Will Brussels Dare to Demand the Source Code?

What the sequencing decides

The first weeks matter more than the statute text. If the office opens routine Article 91 requests to Code of Practice signatories, asking them to show how commitments map onto training summaries and systemic-risk reports, providers will treat the code as a compliance floor. If it waits for a spectacle, the industry will treat August as weather.

Signatories already include Amazon, Anthropic, Google, Mistral, OpenAI, and others. The commission's own GPAI guidelines promise signatories more trust and nonsignatories more paperwork. Meta remains the loudest holdout among major providers. Visible asymmetry is the only way that promise becomes a procurement signal instead of a brochure line.

Understaffed teeth

Euractiv and civil-society briefings have stressed the staffing mismatch: an office of roughly 145 people, with a thin slice on regulation, watching models that rewrite cyber offense baselines every quarter. Pour Demain has argued the GPAI supervisory capacity needs to scale toward hundreds of staff by 2030. Powers without evaluators become forms.

The Digital Omnibus may delay some high-risk system deadlines deeper into 2027. It does not, on current drafting, push back the August 2026 GPAI enforcement date. Frontier labs should not confuse the two calendars.

Across the Atlantic mirror

Washington is formalizing a voluntary pre-release review on August 1, one day earlier, after Commerce already used export controls to darken Claude Fable 5. Brussels is choosing the opposite theory of legitimacy: named articles, named fines, and the right to ask for the insides of the model.

That theory only works if someone asks. Early DSA proceedings against very large platforms showed that published investigations recalibrate compliance even before the first fine. The AI Office needs an equivalent signal, aimed at systemic cyber and loss-of-control risks rather than paperwork completeness.

So will Brussels dare to demand the source code? The statute says yes. The staffing chart says maybe. The next month of Article 91 letters will answer louder than any anniversary speech. If those letters never arrive, the rest of the world will correctly read the EU AI Act as a museum of unused tools.