EU AI Act moves from principle to procedure

The European Union finished writing its Artificial Intelligence Act in 2024, but the part hitting model makers now is less about slogans like “safe” and more about paperwork, thresholds, and who has to hand what to whom. On 22 April 2025, the European Commission opened a consultation to spell out those details for general-purpose models, and it said the feedback window would close on 22 May 2025. (digital-strategy.ec.europa.eu) That consultation was about the models underneath chatbots, coding tools, and image generators, not the apps people click on every day. The Commission said those foundation models can sit inside many downstream products, so the provider at the bottom of the stack has to give the companies above it enough information to build and comply. (digital-strategy.ec.europa.eu) The legal clock is already running. The European Commission says the obligations for providers of general-purpose artificial intelligence models started applying on 2 August 2025, even though the full law does not become broadly applicable until 2 August 2026. (digital-strategy.ec.europa.eu 1) (digital-strategy.ec.europa.eu 2) For every provider in that category, the core list is concrete: draw up technical documentation, put in place a copyright policy, and publish a summary of the training content. The Commission’s own fact page says those are the baseline duties for all general-purpose model providers. (digital-strategy.ec.europa.eu) The guidance also tries to answer the fight every company was about to have with its lawyers: what even counts as a “general-purpose” model, who counts as the “provider,” and when a model is considered placed on the market in Europe. In the April 2025 consultation notice, the Commission said those definitions were the point of the exercise because they decide who is inside the rulebook and who is outside it. (digital-strategy.ec.europa.eu) By July 2025, the Commission had moved from asking questions to giving its own answers. Its published guidelines say a model is treated as general-purpose when it clears technical criteria such as being trained with more than 10^23 floating point operations, which is a measure of computing work, and being able to generate language. (digital-strategy.ec.europa.eu) The same guidance narrows who gets tagged as a provider after a model changes hands. The Commission says only actors making significant modifications to a model take on provider obligations for that modified model, while minor changes do not trigger the same status. (digital-strategy.ec.europa.eu) There is a second lane for the biggest models. The Commission says models are presumed to carry “systemic risk” when they are trained with more than 10^25 floating point operations, and those providers must notify the Commission, assess and mitigate risk, report serious incidents, and maintain cybersecurity protections. (digital-strategy.ec.europa.eu 1) (digital-strategy.ec.europa.eu 2) To make that less abstract, the European Union also built a voluntary General-Purpose Artificial Intelligence Code of Practice with three chapters: Transparency, Copyright, and Safety and Security. The Commission says companies that sign it can use a Model Documentation Form to gather required information in one place and may get lower administrative burden and more legal certainty than firms proving compliance from scratch. (ec.europa.eu) (digital-strategy.ec.europa.eu) The enforcement dates show why this is turning into procurement work inside companies right now. The Commission says it can start enforcing these general-purpose model duties from 2 August 2026 for new models, while models already on the market before 2 August 2025 must comply by 2 August 2027. (digital-strategy.ec.europa.eu) (ec.europa.eu) So the change in Europe is not that artificial intelligence suddenly became regulated this week. The change is that model vendors are being pushed to produce audit-ready records about training data summaries, copyright controls, model changes, incident reporting, and access for downstream customers, and the companies buying those models now need contracts and review processes built to check that those records exist. (digital-strategy.ec.europa.eu 1) (digital-strategy.ec.europa.eu 2)