EU AI Act obligations for general-purpose AI models start to apply

Rules for providers of general-purpose AI models became applicable across the EU on 2 August 2025, together with the AI Act's governance provisions. Providers had duties from that date, while AI Office enforcement powers followed on a delayed schedule.

What it is

General-purpose models are those that can perform a wide range of tasks and increasingly serve as the base for other AI systems. In the weeks before the start date, the Commission issued three support instruments: scope guidelines, the voluntary code of practice, and a template for the public summary of training content. According to the Commission, new models became enforceable by the AI Office one year after application, and models already on the market two years after.

What it requires

Every provider must keep technical documentation, comply with EU copyright law and publish a detailed summary of training content, which the Commission's template breaks down by data sources. Providers of models with systemic risk carry heavier duties, including an adequate level of cybersecurity protection for the model and its physical infrastructure. The AI Office can request documentation, evaluate models, order corrective measures and fine providers.

What security leaders should do

Most enterprises consume general-purpose models rather than train them, so the practical lever is the contract. Ask each model provider for its technical documentation and training-content summary, and confirm how it protects model weights and serving infrastructure. If your team fine-tunes or substantially modifies a model and places it on the EU market, get legal advice on whether that makes you a provider, because the documentation duties would then fall on you.