The European Union’s Artificial Intelligence Act, the world’s first comprehensive law for AI, is hitting a major milestone. Starting August 2, 2025, specific obligations for general-purpose AI models—like the ones powering ChatGPT, Gemini, and Claude—become enforceable. This means the companies behind these models must now follow strict rules on transparency, copyright, and safety.
For everyday users and businesses, this could change how AI tools are developed and used. You might see more details about what data was used to train models, and there could be more safeguards against harmful outputs. But it also raises questions about innovation, trade secrets, and how smaller developers can keep up. Let’s break down what’s changing and why it matters.
What Is the EU AI Act?
The EU AI Act is a landmark law that sets rules for artificial intelligence based on its risk level. It’s the first attempt by any major economy to regulate AI comprehensively. The Act was proposed in 2021, but the explosive growth of generative AI (like ChatGPT) forced lawmakers to add new provisions for general-purpose AI models—the engines behind these tools.
The Act is being rolled out in stages. The first phase, banning AI systems that pose unacceptable risks (like social scoring), took effect in February 2025. Now, starting August 2, 2025, the rules for general-purpose AI models kick in. The next big phase, covering high-risk AI systems, comes in August 2026.
Who Must Comply?
If you’re a company that develops a general-purpose AI model (like a large language model) and you make it available in the EU, you’re a ‘provider’ and must comply. This applies even if your company is based outside the EU. Also, if you build an AI application on top of such a model (a ‘downstream developer’), you’ll need to follow certain rules too.
Key Obligations for AI Model Providers
1. Transparency About Training Data
Providers must publish a detailed summary of the content used to train their models. This is a big deal because it addresses copyright concerns. For example, if a model was trained on millions of books, articles, or images, the provider must disclose that. This summary should be ‘sufficiently detailed’ to help rights holders know if their work was used.
2. Copyright Compliance Policy
Providers must have a policy to respect EU copyright law. This includes honoring the opt-out mechanism from the Digital Single Market Directive, which allows rights holders to reserve their works from being used for AI training. In practice, this might mean respecting robots.txt files on websites or other machine-readable signals.
3. Technical Documentation
Providers must maintain up-to-date technical documentation about the model, including its architecture, training process, and evaluation results. This documentation must be shared with downstream developers so they can understand the model’s capabilities and limitations.
4. Systemic Risk Obligations (for Very Large Models)
If a model is trained with more than 10^25 FLOPs (a measure of computational power), it’s considered to pose ‘systemic risk.’ Models like GPT-4 likely exceed this threshold. These providers face extra duties:
– Conduct model evaluations to identify risks.
– Perform adversarial testing (trying to break the model) to find vulnerabilities.
– Report serious incidents to the authorities.
– Implement cybersecurity protections.
How Will This Be Enforced?
The European AI Office, part of the European Commission, is the main enforcer for these GPAI rules. They can investigate, request information, and impose fines. For violations, the penalties can be up to €35 million or 7% of global annual turnover, whichever is higher. That’s a serious financial risk for big tech companies.
What About Open-Source Models?
The Act includes exemptions for models released under free and open-source licenses, unless they pose systemic risk. However, the definition of ‘open source’ here is strict: the model’s weights and architecture must be publicly available, and the model must not be offered as a paid service. This means many open-source models might still fall under the rules.
The Code of Practice
To help companies comply, the AI Office facilitated a ‘Code of Practice’ with input from industry, civil society, and academics. Finalized in April 2025, this code offers detailed guidance on meeting the obligations. While not legally binding, following the code gives a ‘presumption of conformity’—meaning regulators will assume you’re compliant if you follow it.
What’s the Impact?
For consumers, you might see more transparency from AI companies about what their models were trained on. There could also be improvements in safety, as systemic-risk models undergo more rigorous testing. For businesses using AI, you’ll likely get better documentation from model providers, helping you understand the tools you’re using.
However, there are concerns. Some companies argue that disclosing training data could reveal trade secrets. Smaller developers worry about the compliance burden. And rights holders are still figuring out how to enforce their opt-outs in practice.
The Bigger Picture
The EU is setting a global precedent. Other countries are watching to see how these rules work in practice. If successful, similar regulations might emerge elsewhere. But there’s also a risk of over-regulation, potentially stifling innovation or leading some companies to withhold their AI models from the EU market.
As we move forward, it’s crucial to balance the benefits of AI with the need for accountability. The EU AI Act is a bold experiment in doing just that.
The enforcement of GPAI obligations under the EU AI Act marks a pivotal moment in AI governance. It’s a step toward making AI more transparent and accountable, but it also brings challenges. Whether you’re a developer, a business, or just an AI user, these changes will shape the AI landscape in Europe and beyond.
Summary
- New rules for AI models: As of August 2, 2025, providers of general-purpose AI models in the EU must follow transparency, copyright, and documentation rules.
- Systemic risk models face extra scrutiny: Very large models (like GPT-4) must undergo evaluations, adversarial testing, and incident reporting.
- Enforcement is serious: The European AI Office can fine violators up to €35 million or 7% of global turnover.
- Open-source exemptions are narrow: Only truly open models (with public weights and architecture) are exempt, and only if they don’t pose systemic risk.
- A Code of Practice helps: Following the AI Office’s Code of Practice can demonstrate compliance.
FAQ
Q: What is a general-purpose AI model?
A: It’s an AI model that can perform a wide range of tasks, like generating text, images, or code. Examples include GPT-4, Claude, and Gemini.
Q: Do these rules apply to companies outside the EU?
A: Yes, if they make their AI models available in the EU market, they must comply, regardless of where they’re based.
Q: What happens if a company doesn’t comply?
A: They can face fines up to €35 million or 7% of their global annual turnover, whichever is higher.
Q: How will I know if an AI model was trained on my copyrighted work?
A: Providers must publish a summary of training data. If your work was used, you can then enforce your rights, like requesting an opt-out.
Q: Are open-source models exempt?
A: Only if they meet strict criteria: the weights and architecture are public, and the model isn’t offered as a paid service. Even then, they might face rules if they pose systemic risk.