The EU AI Act's model rules, one year in: what changed for builders

The general-purpose AI (GPAI) provisions of the EU AI Act, Chapter V of the regulation, have applied since 2 August 2025. Enforcement powers for the Commission’s AI Office follow a year later. That makes this a reasonable moment to set aside the speculation from 2024 and describe what the rules have actually meant in practice for the people building on and shipping these models.

Who is covered

The Act regulates providers of general-purpose AI models: the entity that develops a model and places it on the EU market, whether by API, by download or by embedding it in a product. It is separate from the risk-tiered rules for AI systems, which have their own timeline.

Three groups need to pay attention:

• Labs releasing models, closed or open-weight. They are providers and carry the Article 53 obligations directly.
• Companies that substantially modify a model. The Commission’s guidelines say a downstream modifier becomes the provider of a new model when the modification is significant, with training compute relative to the original as the primary indicator. Light fine-tuning on a few thousand examples is unlikely to qualify; a large continued pre-training run is.
• Deployers who build products on a model via API. They are generally not GPAI providers, but they inherit transparency duties under the AI system rules and depend on the upstream provider’s documentation to meet them.

Figure 1: The first question is whether you are a provider, a modifier who has become a provider, or a deployer.

The baseline obligations

Every GPAI provider must:

1. Maintain technical documentation covering training, testing and evaluation, and make it available to the AI Office on request.
2. Provide documentation to downstream builders so they can understand the model’s capabilities and limitations and meet their own obligations. In practice this is what a good model card has always been.
3. Have a copyright policy that respects EU copyright law, including honouring machine-readable opt-outs from text and data mining.
4. Publish a sufficiently detailed summary of training content, using the Commission’s template.

Open-weight models released under a free licence are exempt from the first two items, but not from the copyright policy or the training-data summary. That exemption falls away entirely for models with systemic risk.

Systemic risk

A model is presumed to pose systemic risk when the cumulative compute used to train it exceeds 10^25 floating-point operations. The Commission can also designate models below that line. Providers of these models must additionally:

• perform and document model evaluations, including adversarial testing;
• assess and mitigate systemic risks across the model’s lifecycle;
• track and report serious incidents to the AI Office; and
• ensure an adequate level of cybersecurity for the model and its infrastructure.

Most frontier releases from the major labs sit above the threshold. Most open-weight releases from smaller teams do not.

Figure 2: Every provider carries the middle column. Open-weight releases skip the documentation column unless the model carries systemic risk, which adds the third.

What actually changed

A year in, three practical effects stand out.

Model cards got longer and more uniform. The documentation requirements map closely onto what a thorough model card already contained, so the main change has been consistency: training-data summaries and copyright statements now appear where they were previously absent. See our guide on how to read a model card for what to look for.

The Code of Practice became the default compliance path. The Code is voluntary, but signatories get a presumption of conformity, and the AI Office has said it will focus enforcement attention elsewhere. Most large providers signed. A few declined publicly, citing legal uncertainty, and continue to argue their compliance case directly.

Downstream teams started asking for paperwork. Procurement questionnaires now routinely ask whether a vendor’s models are GPAI-compliant and whether a Code signatory sits upstream. If you sell into European enterprises, expect the question.

What still applies to you

If you only call an API, your obligations under Chapter V are indirect. Your direct obligations arrive through the AI-system rules: labelling AI-generated content, informing users they are interacting with an AI, and, for high-risk use cases, the full conformity regime that phases in through 2027.

If you fine-tune, keep a record of the compute you used. It is the number a regulator will ask for first.