{"id":3876,"date":"2026-09-04T13:06:44","date_gmt":"2026-09-04T13:06:44","guid":{"rendered":"https:\/\/sawaryn.com\/?p=3876"},"modified":"2026-10-23T11:29:45","modified_gmt":"2026-10-23T11:29:45","slug":"ai-act-compliance-gpai-provider-deployer","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/ai-act-compliance-gpai-provider-deployer\/","title":{"rendered":"AI Act Without a Brake: What the Commission\u2019s Decision Means for Your Company"},"content":{"rendered":"<p>More than 40 of the most powerful CEOs of European technology companies asked the European Commission to delay the AI Act deadlines. The Commission responded unequivocally: \u201cno stop the clock, no grace period, no pause.\u201d If your company uses AI models by building products on them, integrating APIs or deploying chatbots, the deadlines are running. Duties for general-purpose AI (GPAI) model providers have applied since 2 August 2025. Full application of the rules for <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/high-risk-ai-systems-eu-ai-act\/\">high-risk AI systems<\/a> begins on 2 August 2026.<\/p>\n<p>This article explains what that means for your technology company. It sets out how AI Act duties depend on your role, what the GPAI Code of Practice is, why Meta\u2019s refusal matters to purchasing decisions and what to do over the coming months.<\/p>\n<h2>Key terms you need to know<\/h2>\n<p>Before getting into the details, it helps to clarify the terminology. The AI Act introduces concepts that directly determine the scope of your obligations.<\/p>\n<table>\n<thead>\n<tr>\n<th>Term<\/th>\n<th>Meaning<\/th>\n<th>Why it matters to you<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>GPAI model (general-purpose AI model)<\/td>\n<td>A model capable of performing a wide range of tasks and capable of being integrated into various systems, such as GPT-4, Claude, Llama or Mistral. It is one type of <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/what-is-an-ai-system-under-the-ai-act\/\">AI system<\/a>.<\/td>\n<td>If you build a product on such a model, you have deployer duties. If you create the model, you have provider duties.<\/td>\n<\/tr>\n<tr>\n<td>GPAI provider<\/td>\n<td>An entity that develops a GPAI model and places it on the market under its own name.<\/td>\n<td>The full set of Chapter V AI Act duties, including documentation, copyright and safety.<\/td>\n<\/tr>\n<tr>\n<td>Deployer<\/td>\n<td>An entity using an AI system under its own control in its professional activity.<\/td>\n<td>Duties under Chapters III and IV of the AI Act, including human oversight, transparency and AI literacy.<\/td>\n<\/tr>\n<tr>\n<td>Systemic risk<\/td>\n<td>A GPAI model whose training compute exceeds 10^25 FLOPs, or which the Commission considers capable of having a high impact.<\/td>\n<td>Additional duties, including safety testing, incident reporting and cybersecurity.<\/td>\n<\/tr>\n<tr>\n<td>GPAI Code of Practice<\/td>\n<td>A voluntary code approved by the Commission that gives a presumption of conformity with the AI Act.<\/td>\n<td>Signing makes it easier to demonstrate compliance. Without signing, conformity must be demonstrated by other means.<\/td>\n<\/tr>\n<tr>\n<td>AI literacy<\/td>\n<td>The duty to ensure that employees understand AI systems&#8217; capabilities, limitations and risks.<\/td>\n<td>It has applied since 2 February 2025 and covers every company using AI.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>The Commission refused to suspend the AI Act. What does that change?<\/h2>\n<p>The EU AI Champions initiative brought together about 50 CEOs of Europe\u2019s largest technology companies. They argued that the rules were unclear, technical standards were missing and the timetable was too ambitious. The Commission did not accept those demands. Commission spokesperson Thomas Regner confirmed that there would be no postponement, grace period or pause.