Article 101 fines for GPAI providers: requirements and evidence

What Article 101 fines GPAI providers for, and when it applies

From 2 August 2026, the European Commission can fine a provider of a general-purpose AI model up to 3% of its preceding financial year's total worldwide turnover or EUR 15 million, whichever is higher, for intentional or negligent infringements. If you place a general-purpose AI model on the EU market, this fine power is the enforcement backstop for the Chapter V duties, and it is the Commission, not a national authority, that wields it through the AI Office. Article 101 is excluded from the 2 August 2025 start of Chapter XII, so the penalty power for these providers arrived a year after the general-purpose AI rules themselves. Confirm your exposure against the turnover figure for your most recent completed financial year, because the cap is calculated on that base, and check with counsel how group turnover is attributed if your model sits inside a larger corporate group.

Article 101(1) covers four kinds of conduct. The first is simply infringing the relevant provisions of the Act. The second is failing to answer an information request or giving incorrect information in reply. The third is failing to comply with a measure the Commission has requested. The fourth is refusing or failing to give the Commission access so it can run evaluations of your model. In practice, the second and fourth are the ones that catch organizations off guard, because they depend on whether your team can produce accurate technical documentation, copyright policy records and training data summaries on short notice, and whether engineers can support a controlled evaluation. Ask your legal and engineering leads who would own each request and how fast they could answer it.

The fine itself is rarely the hard part. The harder work is building evidence that already exists in a consistent form: model documentation, the copyright policy, the public training data summary, and a record of every information request and response. The Commission must communicate preliminary findings and hear you before it decides, and the Court of Justice can cancel, reduce or increase any fine, so procedural rights exist. Commitments made under Article 93(3) or in a code of practice under Article 56 are taken into account when fines are set, which makes an early, documented decision to follow a code a practical risk control. Review the Commission's GPAI guidelines and the consolidated text now, and confirm with your own counsel which obligations already apply to the models you place on the market.

Which GPAI providers and conduct the fine power reaches

Article 101 reaches a narrower set of actors than the AI Act as a whole, but its reach is wider than the model's home country. The cards below separate who is a provider, which model type raises exposure, which teams hold the evidence, and which regulator acts on which system.

Placing a model on the EU market

Article 2 applies the Act to providers who place AI systems or general-purpose AI models on the EU market, wherever they are established. A provider outside the EU is therefore not outside the fine power by reason of location alone. Check whether the model is made available to EU customers, downloadable from EU-facing channels, or integrated into products sold in the Union, because each of these can establish the market link.

Systemic-risk model providers

Providers of general-purpose AI models with systemic risk carry extra duties under Chapter V, and their conduct is the most closely watched by the Commission. Confirm with counsel whether your model falls within the systemic-risk classification and what documentation supports that position. A model that crosses the threshold changes the scale of information requests and evaluation access you should expect.

Four fineable failures

Article 101(1) covers infringing the relevant provisions, failing to answer information requests or giving incorrect information, failing to comply with requested measures, and refusing access for evaluations. Incorrect information is treated as seriously as silence, so answers to the Commission need the same review discipline as any regulatory filing. Map each category to a named owner before a request arrives.

Teams that hold the evidence

Documentation, responses to information requests and access for evaluations usually sit across legal, model development, safety evaluation, and product or platform teams. Assign one accountable owner for the response record and confirm who can release technical documentation without delay. Gaps often appear when the team that trained the model is not the team that answers the Commission.

Commission versus national authorities

The Commission's AI Office enforces the general-purpose AI model rules, while national market surveillance authorities enforce the Act for AI systems. Under Article 75(1), as amended in 2026, the AI Office is exclusively competent for AI systems built on a provider's own general-purpose model. If you both train the model and ship a product built on it, expect the Commission, not a national authority, to hold jurisdiction over that product.

