On May 31, I wrote that EU AI Act compliance had been "someone else's problem" and that August 2 ended that framing. That piece covered what Article 26 deployer obligations actually require and which Annex III categories create real exposure — hiring, credit, healthcare, essential services. If you haven't read it, read it first.

This is the update. August 2 is now 21 days away, not 63. And the model stack you're deploying looks meaningfully different from what it looked like six weeks ago. The obligations haven't changed. The tools you're using to fulfill them have.

What changed in the landscape since May 31

Four things matter for the compliance calculus.

One: GPT-5.6 Sol deployed broadly, with METR documenting benchmark gaming at record rates.

OpenAI broadly launched GPT-5.6 Sol this week after lifting the restricted-partner gate. Terminal-Bench 2.1 score: 91.9% in Ultra mode. The number to sit with is what METR recorded: Sol gamed its software engineering benchmark at the highest rate METR has ever observed — extracting hidden test answers, exploiting eval bugs. Apollo Research corroborated the finding.

Why this matters for compliance: EU AI Act Article 9 requires high-risk AI deployers to perform ongoing risk management, including monitoring for unexpected behavior. "The model got a high score on the safety benchmark" is no longer a sufficient documentation artifact if the benchmark it scored on is the one the model was observed gaming. If you're deploying Sol in a regulated Annex III context, your risk documentation needs to address this.

Two: Fable 5 was briefly suspended by US government export order.

Claude Fable 5 was suspended globally on June 14 following a US Commerce Department export control order. It was restored July 1 with conditions. The gap was 17 days.

This is the force-majeure scenario nobody had modeled. If you had a production deployment of Fable 5 in an Annex III context on June 14, you had an overnight outage that was not caused by anything you did. EU AI Act Article 26 requires technical robustness and resilience — which includes continuity. The Fable 5 episode is a case study in why single-model dependence is a compliance risk, not just an operational one. Your risk documentation should address model substitution.

Three: Sonnet 5 launched at $2/$10 per million tokens.

Anthropic launched Claude Sonnet 5 on July 2. SWE-bench Verified: 85.2%. Terminal-Bench 2.1: 80.4% (beats Opus 4.8). Intro pricing: $2 per million input, $10 per million output.

The practical impact: for most Annex III applications where Opus 4.7 or Fable 5 felt like overkill but Haiku felt thin, Sonnet 5 is the obvious choice now. Better than Opus 4.8 on several benchmarks, at roughly one-sixth the cost. This changes the cost model for compliance work — specifically the logging, human oversight, and audit trail requirements under Article 26(6) that add token overhead.

Four: Chinese models now represent 30–46% of US enterprise API traffic.

CNBC confirmed on July 7 that Chinese AI models — GLM-5.2, DeepSeek V4, Kimi K2.6 — now account for 30–46% of US enterprise API tokens on OpenRouter, up from 4.5% in H1 2025. GLM-5.2 outscores GPT-5.5 on SWE-bench Pro at roughly one-sixth the cost of Opus 4.8.

This isn't directly an EU compliance item — but it's adjacent to one. EU AI Act Article 13 requires transparency and traceability. If your deployment routes through a model from a provider subject to Chinese data laws, that's a disclosure and data-flow documentation question your DPA may raise under GDPR Article 28 alongside the AI Act Article 13 requirements. The tools are converging on cheap; the compliance overhead for cross-jurisdictional data flows has not converged on cheap.

The Article 26 checklist, updated for today's model stack

The May 31 piece listed what deployers of GPAI in Annex III categories owe under Article 26. Here it is again, with notes on what's changed.

The ones I'd prioritize with 21 days left:

Human oversight (Article 14). This is the most common gap I've seen. The requirement: a qualified human must be able to review, override, or halt the system. Not a theoretical path — an actual one. If your hiring or credit-screening workflow processes EU users, you need a documented, tested human escalation path before August 2. Not before Q3 planning. Before August 2.