<\/p>\n<p>For companies that built their compliance strategy on the assumption that \u201cthere will be a delay anyway,\u201d there is now very little time to catch up.<\/p>\n<p>The timetable already in force or approaching is:<\/p>\n<table>\n<thead>\n<tr>\n<th>Date<\/th>\n<th>Obligation<\/th>\n<th>Status<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>2 February 2025<\/td>\n<td>Prohibited AI practices and AI literacy<\/td>\n<td>In force<\/td>\n<\/tr>\n<tr>\n<td>2 August 2025<\/td>\n<td>Duties for GPAI providers, including documentation, copyright and a summary of training data<\/td>\n<td>In force<\/td>\n<\/tr>\n<tr>\n<td>2 August 2026<\/td>\n<td>The Commission\u2019s full enforcement powers for GPAI duties, including imposing fines; full application of rules for high-risk AI systems<\/td>\n<td>In one year<\/td>\n<\/tr>\n<tr>\n<td>2 August 2027<\/td>\n<td>Adaptation deadline for GPAI models placed on the market before 2 August 2025<\/td>\n<td>In two years<\/td>\n<\/tr>\n<tr>\n<td>2 December 2027<\/td>\n<td>Rules for high-risk systems in biometrics, infrastructure, education and employment<\/td>\n<td>In two and a half years<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The Commission\u2019s only compromise is the so-called Digital Omnibus: a delay until December 2027 for high-risk systems. GPAI duties have not been delayed.<\/p>\n<aside class=\"blog-article__inline-newsletter blog-article__inline-form flow\" aria-label=\"Article form\">\r\n                    <div class=\"blog-article__inline-newsletter-head flow\">\r\n                                    <h2>Need help identifying which Code duties apply to your company?<\/h2>\r\n                                                    <p>Leave your details and we will get back to you.<\/p>\r\n                            <\/div>\r\n                <div class=\"form form--cf7 blog-article__newsletter-form blog-article__inline-form-form\">\r\n            \n<div class=\"wpcf7 no-js\" id=\"wpcf7-f2368-o1\" lang=\"pl-PL\" dir=\"ltr\" data-wpcf7-id=\"2368\">\n<div class=\"screen-reader-response\"><p role=\"status\" aria-live=\"polite\" aria-atomic=\"true\"><\/p> <ul><\/ul><\/div>\n<form action=\"\/en\/wp-json\/wp\/v2\/posts\/3876#wpcf7-f2368-o1\" method=\"post\" class=\"wpcf7-form init\" aria-label=\"Contact form\" novalidate=\"novalidate\" data-status=\"init\">\n<fieldset class=\"hidden-fields-container\"><input type=\"hidden\" name=\"_wpcf7\" value=\"2368\" \/><input type=\"hidden\" name=\"_wpcf7_version\" value=\"6.1.7\" \/><input type=\"hidden\" name=\"_wpcf7_locale\" value=\"pl_PL\" \/><input type=\"hidden\" name=\"_wpcf7_unit_tag\" value=\"wpcf7-f2368-o1\" \/><input type=\"hidden\" name=\"_wpcf7_container_post\" value=\"0\" \/><input type=\"hidden\" name=\"_wpcf7_posted_data_hash\" value=\"\" \/>\n<\/fieldset>\n<div class=\"blog-article__inline-form-fields\">\n\t<p><label class=\"blog-article__inline-form-field\"><br \/>\n<span class=\"blog-article__inline-form-label\">First and last name<\/span><br \/>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"article-form-name\"><input size=\"40\" maxlength=\"400\" class=\"wpcf7-form-control wpcf7-text wpcf7-validates-as-required blog-article__inline-form-input\" autocomplete=\"name\" aria-required=\"true\" aria-invalid=\"false\" placeholder=\"Jan Kowalski\" value=\"\" type=\"text\" name=\"article-form-name\" \/><\/span><br \/>\n<\/label>\n\t<\/p>\n\t<p><label class=\"blog-article__inline-form-field\"><br \/>\n<span class=\"blog-article__inline-form-label\">E-mail<\/span><br \/>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"article-form-email\"><input size=\"40\" maxlength=\"400\" class=\"wpcf7-form-control wpcf7-email wpcf7-validates-as-required wpcf7-text wpcf7-validates-as-email blog-article__inline-form-input\" autocomplete=\"email\" aria-required=\"true\" aria-invalid=\"false\" placeholder=\"jankowalski@xyz.com\" value=\"\" type=\"email\" name=\"article-form-email\" \/><\/span><br \/>\n<\/label>\n\t<\/p>\n<\/div>\n<p><label class=\"blog-article__inline-form-field\"><br \/>\n<span class=\"blog-article__inline-form-label\">Message<\/span><br \/>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"article-form-message\"><textarea cols=\"40\" rows=\"10\" maxlength=\"2000\" class=\"wpcf7-form-control wpcf7-textarea blog-article__inline-form-textarea\" aria-invalid=\"false\" placeholder=\"Tell us briefly what you need...