EU GPAI Fines Are Live: What a US Company Shipping Agents into Europe Puts in the SOW

On 2 August 2026 the Commission's enforcement powers over general-purpose AI providers went live. Fines for GPAI breaches can reach €15 million or 3% of worldwide annual turnover. A lot of US teams heard "the AI Act was delayed" (true for Annex III high-risk systems, pushed toward December 2027 by the Digital Omnibus) and stopped listening.

Those are different clocks. We already wrote about why the high-risk delay is a trap: the EU gave you 16 more months. This post is the procurement version. If you sell or operate an agent that Europeans can use, what belongs in the statement of work this quarter.

I am not your counsel. I am the person who has to implement the logging the contract promised.

Who you are in the Act

GPAI provider: you train or substantially modify a general-purpose model and put it on the market. That is OpenAI, Anthropic, Google, DeepSeek, and a handful of others. Probably not you.

Deployer: you use a GPAI model inside a product or process. That is almost every SaaS company with an "AI feature," and every services firm that ships an agent for a client.

Deployers do not pay the GPAI-provider fine line. Deployers still have:

• Transparency when people interact with AI (Article 50). Chatbots, voice agents, synthetic media.
• AI literacy duties (Article 4). Your operators have to understand the system they supervise.
• Sector rules that did not wait for the Omnibus (finance, hiring, biometrics, and anything already prohibited).

If the agent is high-risk when Annex III bites, you will want the logs now, while the product is still malleable. Retrofitting audit trails is the expensive version of this project.

Clauses that actually change the build

Steal the intent, have a lawyer write the words:

1. Model inventory. Named SKUs, providers, regions, and a process to add one. "We use LLMs" is how you wake up on Fable 5 with an export problem. See India teams and Fable 5.
2. Disclosure. Where the UI tells a human they are talking to an agent, in which languages, on which surfaces (web, voice, ChatGPT sponsored slot).
3. Logging. What is stored (prompts, tool args, model ID, scores), where, for how long, who can replay. If you cannot replay a decision, you cannot defend it.
4. Human oversight. Who can take over, how fast, and what the agent is forbidden to do without a human (refunds, legal advice, medical, credit).
5. Eval evidence. A living suite, not a slide. Pass rates on the tasks you sell. See evals your board trusts.
6. Substitution. If a provider SKU is withdrawn, restricted, or repriced, the vendor reroutes within N days without a hostage change-request.
7. Subprocessors. The model lab, the voice SKU, the sandbox, the eval vendor. GPAI enforcement is their problem; your DPA is still yours.

Engineering that satisfies the clause without a second project

• Emit model_id, provider, cache_hit, tool_names, trace_id on every turn.
• Store a redacted replay bundle, not a screenshot of a vendor UI.
• Keep a one-page operator guide. That is Article 4 in a form an on-call can read.
• Label the agent in the UI. That is Article 50. Do it even in the US. Sponsored surfaces in ChatGPT are still your product if you paid for them. See Sponsored Agents.

None of this is "compliance theater." It is how you debug a bad refund at 2am.

Frequently Asked Questions

We have no EU entity. Are we in the clear? If the product is available to people in the EU, you should assume the Act cares. "No EU company" is not a technical control. Ask counsel; do not take comfort from the org chart.

Does using OpenAI make them the deployer? No. They are the GPAI provider. You are the deployer of the feature. Both have duties. Yours are the ones in your SOW.

The Omnibus delayed high-risk. Can we skip logging until 2027? You can. You will then rebuild the agent to add logging, which is how a six-week feature becomes a two-quarter migration. We do not recommend it.

What about UK and California? Separate regimes. California SB 53 is already in force for frontier developers above a compute threshold. UK is sectoral. Do not copy-paste an EU clause and hope. Map each market.

---

FoundrySoft writes the logging, evals, and oversight into the agent so the SOW is not fiction. See AI governance or contact us.