On August 2, 2026, the European Commission's enforcement machinery for general-purpose AI models switches from off to on. The obligations themselves entered into force a year earlier, on August 2, 2025, but the Act gave the Commission a twelve-month grace window before it could actually do anything — issue requests for information, demand access to a model for evaluation, or fine a provider up to 3% of global annual turnover or €15 million, whichever is higher. That window closes in six weeks. The press will cover it as a deadline. It is more interesting than a deadline.
Because the instrument everyone is racing to comply with — the General-Purpose AI Code of Practice, published by the Commission on July 10, 2025 — is voluntary. And the way providers have signed it tells you more about the next decade of AI regulation than any enforcement date will.
Voluntary, and severable
The Code has three chapters: Transparency, Copyright, and Safety and Security. Signing it is not legally required. What signing buys you is administrative relief — the AI Office treats a signatory as presumptively in good standing, which means fewer information requests, more legal certainty, a lighter documentation burden. The alternative is to demonstrate compliance some other way, to a regulator who wrote the Code and will measure you against it anyway. So "voluntary" is doing a lot of quiet work. It is voluntary the way a tip is voluntary when the server is watching.
Here is the part nobody designed on purpose but everybody now exploits: the chapters are severable. You can sign some and not others.
xAI signed exactly one of the three chapters — Safety and Security — and declined Transparency and Copyright. That is not an oversight. That is a priced decision.
Read the menu the way a provider reads it. The Safety and Security chapter is the one you want your name on: it is reputational, it aligns with what every lab already says it does, and it commits you mostly to processes you can describe in a glossy report. The Copyright chapter is the expensive one. It asks you to respect machine-readable opt-outs, to not crawl what you were told not to crawl, to be able to say where your training data came from. The Transparency chapter asks you to document the model and its data in a form a regulator can inspect.
So watch what goes unsigned. xAI took the halo and left the two chapters that would constrain how it acquired its data. Meta declined the Code entirely. Google signed all three while publicly warning the rules might "slow innovation." Roughly two dozen providers — OpenAI, Anthropic, Microsoft, Amazon, IBM, Mistral — signed the full document.
The unsigned chapter is the map
If you want to know where a regulation actually bites, don't read the statute. Read which parts firms refuse to promise even when refusing is awkward and the promise is technically non-binding. Revealed preference beats stated preference, and a severable voluntary code is a revealed-preference machine.
What it reveals is that the contested ground in AI is no longer capability — every serious lab will happily sign up to evaluate dangerous capabilities, because that chapter flatters them — but provenance. The Copyright and Transparency chapters are the ones that touch the unaudited core of every frontier model: the corpus. The thing nobody wants to itemize. xAI's half-signature is the most honest document in the whole process, because it says out loud what the full signatories are betting you won't notice — that signing the safety chapter is cheap and signing the data chapters is not.
What August actually changes
When enforcement powers activate on August 2, the asymmetry sharpens. A full signatory gets the benefit of the doubt across all three areas. A partial signatory like xAI gets it on safety and carries the full burden of proof on transparency and copyright — to a Commission that now has the power to demand model access and levy that €15 million floor. The Code didn't just create a compliance path. It created a sorting hat. Come August, the providers who left chapters blank are the ones the AI Office already knows where to look.
None of this means the Code is a failure. A voluntary instrument that gets two dozen labs to commit, in writing, to copyright opt-outs and capability evaluations is a real achievement, and severability is probably what made the sign-on rates possible at all. But we should stop describing it as a checklist that the good actors complete and the bad actors ignore. It is a menu. Everyone ordered. The bill — requests, audits, fines — arrives on August 2. And the EU already has every provider's order written down.