\" name=\"article-form-message\"><\/textarea><\/span><br \/>\n<\/label>\n<\/p>\n<div class=\"blog-article__newsletter-consent form__legal-notice\">\n\t<p>By submitting this form, you acknowledge that the personal data you provide will be processed by Kancelaria Prawna Sawaryn i Partnerzy sp.k. to handle your enquiry and contact you about it. Details are available in our <a href=\"https:\/\/sawaryn.com\/app\/uploads\/2026\/05\/SawaryniPartnerzySpK-PolitykaPrywatnosci_n.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">Privacy Policy<\/a>. The rules governing the use of this website are set out in the <a href=\"https:\/\/sawaryn.com\/app\/uploads\/2026\/05\/regulamin-serwisu-S-P.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">Terms and Conditions<\/a>.\n\t<\/p>\n<\/div>\n<p class=\"blog-article__newsletter-submit-row\"><button type=\"submit\" class=\"button blog-article__newsletter-submit\">\r\n    <span class=\"button__label\">Submit<\/span>\r\n            <span class=\"button__icon\" aria-hidden=\"true\">\r\n                <span class=\"icon\" data-icon-size=\"sm\">\n        <img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/sawaryn.com\/app\/uploads\/2026\/05\/arrow-01.svg\" alt=\"\" class=\"icon__image\" aria-hidden=\"true\" width=\"11\" height=\"13\">\n    <\/span>\n            <\/span>\r\n    <\/button>\n<\/p><div hidden aria-hidden=\"true\"><label>Leave this field blank<input type=\"text\" name=\"asl_website\" value=\"\" tabindex=\"-1\" autocomplete=\"off\"><\/label><\/div><input type=\"hidden\" name=\"asl_started_at\" value=\"1792926001.953d14887aaaf49b93931de7deea334fabfe6fbff546e1f5f5f3767dbd25982a\"><div id=\"sawaryn-turnstile-1\" class=\"cf-turnstile\" data-sitekey=\"0x4AAAAAAD2_7crf8smCDxe1\" data-theme=\"light\" data-action=\"contact\"><\/div><div class=\"wpcf7-response-output\" aria-hidden=\"true\"><\/div>\n<\/form>\n<\/div>\n        <\/div>\r\n    <\/aside>\n<h2>The GPAI Code of Practice: what it contains and why it matters<\/h2>\n<p>The GPAI Code of Practice was published on 10 July 2025, less than a month before the duties took effect. It is voluntary, but signatories benefit in practice from a presumption of conformity with the AI Act. Signing therefore simplifies demonstrating compliance to the Commission and AI Office. OpenAI, Anthropic, Mistral and Microsoft announced that they would sign. Meta refused, accusing the EU of excessive regulation.<\/p>\n<h3>The Code has three chapters<\/h3>\n<p><strong>Chapter 1: transparency and documentation<\/strong> (all GPAI providers)<\/p>\n<ul>\n<li>Prepare complete model documentation when the model is made available on the market.<\/li>\n<li>Update the documentation after every material model change.<\/li>\n<li>Keep documentation for at least 10 years after placing the model on the market.<\/li>\n<li>Respond to a request from a supervisory authority or downstream user within 14 calendar days.<\/li>\n<li>Documentation covers architecture, parameter count, training techniques, types of training data, evaluation results and estimated energy consumption.<\/li>\n<\/ul>\n<p><strong>Chapter 2: copyright<\/strong> (all GPAI providers, including open source)<\/p>\n<ul>\n<li>Adopt and maintain a documented copyright policy.<\/li>\n<li>Identify and respect machine-readable rights reservations, such as robots.txt files and HTTP headers.<\/li>\n<li>Reduce the risk of generating copyright-infringing outputs.<\/li>\n<li>Establish a contact point and complaint mechanism for rights holders.