Art.88

Article 88 – Enforcement of the Obligations of Providers of General-Purpose AI Models

GPAI Models SME Relevant ~3 min read · 505 words

Article 88 opens Section 5 of Chapter IX — the enforcement section specifically dedicated to GPAI model providers. It establishes the AI Office as the primary enforcement authority for GPAI obligations and defines the investigative tools and procedural steps the Office uses. This is the regulatory framework that governs how OpenAI, Anthropic, Google and similar companies are held accountable under EU law.

✓ Low compliance impact for SMEs

WHAT THE ARTICLE IS ABOUT

The AI Office’s enforcement authority over GPAI providers

Article 88 establishes the AI Office as the exclusive EU-level enforcement authority for the obligations of general-purpose AI model providers under Chapter V. It defines the enforcement procedure — from investigation initiation to finding of non-compliance and imposition of measures — and sets out the procedural rights of GPAI providers during enforcement proceedings.

WHAT IT SAYS

AI Office investigates, may impose measures, works with national authorities

The AI Office is responsible for supervising and enforcing the obligations of GPAI model providers, acting on behalf of the Union
Where the AI Office has reasons to suspect a GPAI provider has violated its obligations, it may initiate an investigation — either on its own initiative, following a qualified alert from the Scientific Panel, or following a request from a national market surveillance authority
During investigation, the AI Office may use its powers under Articles 91 (request documentation), 92 (conduct evaluations) and 93 (request measures)
National market surveillance authorities assist the AI Office in investigating GPAI models used on their territory
Where a GPAI model is also used as a high-risk AI system, both the AI Office and the relevant national market surveillance authority have jurisdiction — they must coordinate
The AI Office must give the GPAI provider the opportunity to be heard before making any finding of non-compliance
Findings of non-compliance and any measures imposed are communicated to the GPAI provider and, where appropriate, to national authorities and the public

WHO IS AFFECTED

GPAI model providers and downstream businesses using their models

All providers of GPAI models — the AI Office can investigate any of them
Downstream businesses building products on GPAI models — AI Office enforcement findings about the underlying model may affect their products
National market surveillance authorities who cooperate with and assist the AI Office
The Scientific Panel whose qualified alerts can trigger investigations

WHAT IT MEANS FOR SMES

AI Office enforcement of your vendors affects your compliance position

If you build products using GPAI model APIs — and the underlying model is found to violate the Act — you may need to update your product, change vendor, or demonstrate that the violation does not affect your specific use case
Monitor AI Office enforcement actions against GPAI providers you rely on — these are publicly communicated and directly relevant to your vendor risk
The AI Office enforcement framework applies from August 2025 — GPAI model providers should already be subject to investigation powers
For non-EU GPAI providers: the AI Office enforces against them through their authorised representative (Article 54) — the representative is your practical point of contact for enforcement-related queries
A finding of non-compliance against a GPAI model you use is a compliance trigger for your own AI governance — update your vendor assessment and consider what documentation you need from the provider

Article 53 — GPAI obligations (the obligations enforced under this article)
Article 55 — Systemic risk obligations (also enforced by the AI Office under this article)
Article 89 — Monitoring actions (the AI Office’s ongoing monitoring function)
Article 99 — Penalties (the fines the AI Office can impose following enforcement findings)

← Back to the Guide