Compliance content usually opens with a scare and closes with a product. I'll give you the dates straight and let you decide how scared to be.
The EU AI Act is in force. Obligations for general-purpose AI model providers took effect August 2, 2025. Enforcement against them begins August 2, 2026. Penalties run up to 15 million euro or 3 percent of global annual turnover, whichever is larger. Those are the numbers. They are not theoretical anymore.
Now the part most vendors get wrong, including, until recently, our own landing page.
Which article applies to you depends on what you build
There are two layers here and they get conflated constantly.
If you train or substantially fine-tune a foundation model and put it on the market, you are a GPAI model provider. Article 53 is yours. You owe technical documentation under Annex XI: architecture, parameters, training data, compute, capabilities, limitations. You also owe downstream integrators enough information to comply with their own obligations, which is Article 53(1)(b).
If you build an application on top of someone else's model, you are a downstream provider. You are not filing Article 53 paperwork. If your system lands in a high-risk category, your obligation is Article 11 plus Annex IV, the technical documentation for high-risk AI systems. You use the Article 53(1)(b) information your model provider hands you to help fill out your own file.
Most teams reading this are in the second group. So when a tool tells you it makes you "Article 53 compliant," check whether Article 53 is even your article. Usually it isn't.
What every one of these paperwork requirements has in common
Different articles, different annexes, same starting point: you cannot document a model inventory you have not taken.
Annex XI wants model and training detail. Annex IV wants a description of the AI system and its components. The downstream information package under 53(1)(b) wants capabilities and limitations passed along the chain. Every one of those documents references an inventory of what AI is in the system, where it came from, and what it depends on.
That inventory is exactly what an AI-BOM is. Models, hashed and versioned. Datasets, with lineage. MCP servers and API clients, with scope. The AI-BOM does not write your compliance documentation for you. It produces the structured, machine-readable layer that the documentation sits on top of. No tool turns the regulation off. The honest claim is narrower and more useful: this is the part of the work you can automate, so the human time goes to the part you cannot.
Why doing it now beats doing it in July 2026
Two reasons, neither of them about fear.
The format is settled. CycloneDX is an ECMA standard with an AI/ML-BOM profile. SPDX exists alongside it. You are not betting on a draft spec. The fields auditors will ask for already have a place to live.
The inventory is only useful if it is current. A model BOM you generate by hand once is stale the next time someone swaps a model or adds an MCP server. The teams that will be ready in 2026 are the ones generating this on every scan, not the ones planning a documentation sprint the month before enforcement.
What this means for you
If you ship AI into the EU market, or sell to anyone who does, you will be asked to produce documentation that references an AI inventory. You can build that inventory by hand under deadline, or have it written on every CI run starting now.
The org-wide view is where this stops being a per-repo chore. The SBOMix hosted dashboard keeps a history of every app's SBOM and AI-BOM, tracks coverage over time, and gives you one link to hand an auditor instead of a folder of stale JSON. That is the difference between "we can produce evidence" and "give us two weeks."
Start a hosted trial. Fourteen days, no card. Or keep it local and free with the CLI. Either way, start the inventory before the deadline turns it into a fire drill.
Next post gets practical. One GitHub Action, AI-BOM on every push, builds that block on critical CVEs.