<\/li>\n<li>Document training-data sources and publish a summary of training content.<\/li>\n<\/ul>\n<p><strong>Chapter 3: safety and security<\/strong> (only models with systemic risk)<\/p>\n<ul>\n<li>Establish a Safety and Security Framework covering the model\u2019s entire lifecycle.<\/li>\n<li>Conduct internal and external red-team testing.<\/li>\n<li>Put safeguards in place against prompt injection, jailbreaks and malicious-data injection.<\/li>\n<li>Document environmental impact, including energy use and CO\u2082 emissions.<\/li>\n<li>Archive successive model versions for incident analysis.<\/li>\n<\/ul>\n<h3>Mapping the Code to the AI Act<\/h3>\n<table>\n<thead>\n<tr>\n<th>Code chapter<\/th>\n<th>Corresponding AI Act provision<\/th>\n<th>Who it covers<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Chapter 1: transparency<\/td>\n<td>Article 53(1)(a) and (b)<\/td>\n<td>All GPAI providers<\/td>\n<\/tr>\n<tr>\n<td>Chapter 2: copyright<\/td>\n<td>Article 53(1)(c) and (d)<\/td>\n<td>All GPAI providers, including open source<\/td>\n<\/tr>\n<tr>\n<td>Chapter 3: safety<\/td>\n<td>Article 55<\/td>\n<td>Providers of models with systemic risk<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Provider, deployer, integrator: determine your role<\/h2>\n<p>This is the most important decision because it determines the full scope of your duties. The AI Act distinguishes roles in the AI value chain and assigns different obligations to each.<\/p>\n<p>If you use a GPAI model API, such as OpenAI or Anthropic, to build your own application, you are a deployer. GPAI duties rest with the model provider, not you. Your duties as a deployer include human oversight, transparency toward users and AI literacy for your team.<\/p>\n<p>If you integrate an API into a system you sell to customers, such as an HR system with an AI module, you are an AI-system provider. If the system is high-risk, you have the full set of Chapter III AI Act duties. GPAI duties still rest with the provider of the base model. See the discussion of <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/azure-openai-responsibility\/\">who bears responsibility for AI Act compliance<\/a>.<\/p>\n<p>If you substantially modify an existing model and make it available under your own brand, you may become a GPAI provider. The threshold is training compute used for the modification exceeding one third of the compute used for the original model. Minor fine-tuning for your own use does not, as a rule, change your role.<\/p>\n<h3>Watch for role changes<\/h3>\n<p>A company that places its own logo on an AI system, substantially modifies its operation or changes its intended purpose ceases to be merely a deployer and is treated as a provider. This means a much broader set of duties. Many startups may cross this line without realizing it.<\/p>\n<table>\n<thead>\n<tr>\n<th>Scenario<\/th>\n<th>Your role<\/th>\n<th>GPAI duties<\/th>\n<th>Deployer or AI-system duties<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>You use the OpenAI API in your own application<\/td>\n<td>Deployer<\/td>\n<td>Rest with the model provider<\/td>\n<td>Human oversight, transparency and AI literacy<\/td>\n<\/tr>\n<tr>\n<td>You integrate an API into an HR system sold to customers<\/td>\n<td>AI-system provider<\/td>\n<td>Rest with the model provider<\/td>\n<td>Full AI-system provider duties, potentially for a high-risk system<\/td>\n<\/tr>\n<tr>\n<td>You substantially fine-tune a model and release it under your brand<\/td>\n<td>Potentially a GPAI provider<\/td>\n<td>Rest with you<\/td>\n<td>Full Chapter V AI Act duties<\/td>\n<\/tr>\n<tr>\n<td>You release a modified open-source model<\/td>\n<td>Potentially a GPAI provider<\/td>\n<td>Rest with you if compute thresholds are exceeded<\/td>\n<td>Depends on downstream use<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Meta did not sign the GPAI Code. What does that mean for Llama users?