EU AI Office Issues First Binding Orders to Foundation Model Providers

The EU AI Office has moved from policy to enforcement, issuing binding compliance orders to three unnamed foundation model providers — the first such orders under the AI Act's general-purpose AI (GPAI) provisions. The violations cited involve insufficient transparency documentation and inadequate disclosure of adversarial testing methodologies, both of which are explicit requirements under the GPAI rules that took effect for high-capability models in August 2025. The companies have 60 days to remediate or face fines capped at 3% of global annual revenue, a number that translates to billions of dollars for the largest frontier model providers.

The AI Office has declined to name the three providers, citing ongoing proceedings, but the enforcement scope covers any foundation model with systemic risk designation — a threshold tied to training compute above 10^25 FLOPs. The transparency documentation requirements are not vague: providers must submit technical documentation covering training data provenance, capability evaluations, and red-teaming results to the AI Office, and must make summaries available to downstream deployers. The adversarial testing disclosure gap in particular signals that the AI Office is treating safety evaluations as a compliance artifact, not just an internal engineering process.

This enforcement action matters less for the fines themselves and more as a proof of concept: the AI Office has cleared its bureaucratic runway and is willing to act. The 60-day compliance window is tight enough to be disruptive for organizations that haven't built documentation pipelines into their model development cycles. It also sets a precedent for what