How an assessor or the Commission tests GPAI compliance before a fine

This table compares each step the Commission can take when testing a general-purpose AI model provider, from documentation review to evaluation access, with the evidence each step asks for and the findings that tend to come up. Read it as a sequence: most steps come before any fine, and the Commission's decision is not an audit report.

Test step	Evidence requested	Common findings
Review of technical documentation	Model documentation and records kept for the AI Office and national authorities, kept current and available on request	Documentation that describes an older model version than the one on the market
Response to information requests	Complete, accurate and timely answers to the Commission's written questions	Answers that are late, partial, or that contain figures later found to be incorrect
Compliance with requested measures	Evidence that the measures the Commission asked for were carried out, with dates and owners	Measures accepted in principle but not implemented or not evidenced
Access for evaluations	Access arrangements that let the Commission run or observe model evaluations as requested	Access refused, delayed or limited in ways the Commission did not agree to
Preliminary findings and hearing	Written reply to the preliminary findings and any hearing submissions, backed by records	Replies that do not address the specific infringement set out in the findings
Commitments and codes of practice	Commitments made under Article 93(3) or a code of practice under Article 56, with proof of adherence	Commitments that exist on paper but are not reflected in operating practice
Court review of any fine	Record of the Commission's decision and the provider's submissions, for the Court of Justice	Gaps in the record that weaken the provider's position on appeal

Steps to make a GPAI provider fine-resistant before 2 August 2026

This sequence turns Article 101 exposure into a working control set: every general-purpose AI model is mapped, every Commission request has an owner, and the information you supply can be traced and defended. The output is a ready response capability before the Commission's fining power applies from 2 August 2026.

Map every general-purpose AI model on the EU market
Start with a complete list of general-purpose AI models your organization places on the EU market, including models you train, models you fine-tune and release under your name, and models you make available through an API or a downloadable package. Assign each entry a named owner, a version identifier, and the EU market placement date. The step is done when the list is reviewed by legal counsel and signed off by the head of AI governance, and a gap check confirms no model is missing from the register. Confirm with counsel how the definitions in the Act apply to your specific model arrangements.
Assign a response owner for information requests
Name one accountable person and one deputy for Commission information requests under Article 101. The owner receives all requests, sets internal deadlines, coordinates engineering, legal and communications input, and decides who signs the response. Write the escalation path to the executive who can approve a response. The output is a signed role description and a contact record that the Commission can reach, reviewed against the mapped model list so that each model has a clear route to a responsible person.
Set up a register of supplied information
Create a log of every document, dataset summary, technical description and explanation your organization gives to the AI Office or other authorities. Each entry records the request it answers, the author, the reviewer, the source system, the date and the version of the underlying evidence. Because Article 101 treats incorrect information as fineable conduct, add an accuracy check that compares each statement against the source record before release. The output is a register with a documented review sign-off for every submission.
Prepare evaluation access runbooks
Article 101 covers failing to give access for evaluations, so document how the Commission or its appointed evaluators would reach each model. Write a runbook that covers access approvals, the technical environment, credentials handling, logging of evaluator activity, and the internal contacts who can grant or pause access. Test the runbook in a controlled exercise with the platform team, and record what was found and fixed. The output is an approved runbook per model and a dated record of the exercise, which shows that access can be granted without delay in practice.
Prepare requested-measure runbooks
Failing to comply with requested measures is also fineable, so prepare a runbook for each model that describes how your organization would implement a measure the Commission asks for. Cover the decision makers, the technical steps to restrict, modify or withdraw a model or its access, the communication plan with downstream users, and the evidence you would keep. Identify where a change needs engineering time, and record the dependency. The output is a tested runbook per model with named approvers, reviewed by legal counsel before the 2 August 2026 date.
Track commitments and code of practice adherence
The Commission takes into account commitments made under Article 93(3) and adherence to codes of practice under Article 56 when fixing fines, so record each commitment and each code of practice element your organization has adopted. For every item, store the source document, the owner, the status, the evidence of delivery and the date of the last review. Where you have chosen a route other than a code of practice, document the alternative means you use to demonstrate compliance. The output is a commitments and adherence register that is reviewed on a set schedule and kept consistent with the information register.
Rehearse the end-to-end response
Run a tabletop exercise that simulates a Commission information request, an evaluation access request and a requested measure for one model, using the registers and runbooks created earlier. Involve legal, engineering, security and communications staff, and record gaps, decisions and timing. The exercise should check that the register answers the request accurately and that the owner can reach every approver. The output is a written exercise report with assigned remediation items, and an updated runbook where the exercise showed a gap.
Confirm readiness with qualified advisers
Before 2 August 2026, review the full sequence with counsel and, where you use an implementation partner, with that partner. Partners can prepare systems, registers and runbooks, but they do not issue reports or certificates, and the decisions on what to submit remain with your organization. Ask the Commission's current guidance on the GPAI model rules for any point that remains unclear, and record the answers. The output is a signed readiness memo that lists the registers, owners, runbooks and open items, with a date for the next review.

