# The EU Artificial Intelligence Act makes provider records enforceable [Journal](/journal/) July 21, 2026 · [evidence](/journal/#evidence) The August 2026 milestone gives the Commission consequences for missing, misleading, or inaccessible general-purpose model records. ![A technical archive routes one stack of model records through a verdigris line into a precision inspection frame.](/_astro/eu-ai-act-enforcement-records.DFcirk3z_2ik5ic.webp) General-purpose model providers need records that can survive a Commission request, not a compliance narrative assembled after one arrives. The EU Artificial Intelligence Act already set the duties. On [August 2, 2026, its provider fine provision starts to apply](https://eur-lex.europa.eu/eli/reg/2024/1689/oj), giving missing, misleading, or inaccessible evidence a defined financial consequence. ## Three dates govern different events The timeline is easy to flatten and costly to misread. [Chapter V, which contains the duties for general-purpose model providers, applied from August 2, 2025, except for Article 101](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). [Article 101 applies from August 2, 2026](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). That is the enforcement milestone, not the date when every provider first acquires its documentation duties. There is a separate transition for older models. [A provider whose general-purpose model was already on the market before August 2, 2025 has until August 2, 2027 to take the necessary compliance steps](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). That rule follows the model’s market date. It does not give every provider the same extra year. ## A request can reach the working record [Article 91 lets the Commission request the documentation required by Articles 53 and 55, plus additional information necessary to assess a provider’s compliance](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). In plain language, the authority can ask for the evidence behind the provider’s claims, not merely a polished summary. [Its request must identify the legal basis and purpose, specify the information, set a response period, and warn of the fine exposure for incorrect, incomplete, or misleading information](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). For a general-purpose model, [Article 53 makes the core record concrete](https://eur-lex.europa.eu/eli/reg/2024/1689/oj): - [current technical documentation covering training, testing, and evaluation results](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) - [current information for providers that intend to integrate the model into their systems, including its capabilities and limits](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) - [a policy for compliance with Union copyright law](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) - [a public summary of the content used to train the model](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) [The first two duties have a limited exception for a non-systemic model released under a qualifying free licence with public parameters and model information](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). [The copyright policy and training-content summary remain required under Article 53](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). Providers of general-purpose models with systemic risk carry an additional record burden. In this Regulation, [systemic risk means a risk specific to the high-impact capabilities of general-purpose models that has a significant effect on the Union market because of its reach or actual or reasonably foreseeable negative effects](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). [Article 55 requires documented model evaluations and adversarial testing, assessment and mitigation of systemic risks, records and reports of serious incidents and corrective measures, and adequate cybersecurity protection](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). ## Evaluation can go beyond the document set If the requested information is insufficient, [Article 92 allows the Office for Artificial Intelligence, after consulting the European Artificial Intelligence Board, to evaluate the model for compliance](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). [It may also investigate Union level systemic risk for a model classified as presenting systemic risk](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). [The Commission can request access through an API or another suitable technical route, including source code, and may appoint independent experts to conduct the evaluation](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). [Article 93 lets the Commission require appropriate compliance steps, mitigation of a serious and substantiated systemic risk, or restriction, withdrawal, or recall of a model](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). These are powers over the provider of the model concerned. [The Regulation defines a provider by its development and market role, separately from a deployer that uses a system under its authority](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). An organization does not become the provider that owes these model records by virtue of use alone. ## The maximum fine now has a live date From the [August 2, 2026 application date](https://eur-lex.europa.eu/eli/reg/2024/1689/oj), [Article 101 permits a maximum fine of 3% of the provider’s annual worldwide turnover in the preceding financial year or EUR 15 million, whichever is higher](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). [The provision covers intentional or negligent infringement, failure to answer an Article 91 request or supplying incorrect, incomplete, or misleading information, failure to comply with an Article 93 measure, and failure to provide model access for an Article 92 evaluation](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). [The Commission must consider the infringement’s nature, gravity, and duration when setting the amount](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). The operational test is therefore retrieval under pressure. A provider should be able to produce the current model record, show how it changed, identify who approved it, and connect each compliance assertion to training, testing, incident, and mitigation evidence. A folder of declarations without those links may be documentation in the everyday sense. It is a weak answer to an evaluation request. This analysis relies on the public Regulation. The European Union institutions named in it are neither Muniment customers nor endorsers. ## Sources 1. [EUR-Lex — Regulation (EU) 2024/1689: Artificial Intelligence Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) eur-lex.europa.eu ## Continue reading [All publications](/journal/) evidence · Jul 21, 2026 ### [The operating layer is becoming an owned asset](/journal/the-operating-layer-is-becoming-an-owned-asset/)