EU obligations for general-purpose AI kicked in on 2 Aug 2025. Models already on the market before 2 Aug 2024, must be fully compliant by 2 Aug 2027 – but boards won’t wait that long.

Over the past few weeks I’ve sat with product, legal, and model teams that felt “compliance-ready” … until we opened the evidence drawer. That’s where most programs stall. The good news: the playbook is clear now. GPAI Code of Practice (10 Jul 2025) gives a pragmatic path, and the Guidelines for GPAI Providers (31 Jul 2025) remove a lot of scope ambiguity. Voluntary? Yes. But it’s the fastest way to show your house is in order while standards mature.

Here’s how I’d tackle this —no drama, just discipline. First, align on who you are in the Act (provider vs. deployer). Then make one leader accountable per model and wire compliance into your release process.

My advice, Companies should:

• Gap-assess every in-scope model against the Code. Do you have a copyright policy, a training-data summary, documented evals, and a working view of downstream disclosures? If any of those are fuzzy, you’re not ready.
• Stand up model cards and incident logs; add release gates that block launch without evidence. Map risks to your cyber program using CSF 2.0 so Security and Audit can speak the same language.
• Run an internal GPAI evidence audit. Publish an exec dashboard with: % of models with complete technical files and disclosures, incident MTTD/MTTR, and time-to-close regulator/customer info requests.

A quick reality check: big providers are splitting—some signalling they’ll sign the Code, others not. That’s strategy. Your advantage (especially if you’re an SME) is disciplined documentation that turns “we promise” into procurement-ready proof.

My rule of the thumb: if the CEO can’t see weekly movements on documentation completeness and incident handling, you are in pilot land – no matter how advanced the model sounds.

What would you put on a one-page dashboard to convince your CFO – and your largest EU customer – that your GPAI program in truly under control?