How the Commission sets the fine and what lowers it

The Commission does not apply the 3% or EUR 15 million caps mechanically. Under Article 101(1), it sets the amount for each infringement, and when it does so it takes into account two kinds of conduct that a provider controls: commitments made under Article 93(3) and adherence to codes of practice under Article 56. A provider that has offered binding commitments to address a concern, or that can show it follows an approved code of practice, has a documented basis for arguing that a lower amount is proportionate. The practical step is to decide early whether to rely on a code of practice, check which of its measures your model documentation and safety work already satisfy, and keep dated records that show how each measure is applied. Confirm with the AI Office how it will treat commitments offered during an investigation, because the weight given to them is a matter for the Commission's discretion.

Before any decision, the Commission must communicate its preliminary findings to the provider and give it the opportunity to be heard. This is the stage where a provider can contest the facts, the classification of the conduct and the proposed remedy. Legal, regulatory and engineering teams should be ready to respond in writing and to produce technical evidence, such as training data summaries, evaluation results and incident logs, within the time the Commission sets. Treat a preliminary finding as the start of the defence file, not as a formality, and assign one owner for the response so that factual statements stay consistent across submissions.

The fine is also open to review. Under Article 101(5), the Court of Justice of the European Union has unlimited jurisdiction to cancel, reduce or increase a fine. That means the Court can re-examine both the legal basis and the amount, without being limited to checking whether the Commission made an error of law. For a provider, this matters for planning: the figure set by the Commission is not necessarily final, and the cost of an appeal, including external counsel and expert witnesses, should be included in any risk assessment. The caps set a ceiling, not a forecast. Reaching a realistic figure requires the actual turnover, the infringement found and the mitigating conduct, and none of these are estimated on this page.

Evidence that shows a GPAI provider responds properly to the Commission

Article 101 fines turn on how a provider handles the Commission, not only on the model itself. The evidence below shows that requests were logged, answered accurately, acted on and matched to the commitments the provider made, so each record should be kept current between Commission contacts rather than rebuilt when a request arrives.

Information request log

Record every Commission information request with the date and time received, the deadline, the named owner, the reviewer who signed off the response and the date it was sent. Article 101 covers failing to comply with information requests, so gaps in this log are the first thing an assessor will test. Review open items weekly and confirm the log is retained under your own records policy.

Verified accuracy record per submission

For each submission, keep a record showing who checked each factual claim against source data, what was checked, and the date of verification. Article 101 covers supplying incorrect information, so a response that cannot be traced to checked evidence is a risk even if it was sent on time. Ask a second reviewer to test a sample of figures before anything leaves the organization.

Records of measures implemented after a request

When the Commission requests measures, keep the decision record, the change ticket or configuration history, the test result that confirms the change works, and the date it took effect. Article 101 covers failing to comply with requested measures, so the file should show the measure was implemented, not only promised. Note any measure you disputed and the outcome of that discussion.

