EU AI Act: GPAI Enforcement Powers in Force August 2, 2026 — What Changed for Turkish Companies?

TL;DR — As of August 2, 2026, the European Commission has begun actively exercising its enforcement powers over providers of general-purpose AI (GPAI) models. Powers to request information, demand model access, and force recalls are now on the table; under Article 101, fines can reach EUR 15 million or 3% of global turnover. In this piece I explain what the timeline actually means, give a clear answer to the question "GPAI obligations already started in August 2025 — so what changed today?", and lay out, from field experience, what companies serving the EU market from Turkey should practically do.

Let me start with the two concepts most often confused in practice: "obligation" and "enforcement power." They are not the same thing, and understanding the difference is essential to reading today's news correctly.

The substantive obligations of GPAI providers — maintaining technical documentation, publishing a copyright policy, disclosing a training-data summary, and providing information to downstream developers — already took legal effect under Articles 51 to 56 of the AI Act on August 2, 2025. In other words, these duties have been legally binding for a year. When I sat down with a client last autumn and said "these are mandatory now, let's start preparing even if only on paper," those were precisely the articles I meant.

What changed today, on August 2, 2026, is not the obligation itself but the Commission's capacity to enforce it. The one-year transition window closed, and the European AI Office can now step onto the field with a genuine enforcement toolkit. Think of it this way: the rule has hung on the wall for a year, but the inspector held no penalty book. Now the book is in hand too.

I stress this distinction because many organizations acted under the illusion of "we have until August." The obligation existed all along; what arrived today is that non-compliance has become behavior with a price tag.

I group the powers the European AI Office can use against GPAI providers under three headings, because this triad works well when I explain it to organizations.

First, the power to request information. The Office can make a formal request for information from a provider about how the model was trained, what data was used, and how systemic risks were assessed. This is not the courtesy of "share if you like"; it is an obligation that must be answered.

Second, the power to access the model. The Office can, where necessary, request access to the model for evaluation purposes. The route to commissioning independent evaluation for models carrying systemic risk is an extension of this power. A provider refusing access is itself grounds for a non-compliance finding.

Third, the power of corrective measures and recall. The Office can demand corrections for a model it finds non-compliant and, where necessary, require the model to be withdrawn from the market or recalled. This is the heaviest tool, and in practice it means commercial catastrophe for a provider.

Taken together, the picture becomes clear: the Commission is no longer merely an actor that "sets rules" but one that "enforces rules." And in my experience, regulators' first enforcement waves always begin with symbolically charged cases that everyone is watching.

The figures are designed to deter. For GPAI-specific breaches, under Article 101, fines can reach EUR 15 million or 3% of global annual turnover (whichever is higher). For broader AI Act breaches — such as prohibited practices — Article 99 is far heavier: EUR 35 million or 7% of turnover.

When I compare these ratios with GDPR, my clients' eyes open. GDPR's ceiling was EUR 20 million or 4% of turnover, and even that created serious discipline in the market. The AI Act's 7% ceiling shows how firm the message is: Europe has moved AI compliance out of the "nice to have" category and turned it into balance-sheet risk.

I should honestly add one point: compliance with the Code of Practice does not grant immunity from fines. Even if a provider signs the voluntary code, a fine can be imposed for a concrete breach. However, adherence to the code can be considered a tool in mitigating sanctions. The practical translation: good faith and transparency will not zero out a fine, but they can lower its tone.

I hear this question in nearly every workshop, and my answer is always the same: the AI Act is market-based, not geography-based. If your model, system, or output is used in the EU market, having your headquarters in Istanbul, Ankara, or Izmir does not put you out of scope.

Let me make it concrete. From Turkey, it directly or indirectly affects companies with these profiles:

• Software companies selling AI-based SaaS products to EU customers.
• Teams that train their own open-weight model and publish it in the EU or offer it to EU developers.
• Manufacturers exporting products to the EU market with an embedded AI component inside those products.
• Integrators in a "downstream provider" position who use an EU GPAI provider's model and add their own layer on top.

That last group matters especially. As a downstream developer, you depend on the documentation of the model you receive from above; but in your own use context, transparency and documentation duties arise for you too. So "I just call an API" does not throw you out of the chain.

Another layer sharpening from August 2, 2026 is transparency. For actors operating chatbots or publishing AI-generated content (text, image, audio, video), the duty to inform users comes to the fore. A user must know they are talking to a machine; AI-generated content must be appropriately labeled.

This carries extra meaning in the Turkish context. Because on the KVKK side too, a bill targeting the sharing of AI-generated audio, text, and images without the data subject's consent was submitted to Parliament in early 2026. The fact that both legal tracks — the EU's transparency mandate and Turkey's deepfake/consent-focused regulation — face the same direction makes "labeling and consent" a standard practice for companies operating in both markets.

The regulation splits GPAI models into two: ordinary GPAI models and those carrying "systemic risk." The systemic-risk threshold is determined by criteria such as the compute used in training, and models crossing this threshold trigger additional duties: advanced model evaluations, adversarial testing (red-teaming), systemic risk mitigation, serious-incident reporting, and cybersecurity protections.

Most companies in Turkey are not playing in this league — the number of teams training frontier models from scratch is limited. But there are many who use these models. So my practical advice is: know the systemic-risk status of the upstream model you use. Because that status defines the scope of documentation and guarantees flowing to you.

Leaving theory aside, let me share the steps I follow with organizations once we sit down at the table. This does not replace legal counsel, but it gives the skeleton of technical and organizational preparation.

