EU AI Act · GPAI · enforcement live since 2 Aug 2026
Independent third-party evidence for the AI Office — prove, don’t assert.
The GPAI Evidence Pack is a signed GSPC measurement pack a general-purpose AI provider can hand to the EU AI Office alongside its self-assessment: Ed25519-signed, three-state, deterministic, reproducible measurement of the provider’s model against our published axes. Your own claims say what you believe. A signed independent measurement says what was observed — and anyone can check it.
We measure. We do not certify, and this page will never tell you that you are compliant — that determination stays with the authorities.
The enforcement reality
On 2 August 2026 the EU AI Office’s supervision and enforcement powers over general-purpose AI (GPAI) models went live — and they reach back to the GPAI obligations that have applied since August 2025. From that date the AI Office can:
Technical documentation, training-data summary, copyright policy — and, for models with systemic risk, model evaluations and adversarial-testing records.
The AI Office can evaluate a model itself, or require the provider to have it evaluated.
Up to and including restriction or withdrawal of a model from the EU market.
Up to €15,000,000 or 3% of total worldwide annual turnover, whichever is higher, for GPAI-provider infringements.
A documentation request is answered with documents. An evaluation request is answered with evidence — and evidence that a third party measured, signed, and stands behind is a different object from evidence a provider generated about itself.
What the pack contains
GSPC axis results as Ed25519-signed, content-addressed cards. Every verdict is three-state — pass, fail, or UNMEASURED — and an axis we have not run is declared UNMEASURED, never implied.
Grading is deterministic code over recorded transcripts — no model scores another model. Re-run the harness on the same inputs and you get the same card, byte for byte.
The full method — axis definitions, statistical discipline, what a verdict does and does not mean — is public at /methodology and referenced from every card.
Read the methodology →Every card verifies against our published public key without contacting us. The AI Office — or anyone — can check the signature themselves at /gspc-verify or fully offline.
Verify a card →When a measurement is wrong, we publish the correction on a public feed — never a silent edit. The record a regulator holds stays checkable against the record we corrected.
Corrections feed (live JSON) →Why independent beats self-attested
Self-assessment has a structural problem: the party with the strongest interest in the answer is the party producing it. That is not an accusation of bad faith — it is why audited accounts exist, and why a regulator reading a self-attestation must discount it.
- ·Self-attested: unsigned prose, produced by the provider, method undisclosed, unrepeatable, silently revisable.
- ·Independently measured: signed cards, produced by a third party with a published method, deterministic and re-runnable, corrected in public when wrong — and verifiable by the regulator without trusting either of us.
- ·Honest about limits: what we have not measured is stamped UNMEASURED. A pack that admits its gaps is worth more to a supervisor than one that claims completeness.
The honest boundary
The GPAI Evidence Pack is measurement evidence. It is not legal advice, not certification, and not a conformity assessment. A signed card records what our instrument observed under our published method — nothing more. Whether a model or its provider complies with the EU AI Act is a determination that stays with the AI Office and the courts. We measure; we never decide.
No public prices. A grade is never sold — pricing for the enterprise pack lives behind the enterprise door, and it never changes a verdict.
Frequently asked
What changed on 2 August 2026 for GPAI providers?
The EU AI Office's supervision and enforcement powers over general-purpose AI models went live. From that date it can request documentation, conduct or require model evaluations, request mitigations, restrict or withdraw a model from the EU market, and fine GPAI providers up to €15,000,000 or 3% of total worldwide annual turnover — enforcing obligations that have applied since August 2025.
What is the GPAI Evidence Pack?
A signed GSPC measurement pack: independent third-party measurement evidence a GPAI provider can hand to the AI Office alongside its self-assessment. Each axis result is an Ed25519-signed, content-addressed card with a three-state verdict (pass, fail, or UNMEASURED), produced by deterministic, reproducible grading under a published methodology.
Is this a certification or a conformity assessment?
No. Council of AI is an independent measurement body. The pack is measurement evidence — not legal advice, not certification, and not a conformity assessment. Determination of compliance stays with the authorities.
Do regulators pay to verify the evidence?
No. Verification is free for everyone, forever — regulators, the public, and the provider's own counsel. A grade is never sold, and there are no public prices; commercial engagement happens behind the enterprise door.
Council of AI (CSOAI Ltd) is an independent measurement body. We issue measurements and signed attestation records — completion records, never certificates. Dates and figures above (2 Aug 2026 enforcement; €15M / 3% turnover) should be confirmed against Regulation (EU) 2024/1689 and the AI Office’s published guidance before you rely on them.