A major part of the AI Act became applicable
On August 2, 2025, the European Union’s obligations for providers of general-purpose AI models entered into application. The rules cover foundation models that can perform a broad range of tasks and sit underneath many downstream AI systems. They create duties for all covered providers and extra requirements for models considered capable enough to pose systemic risk.
The date was one step in a phased law rather than the moment the whole EU AI Act switched on. Prohibited-practice and AI-literacy provisions had begun earlier, while other rules follow later dates. For general-purpose models placed on the EU market after August 2, 2025, however, the new model-level obligations became the relevant baseline. The European Commission’s enforcement powers for these duties began on August 2, 2026, and older models receive a later transition deadline.
What providers must do
The European Commission lists several core obligations for covered general-purpose AI providers:
- maintain technical documentation on development, testing, capabilities, and limitations;
- give downstream system builders information they need to understand and integrate the model;
- adopt a policy designed to comply with EU copyright law and rights reservations;
- publish a sufficiently detailed summary of the content used to train the model; and
- appoint an authorized representative in the EU when the provider is established elsewhere, subject to applicable exceptions.
The Commission’s guidelines use a training-compute indicator, alongside the model’s generality, to clarify scope. They also explain when a party that substantially modifies an existing model may become a provider with its own duties. Some open-source models can receive exemptions from specific documentation obligations, but those exemptions are conditional and do not remove duties attached to systemic-risk models.
Additional rules for systemic risk
The Act presumes a general-purpose model has systemic risk when the cumulative compute used for training exceeds 10^25 floating-point operations, while allowing other capability evidence and future threshold changes to matter. Providers in this group face additional requirements: notify the AI Office, conduct model evaluations, assess and reduce systemic risks, document and report serious incidents, and provide adequate cybersecurity protection for the model and its physical infrastructure.
This is a risk-management framework, not a government declaration that a model is safe. Evaluation methods can miss emerging capabilities, and a compute threshold is an imperfect proxy. The Commission can update technical approaches as the field changes. Providers still need evidence that their controls work in the way the model is actually deployed.
The Code of Practice
Independent experts developed a voluntary General-Purpose AI Code of Practice, published on July 10, 2025, to help providers demonstrate compliance. Its transparency and copyright chapters apply broadly, while its safety and security chapter targets systemic-risk models. The code supplies a documentation form and practices for risk analysis, incident reporting, cybersecurity, and model evaluation.
Signing the code does not replace the law, and declining to sign does not itself prove non-compliance. A signatory can use the code as an agreed route to show how it meets obligations; another provider may use different adequate methods. The Commission and AI Board confirmed the code as an appropriate voluntary tool, and the official site publishes the current signatory list.
Limits and unresolved questions
Implementation details matter. A public training-content summary must be useful without exposing personal data, trade secrets, or security-sensitive information. Copyright policies must work across large, changing data pipelines. Downstream developers need enough technical information to evaluate a model, but they may still lack access to training data or internal test artifacts.
Enforcement also crosses borders. A provider outside Europe can still fall within scope when placing a model on the EU market. At the same time, legal classification depends on facts, model history, and specific exemptions; a short explainer cannot replace the regulation, Commission guidance, or legal advice for an individual product.
Why it matters
The 2025 milestone moved frontier-model governance from voluntary promises toward enforceable documentation and risk duties. It treated a general-purpose model as part of a supply chain: model providers must equip downstream builders with information, and the most capable providers must manage risks that can extend across many applications.
The framework’s value will depend on the quality of evaluations, incident disclosure, regulator expertise, and public summaries. Even with those uncertainties, the rules established a concrete European standard for transparency, copyright process, security, and systemic-risk management at the model layer.