<\/h2>\n<p>Meta refused to sign the GPAI Code, accusing the EU of excessive regulation. If your company uses Llama models, you need to understand the consequences.<\/p>\n<h3>The open-source exemption: what it covers and what it does not<\/h3>\n<p>Article 53(2) of the AI Act exempts providers of open-source models from documentation duties, including technical documentation and information for downstream users, provided that model parameters, weights, architecture and usage information are made publicly available.<\/p>\n<p>The exemption has three limits:<\/p>\n<ol>\n<li>It does not cover models with systemic risk. An open-source model exceeding the 10^25 FLOPs threshold is subject to the full duties.<\/li>\n<li>It does not exempt copyright duties. A copyright policy and a summary of training data are required from every GPAI provider, including open source.<\/li>\n<li>It does not protect deployers. Your duties as a deployer remain unchanged regardless of the model provider\u2019s status.<\/li>\n<\/ol>\n<h3>Three ways to demonstrate AI Act compliance<\/h3>\n<p>Meta\u2019s refusal to sign does not make Llama models illegal in the EU. It means that Meta must demonstrate compliance by other means, which affects your risk as an integrator.<\/p>\n<table>\n<thead>\n<tr>\n<th>Route<\/th>\n<th>Legal basis<\/th>\n<th>Presumption of conformity<\/th>\n<th>Risk for your company<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>GPAI Code<\/td>\n<td>Article 53(4) and Article 56<\/td>\n<td>Presumption in practice<\/td>\n<td>Low: the provider has a privileged position<\/td>\n<\/tr>\n<tr>\n<td>CEN\/CENELEC harmonised standards<\/td>\n<td>Commission mandates<\/td>\n<td>Full presumption after publication in the Official Journal of the EU<\/td>\n<td>Low, but the standards are not yet ready<\/td>\n<\/tr>\n<tr>\n<td>Alternative measures<\/td>\n<td>Second sentence of Article 53(4)<\/td>\n<td>No formal presumption; the Commission assesses conformity ex post<\/td>\n<td>Higher: the provider bears the burden of proving conformity<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Meta chose the third route. For you as a CTO or founder, that means:<\/p>\n<ul>\n<li>Review agreements with AI model providers. Check who bears responsibility for AI Act compliance and what assurances the provider gives.<\/li>\n<li>Assess contractual risk. If the provider has not signed the Code, your position during an inspection may be weaker.<\/li>\n<li>Prepare a backup plan if you use Llama models, in case the absence of the Code creates additional duties for you as an integrator.<\/li>\n<li>Consider the effect on purchasing decisions. A provider\u2019s signature on the Code, such as OpenAI, Anthropic or Mistral, gives more regulatory predictability than using a provider that has not signed.<\/li>\n<\/ul>\n<h2>The Grok case: a warning for every company with an AI chatbot<\/h2>\n<p>Alongside the AI Act debate, the Commission is conducting formal proceedings against platform X under the <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/dsa-rules-online-platforms-intermediaries\/\">Digital Services Act (DSA)<\/a>. In December 2025, it imposed the first DSA fine in history: EUR 120 million. In January 2026, it opened a separate proceeding concerning the Grok chatbot, which generated hate speech and made inappropriate sexual content available, including to children. Poland filed an official complaint with the Commission.<\/p>\n<p>Why this matters to your company even if it is not a social-media platform:<\/p>\n<ul>\n<li>An AI chatbot in your product can generate unlawful content. A lack of content moderation creates liability risk.<\/li>\n<li>The DSA imposes content-moderation duties on platforms designated as Very Large Online Platforms, but the AI Act extends transparency and safety requirements to all AI-system providers.<\/li>\n<li>The Grok case shows that regulators treat AI-generated content like other content. Lack of content safety in a chatbot may trigger proceedings.