1. Build an inventory. Which AI systems do you use, which are your own development, which are third-party? For each, answer "in this system are we a provider, a distributor, or a downstream developer?" Your role determines your obligation.

2. Do a risk classification. The regulation is risk-based: prohibited, high-risk, limited-risk, minimal-risk. Place your systems in this pyramid. If you have a use falling into the high-risk category (e.g., hiring, credit scoring, biometric recognition), the intensity of obligations rises sharply.

3. Set up a documentation line. Model cards, data-source records, evaluation results, limitations, and known risks. When the inspector knocks, "we'll compile it within three months" won't work; the file must be ready.

4. Embed transparency mechanisms. A "you're talking to AI" notice on chatbots; appropriate labeling on generated content; a channel for user objection and human oversight.

5. Define human-oversight points. Especially in high-impact decisions, keeping final approval with a human. This principle is common ground both on the EU side and in Turkey's financial-regulation debates.

6. Review supplier contracts. What documentation and guarantees do you receive from your upstream provider? Is the sharing of compliance responsibility clear in the contract?

7. Set up continuous monitoring. Compliance is not a one-off project but a living process. When the model is updated or the use context changes, documentation must be updated too.

For those who want to put these seven steps into a table, I suggest a simple maturity framework:

Level	State	Typical indicator
0 – Unaware	Unaware of being in scope	No inventory
1 – Aware	Knows the scope, no action	Role unclear
2 – Preparing	Inventory + risk classification started	Partial documentation
3 – Compliant	Documentation + transparency + human oversight in place	Audit-ready
4 – Mature	Continuous monitoring + supply-chain management	Automated evidence generation

In my experience, most EU-facing companies in Turkey are today between 1 and 2. Today's news created the urgency needed to move them to 3.

As someone who has watched regulatory behavior for years, let me share a prediction — not a certainty, but a pattern reading. The first sanctions will most likely concentrate on three profiles: providers who fail to answer information requests, those who openly refuse model access, and uses falling into the prohibited-practice category. In other words, the first targets will be "those who don't care at all," not "those who tried in good faith but left gaps."

This is actually good news for Turkish companies. Because visible preparation, documentation discipline, and transparency practice remove you from the target profile of the first wave. In the inspector's eyes there is a big difference between "trying but incomplete" and "not caring at all," and that difference determines both whether a fine happens and its tone.

In the Turkish case specifically, managing the two legal tracks separately would be a big mistake. KVKK's generative-AI guidance and the EU's transparency and documentation duties actually exercise the same discipline muscles: data inventory, clarity of processing purpose, consent management, explainability, and record-keeping. Once you build a solid governance skeleton, that skeleton serves both regimes.

I always tell organizations: if you treat compliance as two separate projects, you'll pay double for half the yield. If you build a single "AI governance" program and place both KVKK and EU AI Act requirements under it, the same documentation and processes serve you twice. An AI management-system standard such as ISO/IEC 42001 is a practical way to build this shared skeleton.

Read today's news as an action trigger. Over the next three months I recommend concretely: inventory all AI systems touching the EU market and clarify your role for each; flag and prioritize uses in the high-risk or systemic-risk category; identify missing documentation and set a closure schedule; place transparency notices on all your chatbot and generated-content channels; and put the compliance responsibility in contracts with your upstream model providers into writing.

These steps may sound heavy, but they are manageable once broken into parts. And remember: this is not a "do it once, done" job. As the model is updated, as usage broadens, as regulation matures, this cycle will repeat. A company laying a solid foundation today will breathe far easier with every new requirement next year. The early mover's advantage is always cheaper than the latecomer's scramble.

The most neglected thing — and the most useful in an audit — is documentation. A good file I see in the field contains: a plain-language definition of what the model does and does not do; the source and nature of training or configuration data; known limitations and failure modes; evaluation metrics and test results; the intended use context and misuse scenarios; and how human oversight and objection mechanisms work.

Preparing this file "for the inspector" is the wrong motivation. Prepare it for your own team; because a well-documented system is also better understood, more easily maintained, and does not suffer knowledge loss during handovers. A compliance document is cheapest and most durable when it is a byproduct of good engineering hygiene. An experienced eye immediately sees the difference between a file compiled in panic when the inspector knocks and living documentation that is a natural part of operations.

Let me stress one strategic point: EU regulations historically tend to spread far beyond their borders. In the literature this is called the "Brussels effect." We lived it with GDPR; companies around the world rebuilt all their data-processing practices around GDPR just to serve a single EU market, because hitting one global standard is cheaper than building a separate system per market.

I expect the same dynamic for the AI Act. A global model provider or AI product vendor will prefer to raise the bar to EU level and offer the same product everywhere, rather than running two product lines. That means, in practice, EU rules shaping even companies with no EU customers, indirectly. For Turkish companies this means that even saying "I don't sell to the EU" will offer less and less protection; because the tools you use, the platforms you integrate with, and the enterprise customers you work with will start demanding the EU standard from you too.

If I reduce today's news to one sentence: AI compliance is no longer a theoretical debate but an enforceable obligation. And enforceable obligations change organizational behavior far faster than theory. As we see the first enforcement cases in the coming months, I expect the market's sense of urgency to sharpen.

In this environment, the winner will not be the one who panics most, but the one who moves earliest and most methodically. A team that has built its inventory, clarified its role, tied documentation to a living process, and embedded transparency and human oversight into its product both lowers its audit risk and turns that into a sales argument. Because enterprise buyers increasingly ask "how is your AI governance?", and a supplier who can answer that clearly starts a step ahead in closing the deal. The company that builds compliance not as a burden but as the infrastructure of trust and durability will be this era's quiet but real winner.