EU AI Act - GPAI Model Obligations (2 Aug 2025) and Enforcement (2 Aug 2026)

Transparency, copyright and safety obligations for general-purpose AI model providers from 2 August 2025; Commission fining powers of up to 3 percent of global turnover or EUR 15 million enforceable from 2 August 2026.

JurisdictionEuropean Union
CategoryAI Regulations
StatusActive
Effective date
Latest development

Analysis

The EU AI Act GPAI obligations apply from 2 August 2025, with a separate transition until 2 August 2027 for GPAI models already on the EU market before that date.[1][7][10] For systemic-risk GPAI models, the Act adds model evaluations, adversarial testing, incident reporting, and cybersecurity protections.[7][10]

Key Requirements

  • Maintain technical documentation for the GPAI model, including training and testing processes and evaluation results, and provide it to the AI Office or national competent authorities on request.[7][3]
  • Provide downstream information sufficient for AI providers integrating the GPAI model to understand capabilities, limitations, and integration requirements.[7][3]
  • Adopt and implement a copyright compliance policy covering EU copyright and related rights.[7][3]
  • Publish a sufficiently detailed summary of training content using the European Commission’s template for public summaries of training data/content.[7][4][9]
  • If the model presents systemic risk, perform model evaluations, including adversarial testing, to identify and mitigate risks.[7][10]
  • Track, document, and report serious incidents and corrective measures without undue delay to the AI Office and relevant national authorities.[7][10]
  • Ensure adequate cybersecurity protections for the model and its physical infrastructure.[7][10]
  • For models placed on the market before 2 August 2025, the compliance deadline for the GPAI chapter is 2 August 2027.[1][4][10]

Compliance Challenges

  • Training-data disclosure without exposing trade secrets is a common challenge because providers must publish a sufficiently detailed summary while still protecting proprietary datasets and methods.[7][9]
  • Building documentation that is both technical and operationally useful is difficult because the Act requires documentation for regulators and separate information for downstream integrators.[7][3]
  • Determining whether a model is “systemic risk” can be complex because the Commission’s guidance ties the concept to advanced models and high compute thresholds, requiring internal governance and technical evidence.[2][5][10]
  • Implementing adversarial testing at scale is operationally demanding because providers need repeatable evaluation pipelines, red-teaming capacity, and ongoing risk mitigation.[7][5]
  • Incident reporting readiness is hard for organizations without mature AI governance, since the Act expects tracking, documentation, and timely reporting of serious incidents.[7][10]
  • Example industry challenge: legal and compliance advisories note that the Commission’s July 2025 guidance, code of practice, and disclosure template were introduced specifically to clarify how providers should operationalize the new GPAI duties.[2][9]
  • Example industry challenge: law-firm analyses highlight that providers with models already on the market before 2 August 2025 must manage a separate transition period to 2 August 2027, creating portfolio-level compliance complexity.[3][4][6][10]

Implementation Best Practices

  • Create a GPAI compliance inventory that classifies each model by launch date, market status, and whether it may meet systemic-risk criteria.[1][7][10]
  • Map every Article 53 and Article 55 obligation to a named control owner, evidence artifact, review cadence, and escalation path.[7][3]
  • Use the Commission’s public training-content summary template to standardize disclosures across models and teams.[4][9]
  • Establish a model documentation pack containing training data provenance, evaluation methods, benchmark results, known limitations, and intended use restrictions.[7][3]
  • Run adversarial testing as a recurring process, not a one-time event, and document findings, mitigations, and re-tests.[7][5]
  • Implement an incident-management workflow with severity criteria, reporting triggers, and authority notification procedures aligned to the AI Office and national competent authorities.[7][10]
  • Adopt the GPAI Code of Practice and Commission guidance as implementation references where applicable, because they clarify expected operational controls and disclosure practices.[2][9]
  • Use established AI risk-management frameworks such as the NIST AI Risk Management Framework and the ISO/IEC 42001 AI management system standard to structure governance, risk, and monitoring processes.
  • Use model documentation and governance tools such as Model Cards, Datasheets for Datasets, and OpenAI Evals to support repeatable evidence generation and testing workflows.