<\/li>\n<\/ul>\n<p>Test your chatbot for unlawful outputs, implement moderation procedures and document the test results.<\/p>\n<h2>How much does AI Act compliance cost?<\/h2>\n<p>There is no firm empirical data on compliance costs for startups and SMEs. The only publicly available estimate cited here comes from industry consultations by the Digital Poland Foundation: small companies estimate annual AI Act compliance costs of up to EUR 200,000. This is indicative only. Actual costs depend on your company\u2019s role, number of AI systems, risk level and current documentation.<\/p>\n<table>\n<thead>\n<tr>\n<th>Cost category<\/th>\n<th>Main activities<\/th>\n<th>Who it concerns<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Technical documentation<\/td>\n<td>Architecture, parameters, training data and test results<\/td>\n<td>GPAI providers<\/td>\n<\/tr>\n<tr>\n<td>Quality management system<\/td>\n<td>Policies, procedures and responsibility structures<\/td>\n<td>Providers of high-risk AI systems<\/td>\n<\/tr>\n<tr>\n<td>AI literacy and training<\/td>\n<td>Employee training and educational materials<\/td>\n<td>Everyone; in force since 2 February 2025<\/td>\n<\/tr>\n<tr>\n<td>Risk management<\/td>\n<td>Risk identification, testing, validation and reviews<\/td>\n<td>Systemic-risk GPAI providers and deployers of high-risk systems<\/td>\n<\/tr>\n<tr>\n<td>Transparency and content labeling<\/td>\n<td>Label AI-generated content and inform users<\/td>\n<td>Deployers of AI systems<\/td>\n<\/tr>\n<tr>\n<td>Data protection<\/td>\n<td>DPIA, updated records and security measures<\/td>\n<td>Companies processing personal data with AI, including AI Act\/<a href=\"https:\/\/sawaryn.com\/en\/publikacje\/privacy-by-design-default-gdpr-practice\/\">GDPR<\/a> interaction<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Potential penalties are another cost to consider:<\/p>\n<table>\n<thead>\n<tr>\n<th>Type of infringement<\/th>\n<th>Maximum penalty<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Use of prohibited AI practices<\/td>\n<td>Up to EUR 35 million or 7% of annual global turnover<\/td>\n<\/tr>\n<tr>\n<td>Failure to meet high-risk system duties<\/td>\n<td>Up to EUR 15 million or 3% of global turnover<\/td>\n<\/tr>\n<tr>\n<td>Failure to meet GPAI provider duties, such as documentation or training-data summary<\/td>\n<td>Up to EUR 7.5 million or 1.5% of global turnover<\/td>\n<\/tr>\n<tr>\n<td>Providing false information to supervisory authorities<\/td>\n<td>Up to EUR 7.5 million or 1% of global turnover<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The Commission may also require a GPAI model to be withdrawn from the EU market in case of serious and justified systemic risk, under Article 93(1)(c) of the AI Act.<\/p>\n<h2>What you should do over the coming months<\/h2>\n<p>Here are seven steps, ordered by priority, from actions to take immediately to those to plan for the next few quarters.<\/p>\n<h3>Immediate actions<\/h3>\n<ol>\n<li>Determine your role in the AI value chain. Check whether your company is a GPAI provider, AI-system provider or deployer. The scope of your duties depends on this. Use the Commission\u2019s new GPAI guidance for definitions, compute thresholds and borderline scenarios.<\/li>\n<li>Review the GPAI Code of Practice and assess whether your organization should sign voluntarily. For GPAI providers, signing is the easiest route to demonstrating conformity. For deployers, check whether your model providers have signed.<\/li>\n<li>Review agreements with AI model providers. Check who is responsible for AI Act compliance, what assurances the provider gives and what happens if it has not signed the Code. If you use Meta Llama models, assess the risk arising from the absence of a presumption of conformity.<\/li>\n<li>Implement or update AI content-moderation procedures. The Grok case shows that an unmoderated chatbot may trigger regulatory proceedings. Test your chatbot for unlawful content and document the results.