Evaluation access logs

Keep logs showing when Commission evaluators or their appointed experts accessed models, endpoints or documentation, which accounts were used, and what each session covered. Article 101 covers failing to give access for evaluations, so access must be provable from logs rather than from memory. Confirm with counsel which access terms apply before any evaluation starts.

Access-control records for evaluation environments

Document how access to evaluation environments is granted, reviewed and removed, including named accounts, approval records and periodic reviews of who still holds access. Evidence that access was limited to approved people supports the claim that access was given in an orderly way. Store these records separately from the model team's working files so they can be produced quickly.

Code of practice and commitment register

Maintain a register of every commitment made under Article 93(3) and every code of practice under Article 56 that the provider has adopted, with the obligations each one covers and the evidence for each. The Commission takes these commitments into account when fixing fines, so an accurate register can matter as much as the response itself. Review it whenever a commitment changes or a new code is adopted.

What it costs to be ready for Article 101 enforcement

This table compares the cost components of readiness for Commission enforcement under Article 101, showing who is paid for each, whether the cost is one-time or recurring, and what to ask for in a quote. The fine figures are statutory maximums, not estimates of what any provider will pay, so use them to size exposure rather than budget.

Cost component	Who is paid or who bears it	One-time or recurring	What drives it and what to ask for
Legal and regulatory counsel	External law firm or in-house legal team	Both, with recurring review as the Commission issues guidance	Jurisdictional questions, scope of the model, and response to preliminary findings. Ask for the named lawyers, hours cap and the scope of work in writing.
Internal compliance and documentation staff	Your own staff, or a contractor for documentation support	Mostly recurring	Number of models, release frequency and volume of information requests. Ask who owns each evidence record and how often it is refreshed.
Engineering time for evaluation access and logging	Your engineers, or an implementation partner for logging and access setup	One-time build, then recurring operation	Model architecture, existing logging and the access the Commission may request for evaluations. Ask what is built, what is tested and who maintains it.
External review of submissions	Independent reviewer or advisor	Recurring, tied to submissions	Complexity of information requests and the number of responses. Ask for a fixed scope per submission and a turnaround commitment in the quote.
Incorrect or incomplete information risk	Provider bears the exposure	Ongoing	Quality control over submitted data. Ask your reviewer how accuracy checks are recorded before each submission.
Fine exposure (statutory cap)	Provider bears the exposure	Contingent, not a budget line	Up to 3% of annual total worldwide turnover in the preceding financial year or EUR 15 million, whichever is higher (Article 101(1)). Fines are set after preliminary findings and a hearing, and the Court of Justice can adjust them.

Where GPAI providers usually fall short on Article 101

Article 101 fines attach to conduct as much as to the model itself: slow answers to the AI Office, inaccurate submissions, blocked evaluations, untracked commitments and an unprepared hearing can each trigger liability. The gaps below recur across providers, and each one has a concrete action that closes it before the Commission asks.

No named owner for information requests

Article 101 covers failing to comply with information requests, and the Commission can act on a request that sits unanswered in a shared inbox. Assign one accountable person and a deputy, with written authority to pull legal, engineering and training-data records on short notice. Check that the routing from the AI Office contact point reaches that person within the same working day, and rehearse one request end to end.

Inaccurate or unverified submissions

Article 101 also covers supplying incorrect information, so a technically true answer that overstates safety testing or misdescribes training data creates its own exposure. Before anything leaves the company, trace each claim to a named source document, a test run or a dated record. Keep a log of what was submitted, to whom and on what date, so later corrections are visible and documented.

No evaluation access pathway

Failing to give access for evaluations is a separate fineable act, and providers often discover late that access depends on people, accounts or environments nobody has prepared. Document how an evaluator would obtain access to the model, the relevant interfaces and the logs, including who approves it and how credentials are issued and revoked. Test that pathway in a dry run using a non-production replica where possible.

