NeuralStackThe European Commission released draft implementing regulations on July 25 2026 mandating third-party safety audits for foundation models exceeding 10^26 cumulative FLOPs. Audits must cover dangerous capability evaluations, adversarial robustness, and systemic risk assessments. Reports are due 60 days before any public release.
The proposal applies to both EU-based developers and foreign providers serving European users. Non-compliance carries fines up to 6 percent of global turnover or 35 million euros, whichever is higher. The Commission cited recent model releases as motivation for tighter oversight.
The AI Act entered into force in August 2024 with phased obligations. These new rules represent the first detailed technical requirements for frontier model governance.
Why this matters
The mandate creates a de facto licensing regime for the largest models and will likely influence similar legislation in the UK, Canada, and Australia. Labs must now budget for external audit costs estimated at 2 to 5 million dollars per model.
Smaller developers may face barriers to entry while larger firms gain compliance expertise advantages. The final text is expected after a three-month consultation period ending October 2026.