<\/li>\n<\/ol>\n<h3>Actions over the next 1 to 3 months<\/h3>\n<ol>\n<li>Prepare technical documentation. For a GPAI provider, it must cover architecture, parameters, training data, evaluation results and estimated energy use. The Commission provides a standardized form. The duties have applied since 2 August 2025.<\/li>\n<li>Plan AI literacy training for your team. The duty has applied since 2 February 2025 and covers everyone involved in designing, developing, deploying or overseeing AI systems. Include C-level executives so management understands the difference between GPAI-provider and deployer duties.<\/li>\n<\/ol>\n<h3>Actions to monitor<\/h3>\n<ol>\n<li>Follow developments concerning Meta and open-source models. If you use Llama, prepare a backup plan if the lack of the Code creates additional duties for you. Also monitor CEN\/CENELEC work on harmonised standards, which will provide another route to demonstrating conformity when published.<\/li>\n<\/ol>\n<h2>How we can help you prepare for the AI Act<\/h2>\n<p>The AI Act will not wait for companies to be ready. GPAI duties are already in force, and the Commission\u2019s enforcement powers, including the ability to impose fines and require market withdrawal, begin in August 2026.<\/p>\n<p>We combine legal advice with an understanding of how technology teams work. Rather than treating contracts, IP and AI as separate workstreams, we combine them into one model suited to your product.<\/p>\n<p>Our AI Act support includes:<\/p>\n<ul>\n<li>Classifying your company\u2019s role: determining whether you are a GPAI provider, AI-system provider or deployer, and mapping the resulting duties.<\/li>\n<li>Auditing AI model-provider agreements: reviewing who bears compliance responsibility, what assurances are given and how risk is allocated when a provider has not signed the Code.<\/li>\n<li>Preparing technical documentation under the AI Act and GPAI Code.<\/li>\n<li>Reviewing the GPAI Code and whether signing it is the best route for your organization.<\/li>\n<li>Reviewing AI content-moderation procedures and chatbot safety requirements.<\/li>\n<li>Preparing a compliance roadmap aligned with your business model and AI Act deadlines.<\/li>\n<\/ul>\n<h2>GPAI duties will not wait. Start by classifying your role<\/h2>\n<p>The AI Act has not been postponed. The GPAI Code has been published. Penalties for GPAI provider breaches may reach EUR 7.5 million or 1.5% of global turnover. The Commission may require a model to be withdrawn from the EU market.<\/p>\n<p>Your first step is to determine your company\u2019s role in the AI value chain. That determines which duties apply, what documentation you need and when it is due. For support with role classification, model-provider agreement audits or a compliance roadmap, <a href=\"https:\/\/sawaryn.com\/en\/contact\/\">contact us<\/a>. We can help define your obligations and prepare for deadlines that are already running.<\/p>\n<h2>Frequently asked questions<\/h2>\n<p><strong>Does the AI Act apply if my company only uses an OpenAI or Anthropic API and does not build its own model?<\/strong><br \/>\nYes, but in a limited way. As a deployer, you have duties under Chapters III and IV of the AI Act, including human oversight, user transparency and AI literacy for your team. GPAI model-documentation duties rest with the model provider. If you substantially modify a model and release it under your own brand, you may be treated as a GPAI provider with the full set of duties.<\/p>\n<p><strong>Does Meta\u2019s refusal to sign the GPAI Code mean that I cannot legally use Llama models in the EU?<\/strong><br \/>\nNo. Using Llama models in the EU remains legal. Not signing the Code is not itself a breach of the AI Act. It means that Meta must demonstrate GPAI conformity by \u201cother appropriate means,\u201d assessed by the Commission under Article 53(4). For you as an integrator, this creates higher regulatory risk because the provider lacks a presumption of conformity. Review your Meta agreements for how responsibility is allocated.