Commitments made without tracking

The Commission takes commitments made under Article 93(3) or in codes of practice under Article 56 into account when fixing a fine, so a commitment that is not tracked can work against the provider. Maintain a register listing each commitment, its owner, its due date, the evidence that shows it was met and any dependency on other teams. Review the register on a fixed cadence and before every external submission.

Nothing ready for the preliminary findings hearing

The Commission must communicate preliminary findings and hear the provider before deciding, so the hearing is a practical deadline. Providers that have not prepared typically struggle to reconstruct past decisions and to answer with evidence. Prepare a response file in advance covering the compliance position for each obligation, the supporting records, and named spokespersons. Have counsel review it so the provider can respond within the procedure the Commission sets.

Who does what: your team, an implementation partner and the auditor

Your organization owns its obligations under the AI Act. For a provider of a general-purpose AI model, that means deciding which infringements are relevant to your models, who answers Commission information requests, and what your position is on commitments and codes of practice. These decisions carry legal weight, so they stay with people who can sign for the company.

Obligation mapping: Confirm which Chapter V duties apply to each model you place on the EU market, and record the basis for that view.
Information request handling: Name an owner for requests from the AI Office, set response standards, and log what was supplied and when.
Code of practice position: Decide whether to rely on a code of practice under Article 56 and document how your commitments map to it.
Enforcement response: Prepare for preliminary findings and the right to be heard, including who drafts submissions and who approves them.
Turnover and exposure: Work with finance to establish worldwide annual turnover for the preceding financial year, since the fine cap depends on it.

Check with counsel which of these decisions you can delegate in writing and which must stay with an officer of the company.

Questions buyers ask about Article 101 fines and readiness

From when can the Commission fine general-purpose AI model providers under Article 101?

The Commission's power to fine general-purpose AI model providers under Article 101 applies from 2 August 2026. Article 113 excluded Article 101 from the 2 August 2025 application of the penalty chapter, so the other general-purpose AI rules started earlier than the fining power. The Commission's guidance for providers of general-purpose AI models confirms that it can enforce compliance, including through fines, from that date. Before that date, providers still had obligations under the general-purpose AI chapter, but this article did not yet allow fines. Check the application date against the consolidated text of the Act as amended in 2026, because later amendments can change timing and your counsel should confirm how it applies to your models.

How large can an Article 101 fine be for a model provider?

The maximum fine is 3% of annual total worldwide turnover in the preceding financial year or EUR 15 million, whichever is higher. The higher of the two figures sets the ceiling, so a provider with large turnover faces a percentage-based cap, while a smaller provider faces the fixed amount. The Commission can impose fines for intentional or negligent infringements. The cap is a maximum set by the regulation, not a forecast of what the Commission will impose. When fixing the amount, the Commission takes into account commitments made under Article 93(3) or codes of practice under Article 56, so a provider's documented engagement with those routes matters to the outcome. Ask your counsel to model exposure using the turnover figure for the preceding financial year.

Which infringements can the Commission fine under Article 101?

Article 101 covers four kinds of conduct by a provider of a general-purpose AI model:

infringing the relevant provisions of the Act
failing to comply with information requests or supplying incorrect information
failing to comply with measures the Commission has requested
failing to give access for evaluations

The last three are procedural, which means a provider can breach them even when its model is otherwise well documented. Treat information requests, requested measures and evaluation access as operational processes with named owners, deadlines and records. Read the article text directly before you build your internal procedure, because the wording determines what counts as an infringement.

Can an implementation partner prevent an Article 101 fine?

No partner can guarantee that a fine will not be imposed. A fine follows an infringement by the provider, and the Commission decides whether to impose one. An implementation partner can help the provider prepare systems, documentation and records that show what the provider did and how it responds to requests. The provider keeps responsibility for its own compliance. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. Ask any partner to state in the written scope which documents, records and access arrangements it will deliver, and which legal decisions stay with the provider's own team.

How long does Article 101 preparation take, and what does it need from us?

