EU makes AI compliance operational

Europe’s artificial intelligence law stopped being a future compliance problem and started becoming a paperwork problem this week, because the European Commission closed consultation on draft procedure rules that tell officials how to investigate and evaluate certain cases under the law. The draft covers proceedings tied to general-purpose artificial intelligence models under Article 92, including how independent experts can be brought into evaluations. (dig.watch) That sounds dry until you remember what changed on 2 August 2025: the European Union’s obligations for providers of general-purpose artificial intelligence models started to apply across the bloc on that date. The Commission’s own guidance says those obligations are no longer theoretical for companies placing foundation-style models on the European market. (digital-strategy.ec.europa.eu) A general-purpose artificial intelligence model is the base engine that can be plugged into many products, the way one power grid can run thousands of buildings. The European Union says these models are “the foundation for many different AI systems,” which is why Brussels wrote one layer of rules for the base model itself, not just for the apps built on top. (digital-strategy.ec.europa.eu) For all providers of these models, the law now requires technical documentation, a copyright policy, and a public summary of the training content. For the small set of models judged to pose “systemic risk,” the obligations go further into risk assessment, incident reporting, notification to the Commission, and cybersecurity protections. (digital-strategy.ec.europa.eu) The Commission spent 2025 turning those broad duties into instructions companies can actually follow. On 22 April 2025 it opened a targeted consultation asking developers, downstream companies, academics, and civil society groups how the general-purpose artificial intelligence rules should work in practice. (digital-strategy.ec.europa.eu) Then on 18 July 2025 the Commission published formal guidelines on the scope of those obligations, just two weeks before the 2 August 2025 start date. Those guidelines were meant to answer a basic but expensive question for model makers: who counts as a provider, and which models actually fall inside the rulebook. (digital-strategy.ec.europa.eu) The Commission paired that guidance with a voluntary General-Purpose Artificial Intelligence Code of Practice published on 10 July 2025. The code is not the law itself, but Brussels describes it as a practical tool companies can use to show they are meeting the law’s transparency, copyright, and systemic-risk duties. (digital-strategy.ec.europa.eu) What is new now is the move from “what the law means” to “how a case gets handled when regulators open the file.” The draft procedure rules described in the consultation set out detailed arrangements for evaluations under Article 92 and for selecting outside experts, which is the machinery an enforcement system needs before it can run at scale. (dig.watch) This is also part of a wider build-out around the European Artificial Intelligence Office, the unit the Commission created to help implement and supervise the law. The Commission says the office is preparing multiple guidelines and support tools so companies can apply the Artificial Intelligence Act alongside other European Union rules instead of waiting for court fights to define everything. (digital-strategy.ec.europa.eu, digital-strategy.ec.europa.eu) For companies selling or deploying foundation models in Europe, the practical shift is simple: Brussels is no longer just publishing principles. It now has active obligations in force from 2 August 2025, published guidance on who must comply, a voluntary code for showing compliance, and draft procedures for how investigations around general-purpose models can actually be run. (digital-strategy.ec.europa.eu, digital-strategy.ec.europa.eu, dig.watch)