<\/p>\n<p><strong>What duties apply to my company when it uses GPAI models?<\/strong><br \/>\nAs a deployer, you must provide AI literacy training, use the system in accordance with the provider\u2019s instructions, inform users that they are interacting with AI, monitor system operation and inform the provider of irregularities. If your system is high-risk, for example an HR or credit-scoring system, additional duties may include a fundamental-rights impact assessment (FRIA), keeping logs for at least six months and assigning oversight to competent people.<\/p>\n<p><strong>Could an AI chatbot expose my company to liability even if I am not a social-media platform?<\/strong><br \/>\nYes. The Grok and X case shows that regulators treat AI-generated content like other content. A lack of moderation where a chatbot generates unlawful content, such as hate speech or sexual content accessible to children, may trigger proceedings under the DSA if your platform meets its criteria, and under the AI Act\u2019s transparency and safety duties. Test your chatbot for unlawful outputs and document the results.<\/p>\n<p><strong>When may the Commission impose penalties for AI Act violations?<\/strong><br \/>\nThe Commission\u2019s full powers to penalize GPAI-duty breaches begin on 2 August 2026. That does not mean you can do nothing until then: documentation and information duties have applied since 2 August 2025, and the Commission may already request information and assess models. Penalties for GPAI provider breaches may reach EUR 7.5 million or 1.5% of global turnover. Use of <a href=\"https:\/\/sawaryn.com\/en\/publications\/limiting-the-abuse-of-artificial-intelligence-according-to-assumptions-in-the-us-and-eu-what-do-you-need-to-know-about-it\/\">prohibited AI practices<\/a> has been prohibited since 2 February 2025 and may be penalized by up to EUR 35 million or 7% of turnover.<\/p>\n<p><strong>How much does AI Act compliance cost a small technology company?<\/strong><br \/>\nThere is no firm empirical data. The only public estimate cited here is from Digital Poland Foundation industry consultations: small companies estimate annual costs of up to EUR 200,000. Actual costs depend on the company\u2019s role, number of AI systems, risk level and existing documentation. A deployer using one API will generally face lower costs than a systemic-risk GPAI provider.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The AI Act has not been paused. Learn how GPAI duties, the Code of Practice and provider\/deployer roles affect your company\u2019s compliance work.<\/p>\n","protected":false},"author":9,"featured_media":1886,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"","sip_en_pl_url":"","sip_pair_uuid":"","sip_pair_state":""},"categories":[1577],"tags":[1545,1448,1537,1531],"specialization":[1211],"practice_area":[],"class_list":["post-3876","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it-ai-ip-law","tag-ai-act-en","tag-compliance","tag-intellectual-property-en","tag-personal-data-protection","specialization-it-ai-ip-law"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=3876"}],"version-history":[{"count":1,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3876\/revisions"}],"predecessor-version":[{"id":4196,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3876\/revisions\/4196"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media\/1886"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=3876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=3876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=3876"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=3876"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=3876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}