Recent Updates

  • On 18 July 2025, the European Commission published draft guidelines clarifying the definition, scope, lifecycle obligations, systemic-risk criteria, and notification duties for GPAI providers.[2]
  • On 24 July 2025, the Commission published the template for the public summary of training content, supporting the new disclosure obligation.[4][9]
  • On 1 August 2025, the GPAI Code of Practice was formally approved, providing a practical reference for compliance implementation.[9]
  • On 2 August 2025, the GPAI obligations under the AI Act became applicable across the EU.[1][7][10]
  • On 2 August 2026, the AI Act becomes fully applicable in general, and the AI Office gains fuller enforcement capability according to the Commission’s published materials and commentary summarizing the implementation timeline.[1][2][6]
  • On 2 August 2027, GPAI models placed on the market before 2 August 2025 must be brought into compliance.[4][6][10]

Related Regulations

  • EU AI Act, Regulation (EU) 2024/1689 — the primary legal basis for GPAI obligations, including Article 53 and Article 55 duties.[1][7]
  • EU Copyright Directive — relevant because GPAI providers must maintain a policy to comply with EU copyright and related rights.[7][3]
  • NIST AI Risk Management Framework — not binding EU law, but useful for building risk controls, evaluation processes, and governance aligned to the Act’s documentation and mitigation duties.[7][10]
  • ISO/IEC 42001 — a management-system standard that can support structured AI governance, accountability, and continual improvement.[7][10]
  • ISO/IEC 23894 — AI risk management guidance that can complement systemic-risk identification and mitigation workflows.
  • GDPR — may overlap where training data, model outputs, or incident handling involve personal data processing.
  • DORA — may overlap for financial entities using GPAI in regulated ICT environments, especially where resilience, incident management, and third-party risk controls are relevant.

Industry Impact

  • Foundation-model providers face earlier compliance pressure than many other AI actors because GPAI obligations apply from 2 August 2025, before the broader AI Act regime fully applies in 2026.[1][10]
  • Large providers need new disclosure workflows for technical documentation and training summaries, which increases legal, ML engineering, and data-governance overhead.[7][4][9]
  • Systemic-risk models face a higher compliance burden because they require evaluation, adversarial testing, incident reporting, and cybersecurity controls beyond the baseline GPAI duties.[7][10]
  • Downstream AI developers may benefit from improved model documentation, because the Act requires GPAI providers to supply information needed for integration and compliance.[7][3]
  • Market-wide pressure toward standardized transparency artifacts is increasing because the Commission has issued a public-summary template and guidance intended to harmonize provider disclosures.[4][2][9]
  • Industry analyses and practitioner commentaries emphasize that the transition deadline for pre-existing models to 2027 creates a staged compliance market, with newer models needing immediate readiness and legacy models needing retrofit programs.[3][4][6][10]

Sources

Recent developments

  • — The EU AI Act’s **second wave of requirements** entered into force on 2025-08-02, bringing the core **GPAI model obligations** (technical documentation, downstream information, copyright policy, and public training data summaries) into effect for models placed on the market from that date, with a transition period until 2027-08-02 for existing models.[5] (source)
  • — Legal commentators note that with **GPAI obligations now in force**, models exceeding systemic‑risk thresholds face heightened duties around risk assessment and security, and businesses are adapting product roadmaps and governance structures to align with the new EU‑wide baseline.[7][8] (source)
  • — Updated high‑level summaries explain that **all GPAI providers** must now meet documentation, training‑data summary, and copyright obligations, while systemic‑risk GPAI models must additionally conduct evaluations, adversarial testing, incident tracking, and cybersecurity measures, intensifying compliance burdens for large‑scale models.[2] (source)
  • — Regulatory and compliance experts report that from 2025-08-02 **Chapter V GPAI rules** apply, creating a two‑tier regime (baseline transparency for all GPAI and enhanced obligations for systemic‑risk models), which is reshaping foundation‑model providers’ compliance programs and EU launch strategies.[4][8] (source)
  • — From 2025-08-02, **EU rules on general‑purpose AI models** formally apply, requiring transparency on training data, stronger copyright enforcement, and additional safety and security obligations for systemic‑risk models, with existing models given until 2027-08-02 to comply.[6] (source)
  • — The European Commission confirms that **GPAI model obligations under the AI Act** are applicable from 2025-08-02 as part of the phased implementation: GPAI rules now apply, while the Commission’s enforcement powers and high‑risk AI system obligations will follow in 2026.[1][5] (source)
  • — On 2025-08-01, the European Commission and AI Board **endorsed the GPAI Code of Practice** via adequacy decisions, clarifying that while adherence is voluntary, the Code provides a widely recognized way for GPAI model providers to demonstrate compliance with Chapter V obligations.[3] (source)
  • — On 2025-07-18, the Commission released **draft Guidelines on GPAI models**, offering interpretative guidance on key AI Act provisions for GPAI providers and signalling forthcoming detailed supervisory expectations ahead of the 2025-08-02 application date.[9] (source)
  • — Industry analysis highlights that the July 2025 **Commission guidance, Code of Practice, and disclosure template** significantly flesh out GPAI providers’ obligations, prompting companies to reassess documentation, transparency, and copyright compliance strategies under the AI Act.[7] (source)
  • — The European AI Office published the **final Code of Practice for GPAI providers** on 2025-07-10, a voluntary instrument structured around transparency, copyright, and safety/security, later endorsed by the Commission and AI Board to serve as a key compliance benchmark for GPAI obligations.[3] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates