The tracker
### Safety questionnaires (potential use of Article 91 powers; the legal basis of individual requests is not publicly confirmed)
Who: GPAI providers with models on the EU market; 30+ developers received them, US and Chinese companies included. What: evidence of how they manage model safety, security, transparency and copyright compliance. Key dates: sent late August 2026; replies confirmed received September 25, 2026. Status: under assessment — Virkkunen (October 9) said the assessments could lead to formal investigations. Source: Reuters via European Newsroom, October 9, 2026 — https://europeannewsroom.com/eu-tech-chief-expects-countries-leading-ai-race-to-come-around-on-safety/
### GPAI baseline obligations (Article 53)
Who: all providers of general-purpose AI models placed on the EU market. What: technical documentation; information for downstream providers; a copyright compliance policy; a public summary of training content using the AI Office template. Key dates: apply since August 2, 2025; models marketed before that date comply by August 2, 2027. Status: in force; enforceable since August 2, 2026. Source: European Commission, AI Act — https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
### GPAI Code of Practice (Article 56)
Who: GPAI providers — voluntary. What: commitments across three chapters: Transparency, Copyright, and Safety & Security (the last only for systemic-risk models). Key dates: final code received by the Commission July 10, 2025. Status: voluntary, not law — adherence is a recognised way to demonstrate compliance and is weighed in enforcement; non-signatories must show compliance another way. Source: European Commission, AI Act — https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
### Systemic-risk obligations (Articles 51 & 55)
Who: providers of GPAI models classified as presenting systemic risk, including models presumed to qualify under the 10^25-FLOP threshold or designated by the Commission. What: notify the Commission without delay and within two weeks after the Article 51 systemic-risk condition is met or becomes known; standardised model evaluation including adversarial testing; assess and mitigate systemic risks; adequate cybersecurity for model and infrastructure. Key dates: apply since August 2, 2025; enforceable since August 2, 2026. Status: in force. Source: European Commission, GPAI provider guidelines — https://digital-strategy.ec.europa.eu/en/faqs/guidelines-obligations-general-purpose-ai-providers
### Serious incident reporting (Article 55(1)(c))
Who: providers of GPAI models with systemic risk. What: track serious incidents and report them to the AI Office without undue delay. Key dates: since August 2, 2025. Status: in force — no public register of reports exists, so the volume of reports filed is unknown. Source: European Commission guidance — https://digital-strategy.ec.europa.eu/en/faqs/guidelines-obligations-general-purpose-ai-providers
### Transparency for generative output (Article 50)
Who: providers and deployers of generative AI systems. What: machine-readable marking of AI-generated content; disclosure of chatbots; labelling of deepfakes. Key dates: Article 50 generally applies from August 2, 2026; under Article 111(4), systems placed on the market before that date have until December 2, 2026 to meet Article 50(2)'s machine-readable marking requirement. Status: in force, in transition. This is the rule behind EU watermarking rollouts. Source: European Commission, AI Act — https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
### Commission enforcement and fines (Articles 91–93, 101)
Who: GPAI providers. What: comply with document requests (Article 91), model evaluations (Article 92) and requested measures (Article 93); Article 101 fines up to €15 million or 3% of preceding-year worldwide turnover, whichever is higher, including for intentional or negligent non-compliance with Article 91 requests or provision of incorrect, incomplete or misleading information. Key dates: powers live since August 2, 2026. Status: no fines announced as of October 12, 2026. Source: European Commission, AI Act — https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
### High-risk system obligations (Annexes I & III) — context row, not model-provider duties
Who: providers of high-risk AI systems (employment, education, biometrics, regulated products). What: the full conformity regime — risk management, data governance, logging, human oversight, conformity assessment. Key dates: delayed by the AI Omnibus — Annex III use cases from December 2, 2027; Annex I regulated products from August 2, 2028. Status: not yet applicable. Included because coverage routinely conflates these dates with the GPAI dates above; they are separate tracks. Source: European Commission, AI Act — https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
What the questionnaires actually are
The Commission's questionnaires seek compliance information from AI developers. Article 91 provides a formal power to demand documentation and information from GPAI providers, but the Commission has not publicly confirmed the legal basis of each questionnaire. They are not a survey and not a consultation.
The surrounding power set is broader than paperwork: since August 2, 2026, the AI Office can also evaluate models directly (Article 92) and require corrective measures (Article 93). And the paperwork itself has teeth. Under Article 101(1)(b), a GPAI provider that intentionally or negligently fails to comply with an Article 91 request, or supplies incorrect, incomplete or misleading information, can face a fine of up to €15 million or 3% of preceding-year worldwide turnover, whichever is higher.
Virkkunen has said the trigger was concrete: AI agents escaping test environments and bypassing safety controls in cybersecurity experiments, with developers unable to control their own systems. The Commission convened its 60-expert Scientific Panel on frontier AI safety on October 9 to work through recent loss-of-control incidents and draft follow-up questions. The questionnaires were sent in August, before the October public discussion of recent agent-security incidents. The Commission has not publicly established whether those incidents influenced the requests. Our news coverage of the questionnaire round: Brussels Questioned 30 AI Labs About Safety. Now It Reads the Answers. — https://alfw.ai/article/eu-30-ai-labs-safety-questionnaires/
Questionnaire vs enforcement
These are different things, and most coverage blurs them.
What a questionnaire is: a demand for evidence, sent to companies the Commission wants documented proof from. It is not an accusation, not a finding, and not public — the Commission has not even named the recipients.
What enforcement would look like: if the assessments find gaps, the Commission can open formal proceedings, evaluate a model directly, require corrective measures, restrict or withdraw a model from the EU market, and fine the provider. For GPAI providers the fining power is Article 101: up to €15 million or 3% of total preceding-year worldwide turnover, whichever is higher.
What the fines are not: the 7% / €35 million figure attached to almost every headline about this story is Article 99(3) — the tier for banned practices such as social scoring and untargeted facial-recognition scraping. It does not apply to a model provider's documentation, transparency or safety-process failures. Our own first report's summary line blurred this; the tracker above keeps the tiers separate because the difference is a factor of two.
What is not yet established, as of October 12, 2026: no provider has publicly been found non-compliant with the GPAI obligations; no AI Act fine has been announced against a GPAI provider; the recipient list for the questionnaires is not public, and claims naming specific companies beyond the labs' own confirmations are unverified; whether any assessment escalates to a formal investigation is unknown — Virkkunen said it "could", which is a warning, not a schedule.
What to watch
Three dated things will show whether this tracker is documenting a regime or a press release: whether the Commission announces any formal investigation out of the questionnaire round; whether the December 2, 2026 transparency transition closes without enforcement noise; and whether the first Article 101 fine — whenever it lands — is for a substantive breach or for a sloppy questionnaire response. The second is the cheaper mistake to make, and the one compliance teams should fear first.
Sources
- [1] European Commission, "AI Act" (framework, GPAI rules, enforcement, application timeline incl. Omnibus dates)Read source
- [2] European Commission, Guidelines on the scope of obligations for GPAI providers (systemic-risk threshold, two-week notification)Read source
- [3] European Commission, "The AI Omnibus enters into force"Read source
- [4] Reuters via European Newsroom, "EU tech chief expects countries leading AI race to come around on safety" (October 9, 2026)Read source
- [5] alfw.ai coverage, "Brussels Questioned 30 AI Labs About Safety. Now It Reads the Answers." (October 11, 2026)Read source