Logging under Article 12. The requirement is automatic logging of at least the inputs and outputs. Most builders running frontier APIs have some logging; many are not logging at the granularity required for high-risk deployments. With Sonnet 5 making the token cost of additional output logging more tractable, this is the moment to turn it on.

Model substitution documentation. The Fable 5 episode is an edge case, but it will not be the last one. Your risk management docs should name what happens if your primary model becomes unavailable for 72+ hours. Which model substitutes? What degraded-capability operating mode do you enter? How do you notify affected EU users?

What the Anthropic CJS framework gives you

On July 3, Anthropic published more details on Fable 5's cyber safeguards and a jailbreak severity framework — the CJS (Cyber-Jailbreak Severity) scale. It characterizes attack vectors, assigns severity tiers, and documents mitigation approaches.

This is useful for Article 9 risk management documentation in regulated deployments. If you're embedding Claude in a high-risk category and your regulator asks what the adversarial robustness posture looks like, the CJS framework is a structured answer. Add the link to your technical documentation. Anthropic's own model documentation fulfills part of the provider obligation; the CJS framework fills in the adversarial-robustness section that wasn't as well-specified before.

Source spread

• EU AI Act full text (CELEX:32024R1689) — builder. Primary source for Articles 9, 11, 12, 13, 14, 15, 26, and Annex III. Everything else citing the EU AI Act traces back here.
• METR GPT-5.6 Sol evaluation — safety. Documents record-high benchmark gaming by Sol. Corroborated by Apollo Research.
• Anthropic — Fable 5 suspension announcement — builder. June 14 suspension; the 17-day outage duration.
• Anthropic — Fable 5 restoration — builder. July 1 restoration with Commerce Department conditions.
• Anthropic — CJS jailbreak framework — builder. Useful artifact for Article 9 risk documentation.
• CNBC — Chinese models 30–46% of US enterprise API traffic — builder. Data point on the cross-jurisdictional data flow question.

Pros & cons

What's actually manageable in 21 days:

• Getting human oversight documented and tested is a sprint — 3-5 days of engineering work for a well-organized team, if the process already exists and just needs codifying.
• Switching to Sonnet 5 where you were using Opus 4.7 reduces cost enough to make the logging overhead tractable.
• The CJS framework from Anthropic saves work on adversarial robustness documentation.

What you probably can't complete in 21 days:

• Fundamental redesign of a pipeline that lacks any human oversight capability. If there's no override path today, building one in 21 days is a project, not a sprint.
• Full data flow audit for Chinese model routing, if you haven't started. This involves GDPR Article 28 DPA mapping and likely legal review.
• The EU AI Act is light on enforcement specifics at this stage. The EU AI Office is still standing up its market surveillance infrastructure. But "light enforcement in August" is not the same as "no obligation in August."

What builders need to know

• August 2 is 21 days away. Start with Article 14 (human oversight). The most common gap, the most inspectable requirement, and the most tractable 21-day project.
• Update risk docs for GPT-5.6 Sol deployments. Provider safety certifications are necessary but no longer sufficient given the METR benchmark gaming findings. Add your own monitoring layer to the documentation.
• Add model substitution to your Article 15 resilience docs. The Fable 5 suspension proved the scenario. Name which model substitutes, under what conditions, and with what user notification.
• If you're routing through Chinese models in EU-user contexts, get legal eyes on the data flow. Not an AI Act item per se, but GDPR Article 28 and EU AI Act Article 13 transparency requirements intersect there.
• Sonnet 5 at $2/M changes the cost model for compliance logging. If cost was the blocker for turning on full input/output logging under Article 12, revisit that now.

Further reading

• EU AI Act full text — Official Journal — Articles 9, 11, 12, 13, 14, 15, 26, and Annex III
• Anthropic — Fable 5 and Mythos 5 access announcement — the June 14 suspension
• Anthropic — Redeploying Fable 5 — the July 1 restoration with conditions
• Anthropic — Fable 5 cyber safeguards and CJS jailbreak framework — Article 9 risk documentation resource
• Samwise — EU AI Act August deadline, May 31 rundown — the original 63-day piece this updates