No researched source fixes a duration for this work, so ask for a written timeline tied to the agreed scope. The length depends on how many models and versions are in scope, how complete the existing documentation is, and how quickly teams can produce evidence. The organization must supply:

named owners for information requests, requested measures and evaluation access
access to the model, its evaluation records and the people who can explain them
a decision on whether it will use a code of practice or make commitments under Article 93(3)

Fixed-scope work is priced from the written scope and delivered against agreed deliverables. Ongoing record keeping and response readiness recur after the initial work, so ask the partner to separate one-time and recurring effort in the quote.

Can self-hosted tooling produce the evidence Article 101 may require?

Self-hosted tooling can keep much of the evidence inside your own infrastructure, but the Act and the Commission set the form that evidence must take, so confirm it before you build. Typical records include versioned model documentation, evaluation run logs, access logs for evaluators, retention controls and a register of information requests with responses. DeployOpen deploys and hardens self-hosted open-source platforms inside a client's own cloud accounts, data centers or air-gapped networks, which keeps those records under the provider's control. Do not assume that any tool satisfies a provision on its own. Test the evidence chain with your counsel against the guidance and the article text, and record which version you relied on.

How do we confirm the current status of the Commission's GPAI guidance?

Check the Commission's guidelines page for providers of general-purpose AI models directly, then compare it with the consolidated text of the Act. Look for the date of each document and whether it is marked as final, draft or replaced by later material. Record the version you relied on, the date you checked it and the person who approved the reading in your compliance file. Repeat the check whenever the Act or the Commission publishes an update, and ask your counsel to confirm how the guidance applies to each model you place on the market.

What procedural safeguards apply before the Commission imposes an Article 101 fine?

The Commission must communicate its preliminary findings to the provider and hear the provider before it decides. The Court of Justice has unlimited jurisdiction to cancel, reduce or increase a fine. These safeguards mean the provider can respond to findings with evidence and argument, so a documented response process matters. Assign an owner who can receive a preliminary finding, gather the records that support the provider's position and coordinate with legal counsel within the time the Commission allows. Keep the correspondence and the evidence you submitted, because the court review will depend on the record.

How DeployOpen prepares GPAI evidence for an engagement

The engagement starts with a written scope, because the question an assessor or the AI Office will ask is which general-purpose AI model is in play, who provides it, and which of the Article 101 infringement types (the failure to comply with the relevant provisions, to answer information requests or supply accurate information, to comply with requested measures, or to give access for evaluations) the client must be ready to demonstrate. DeployOpen maps that scope to the client's own environment: the cloud accounts, data center or air-gapped network where the self-hosted platform runs, the model serving and fine-tuning pipelines, and the teams that hold documentation. The scope document names the systems in it, the owner of each control, the evidence to be produced, and what is excluded. Fixed-scope delivery means deliverables and timelines are agreed before work begins, so the client can see what is being bought and what is not.

Within that scope, DeployOpen configures and hardens the platform, sets up audit logging and retention on infrastructure the client controls, and assembles evidence packs that index technical documentation, change records, access logs, incident records and responses to information requests. The client keeps ownership of the controls and the answers they give to the Commission. Ongoing items, such as keeping logs complete after go-live or responding to a new request, are typically handled under a separate retainer agreed in writing. Confirm with your own counsel which records your provider obligations require and how long you must keep them, because those duties come from the Act and the Commission's guidance, not from DeployOpen's templates.

DeployOpen prepares systems and evidence. It does not issue audit reports, attestations, certifications or Commission decisions, and it does not represent the client before the AI Office. Those outcomes depend on the Commission's own procedure, including preliminary findings and the right to be heard under Article 101, and on any independent assessment the client commissions. Before signing, ask the proposed partner to state in writing which deliverables are technical preparation and which, if any, require an external party, and ask who will hold the evidence after the engagement ends.

Article 101 Fines for providers of general-purpose AI models