, and why a managed platform usually wins this build.
AI Control Tower is the governance layer for ServiceNow's Project Arc — policy, monitoring, and audit logs for autonomous agents. Here is how it works.
The 2024 NPRM proposes mandatory penetration tests every 12 months and vulnerability scans every 6 months. Here is how an AI voice agent should be tested in 2026.
CAISI announced new agreements with Google DeepMind, Microsoft, and xAI in May 2026. What gets tested, what changes for enterprise AI buyers, what to watch.
Six-domain AI vendor diligence: financial, security, privacy, operational, legal, ethics. Plus 30+ specific questions, SOC 2 / ISO 27001 baselines, and review cadence.
A fair audit of Anthropic's Responsible Scaling Policy, its AI Safety Levels, who actually audits compliance, and whether it has ever delayed a release.
© 2026 CallSphere Inc. All rights reserved.
Made within San Francisco
Watch how CallSphere handles real customer calls, schedules appointments, and processes payments — live.
Try Live DemoBook a DemoCalculate Your ROI